How to fix – “message”: “services \”https:kubernetes-dashboard:\” is forbidden: User \”system:anonymous\” cannot get services/proxy in the namespace \”kube-system\””

Jun 30, 2020 kubernetes

Let me get to the point - You are trying to setup Kubernetes dashboard and you have pretty much done the following 2 steps -

Step 1 - Used kubectl command to install kubernetes dashaboard (Note- If the url is not accessible then please refer to https://kubernetes.io or https://github.com/kubernetes/dashboard for updated URL)

1kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0/aio/deploy/recommended.yaml

Step 2 - Started your kubernetes API server using

1kubectl proxy

But after above steps when you tried to access the kubernetes dashboard URL (http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/.) , you got the following error message.

 1{
 2  "kind": "Status",
 3  "apiVersion": "v1",
 4  "metadata": {
 5    
 6  },
 7  "status": "Failure",
 8  "message": "services \"https:kubernetes-dashboard:\" is forbidden: User \"system:anonymous\" cannot get services/proxy in the namespace \"kube-system\"",
 9  "reason": "Forbidden",
10  "details": {
11    "name": "https:kubernetes-dashboard:",
12    "kind": "services"
13  },
14  "code": 403
15}

Well do not worry we are going to fix the issue and we will see how RBAC works in kubernetes.

Root Cause of Error

You do not have user certificate installed at your end and that is the reason kubernetes does not trust you, eventually leading to HTTP 403 forbidden error .

Solution

Install the certificate into your browser, so that kubernetes trust your request. But the questions comes from where to get the certificate ?

So we are going to generate the certificate using kubeconfig file which is generated by kubeadm. Follow the below steps for generating the certificate

(If you are interested more in visual way to troubleshoot then please refer to following lab session as well as follow the guide.)