Dashboard: Unknown user in kubernetes dashboard

[magnusart]

Steps to reproduce

• In GKE I created brand new cluster in europe-west1-d with default settings (1.7.5-gke.1, 1v cpu, container-os etc)
• Changed nodes to 1 node and hit create
• Disabled the legacy mode authorization
• Setup connection with instruction under connect button in GCE ui
• Started kubectl proxy
• Navigated to http://localhost:8001/ui
• Unknown user error as shown below

Environment

Installation method: 
Kubernetes version:
Dashboard version: @@BUILD_DASHBOARD_VERSION
Commit: @@BUILD_GIT_COMMIT

Observed result

Dashboard reported Forbidden (403):

User "system:serviceaccount:kube-system:default" cannot list jobs.batch in the namespace "default".: "Unknown user \"system:serviceaccount:kube-system:default\"" (get jobs.batch)

Comments

This might be purely GKE related (I suspect the authorization mode), so maybe this is not the correct forum for this error report. If you have any suggestions on how to route it to the right place, please advice and close this issue.

Also tried in incognito window in case some cookie/local storage was causing trouble. Same result.
I am able to use kubectl to send commands (I tried to create a namespace) but I can still not see anything in the dashboard so it seems to be a configuration error in the dashboard.

[maciaszczykm]

Few things:

• Yes, it is probably cluster-related.
• You should check out https://github.com/kubernetes/dashboard/issues/2415, however, it is a bit different.
• I guess, that your Dashborad version is quite old. Please check and update it (you Dashboard version doesn't handle auth well I suppose).

Also tried in incognito window in case some cookie/local storage was causing trouble. Same result.

It is not the case. Your cluster does not allow you to enter this page. You have to change your setup.

Take a read at https://github.com/kubernetes/dashboard/wiki/Accessing-dashboard and https://github.com/kubernetes/dashboard/wiki/Access-control.

Let us know if you need more help.

[floreks]

Duplicate of #2328, #2326 and probably more.

It's not an Dashboard issue but rather configuration. You should read about configuring access to kubernetes and access control in Dashboard.

[magnusart]

For future reference for someone wanting to work around this issue it was due to GKE legacy mode authorization and the dashboard not playing nice out of the box. Reverted to the default legacy mode and it works fine.

[soickm]

Thank you @magnusart for finding the solution. Thanks also for the non-pedantic response. Others should follow your lead :)

[Markbnj]

Ran into this issue in GKE recently on a 1.9.6 cluster. We received the error above from the dashboard and also had a similar error when trying to run helm against the cluster. Two 1.9.6 clusters in other projects continued to function correctly. On investigation learned that somehow legacy authorization had become disabled in the cluster having the issue. Edited it in the console to reenable and the issue was solved.