<p>I am using this command in Helm 3 to install kubernetes dashboard 2.2.0 in kubernetes v1.18,the OS is CentOS 8:</p>
<pre><code>helm repo add kubernetes-dashboard https://kubernetes.github.io/dashboard/
helm repo update
helm install k8s-dashboard/kubernetes-dashboard --generate-name --version 2.2.0
</code></pre>
<p>the installing is success,but when I check the pod status,it shows <code>CrashLoopBackOff</code> like this:</p>
<pre><code>[root@localhost ~]# kubectl get pods --all-namespaces -o wide
NAMESPACE     NAME                                               READY   STATUS             RESTARTS   AGE     IP              NODE                    NOMINATED NODE   READINESS GATES
default       kubernetes-dashboard-1594440918-549c59c487-h8z9l   0/1     CrashLoopBackOff   15         87m     10.11.157.65    k8sslave1               &lt;none&gt;           &lt;none&gt;
default       traefik-5f95ff4766-vg8gx                           1/1     Running            0          34m     10.11.125.129   k8sslave2               &lt;none&gt;           &lt;none&gt;
kube-system   calico-kube-controllers-75d555c48-lt4jr            1/1     Running            0          36h     10.11.102.134   localhost.localdomain   &lt;none&gt;           &lt;none&gt;
kube-system   calico-node-6rj58                                  1/1     Running            0          14h     192.168.31.30   k8sslave1               &lt;none&gt;           &lt;none&gt;
kube-system   calico-node-czhww                                  1/1     Running            0          36h     192.168.31.29   localhost.localdomain   &lt;none&gt;           &lt;none&gt;
kube-system   calico-node-vwr5w                                  1/1     Running            0          36h     192.168.31.31   k8sslave2               &lt;none&gt;           &lt;none&gt;
kube-system   coredns-546565776c-45jr5                           1/1     Running            40         4d13h   10.11.102.132   localhost.localdomain   &lt;none&gt;           &lt;none&gt;
kube-system   coredns-546565776c-zjwg7                           1/1     Running            0          4d13h   10.11.102.129   localhost.localdomain   &lt;none&gt;           &lt;none&gt;
kube-system   etcd-localhost.localdomain                         1/1     Running            0          14h     192.168.31.29   localhost.localdomain   &lt;none&gt;           &lt;none&gt;
kube-system   kube-apiserver-localhost.localdomain               1/1     Running            0          14h     192.168.31.29   localhost.localdomain   &lt;none&gt;           &lt;none&gt;
kube-system   kube-controller-manager-localhost.localdomain      1/1     Running            0          14h     192.168.31.29   localhost.localdomain   &lt;none&gt;           &lt;none&gt;
kube-system   kube-proxy-8z9vs                                   1/1     Running            0          38h     192.168.31.31   k8sslave2               &lt;none&gt;           &lt;none&gt;
kube-system   kube-proxy-dnpc6                                   1/1     Running            0          4d13h   192.168.31.29   localhost.localdomain   &lt;none&gt;           &lt;none&gt;
kube-system   kube-proxy-s5t5r                                   1/1     Running            0          14h     192.168.31.30   k8sslave1               &lt;none&gt;           &lt;none&gt;
kube-system   kube-scheduler-localhost.localdomain               1/1     Running            0          14h     192.168.31.29   localhost.localdomain   &lt;none&gt;           &lt;none&gt;
</code></pre>
<p>so I just check the kubernetes dashboard pod logs and see what happen:</p>
<pre><code>[root@localhost ~]# kubectl logs kubernetes-dashboard-1594440918-549c59c487-h8z9l
2020/07/11 05:44:13 Starting overwatch
2020/07/11 05:44:13 Using namespace: default
2020/07/11 05:44:13 Using in-cluster config to connect to apiserver
2020/07/11 05:44:13 Using secret token for csrf signing
2020/07/11 05:44:13 Initializing csrf token from kubernetes-dashboard-csrf secret
panic: Get &quot;https://10.20.0.1:443/api/v1/namespaces/default/secrets/kubernetes-dashboard-csrf&quot;: dial tcp 10.20.0.1:443: i/o timeout

goroutine 1 [running]:
github.com/kubernetes/dashboard/src/app/backend/client/csrf.(*csrfTokenManager).init(0xc0000a2080)
    /home/runner/work/dashboard/dashboard/src/app/backend/client/csrf/manager.go:41 +0x446
github.com/kubernetes/dashboard/src/app/backend/client/csrf.NewCsrfTokenManager(...)
    /home/runner/work/dashboard/dashboard/src/app/backend/client/csrf/manager.go:66
github.com/kubernetes/dashboard/src/app/backend/client.(*clientManager).initCSRFKey(0xc0005a4100)
    /home/runner/work/dashboard/dashboard/src/app/backend/client/manager.go:501 +0xc6
github.com/kubernetes/dashboard/src/app/backend/client.(*clientManager).init(0xc0005a4100)
    /home/runner/work/dashboard/dashboard/src/app/backend/client/manager.go:469 +0x47
github.com/kubernetes/dashboard/src/app/backend/client.NewClientManager(...)
    /home/runner/work/dashboard/dashboard/src/app/backend/client/manager.go:550
main.main()
    /home/runner/work/dashboard/dashboard/src/app/backend/dashboard.go:105 +0x20d
</code></pre>
<p>I am tried to access this resource using curl in host machine to see if the master server is response properly:</p>
<pre><code>[root@localhost ~]# curl -k https://10.20.0.1:443/api/v1/namespaces/default/secrets/kubernetes-dashboard-csrf
{
  &quot;kind&quot;: &quot;Status&quot;,
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;metadata&quot;: {
    
  },
  &quot;status&quot;: &quot;Failure&quot;,
  &quot;message&quot;: &quot;secrets \&quot;kubernetes-dashboard-csrf\&quot; is forbidden: User \&quot;system:anonymous\&quot; cannot get resource \&quot;secrets\&quot; in API group \&quot;\&quot; in the namespace \&quot;default\&quot;&quot;,
  &quot;reason&quot;: &quot;Forbidden&quot;,
  &quot;details&quot;: {
    &quot;name&quot;: &quot;kubernetes-dashboard-csrf&quot;,
    &quot;kind&quot;: &quot;secrets&quot;
  },
  &quot;code&quot;: 403
}
</code></pre>
<p>this is my master node and k8sslave1 firewalld status:</p>
<pre><code>[root@localhost ~]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: inactive (dead)
     Docs: man:firewalld(1)


[root@k8sslave1 ~]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor &gt;
   Active: inactive (dead)
     Docs: man:firewalld(1)
lines 1-4/4 (END)
</code></pre>
<p>so where is the problem? what should I do to make the dashbord running success?</p>

Dolphin
<p>The problem is that you didn't specify <strong>ClusterRole</strong> for the serviceaccount attached to the dashboard pod.</p>
<p>I've used this chart few months ago and i have to provide custom values.yaml as following :</p>
<pre><code># myvalues.yaml
#these are mine
rbac:
  clusterReadOnlyRole: true # &lt;--- 🔴 YOU NEED this one
  clusterAdminRole: false
extraArgs:
  - --enable-skip-login
  - --enable-insecure-login
  - --system-banner=&quot;Welcome to Company.com Kubernetes Cluster&quot;
</code></pre>
<p>As you can see <code>rbac.enabled</code> is not enough, you need to specify also <code>rbac.clusterReadOnlyRole=true</code>.</p>
<p>Or if you want to give more access to the Dashboard, set true to <code>rbac.clusterAdminRole</code>.</p>
<p>Now, you can upgrade your helm release using values file above :</p>
<pre><code>helm install &lt;generate-release-name&gt; k8s-dashboard/kubernetes-dashboard \
   --version 2.2.0 \
   -f myvalues.yaml
</code></pre>
