k8s replicationcontrollers is forbidden: User "system:serviceaccount:kubernetes-dashboard:kubernetes-dashboard" cannot list resource "replicationcontrollers" in API group "" in the namespace "default"

k8s dashboard安裝完成之后，kubectl describe secret kubernetes-dashboard-token-7nxrg -n kubernetes-dashboard,輸入得到的token，然后瀏覽器登錄發現資源一個都沒有，右上角一直報錯

 

 

 費了老大的功夫才明白是serviceaccount的問題,k8sdashboard出廠的serviceaccount權限太低，需要配置一個admin用戶，用它的token登錄即可。

創建Service Account

apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard

創建ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard

獲取admin的token

kubectl -n kubernetes-dashboard get secret $(kubectl -n kubernetes-dashboard get sa/admin-user -o jsonpath="{.secrets[0].name}") -o go-template="{{.data.token | base64decode}}"

用這個token重新登錄

 

 官方文檔：https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/creating-sample-user.md

 轉載k8s之RBAC授權模式 https://www.cnblogs.com/liusy01/p/14274815.html