title: user permissions needed for token access to kubernetes dashboard with RBAC
body: <p>On kubernetes 1.8.4 I'm trying to give kubernetes users access to our dashboard.</p>
  
  <p>When using the admin context to proxy, all the tokens work when logging into the dashboard. But my users don't have the admin context, only I do, so they use their own context to proxy. And in those situations, they get an error.</p>
  
  <p><strong>Steps:</strong></p>
  
  <ol>
  <li>Create a service account for a user, put token in <code>~/.kube/config</code></li>
  <li>Give permissions to namespace A to that service account through rolebinding</li>
  <li>Switch to that user's context</li>
  <li>Do deployments, get pod overview, etc, verify it works. all fine so far</li>
  <li>Start <code>kubectl</code> proxy, still in that user's context</li>
  <li>Open browser, go to <a href="http://localhost:8001/ui" rel="nofollow noreferrer">http://localhost:8001/ui</a></li>
  <li><p>See this in the browser:</p>
  
  <pre><code>{
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Failure",
    "message": "
        forbidden: User \"system:serviceaccount:default:&lt;username&gt;\"
            cannot get path \"/ui\"",
    "reason": "Forbidden",
    "details": {},
    "code": 403
  }
  </code></pre></li>
  <li><p>try <a href="http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/" rel="nofollow noreferrer">http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/</a></p></li>
  <li><p>See this in the browser:</p>
  
  <pre><code>{
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Failure",
    "message": "
        services \"https:kubernetes-dashboard:\" is forbidden:
        User \"system:serviceaccount:default:&lt;username&gt;\" cannot get services/proxy in the namespace \"kube-system\"",
    "reason": "Forbidden",
    "details": {
      "name": "https:kubernetes-dashboard:",
      "kind": "services"
    },
    "code": 403
  }
  </code></pre></li>
  </ol>
  
  <p>Clearly a permission problem. I'm not sure which permission the user needs to have to enable them to access the dashboard though. I'm very hesitant to give them permissions into the kube-system namespace.</p>
  
  <p>When I stop kubectl proxy and then switch to the admin context, start the proxy and retry the same url, I get the dashboard login page.</p>
  
  <p>What do I need to do to get that same result when using the user's context?</p>