Collectives™ on Stack Overflow

Find centralized, trusted content and collaborate around the technologies you use most.

Teams

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

"The ClusterRoleBinding "kubernetes-dashboard" is invalid: roleRef: Invalid value" when deploying Web UI

I'm trying to deploy Kubernetes Web UI as described here: https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/

My system configuration is as follows:

$ uname -a
Linux debian 4.19.0-6-amd64 #1 SMP Debian 4.19.67-2+deb10u2 (2019-11-11) x86_64 GNU/Linux
$ /usr/bin/qemu-system-x86_64 --version
QEMU emulator version 3.1.0 (Debian 1:3.1+dfsg-8+deb10u3)
$ minikube version
minikube version: v1.5.2
commit: 792dbf92a1de583fcee76f8791cff12e0c9440ad-dirty
$ kubectl version
Client Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.3", GitCommit:"b3cbbae08ec52a7fc73d334838e18d17e8512749", GitTreeState:"clean", BuildDate:"2019-11-13T11:23:11Z", GoVersion:"go1.12.12", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.2", GitCommit:"c97fe5036ef3df2967d086711e6c0c405941e14b", GitTreeState:"clean", BuildDate:"2019-10-15T19:09:08Z", GoVersion:"go1.12.10", Compiler:"gc", Platform:"linux/amd64"}
After starting the minukube cluster minikube start I created a Service Account and ClusterRoleBinding as described here: https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/creating-sample-user.md
$ nano dashboard-adminuser.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard
$ kubectl apply -f dashboard-adminuser.yaml
$ nano dashboard-adminuser.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard
$ kubectl apply -f dashboard-adminuser.yaml
Now I execute:
$ kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta6/aio/deploy/recommended.yaml
$ kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/master/aio/deploy/recommended.yaml
and get the following output:
namespace/kubernetes-dashboard configured
serviceaccount/kubernetes-dashboard configured
service/kubernetes-dashboard configured
secret/kubernetes-dashboard-certs configured
secret/kubernetes-dashboard-csrf configured
secret/kubernetes-dashboard-key-holder configured
configmap/kubernetes-dashboard-settings configured
role.rbac.authorization.k8s.io/kubernetes-dashboard configured
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard configured
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard configured
deployment.apps/kubernetes-dashboard configured
service/dashboard-metrics-scraper configured
deployment.apps/dashboard-metrics-scraper configured
The ClusterRoleBinding "kubernetes-dashboard" is invalid: roleRef: Invalid value: rbac.RoleRef{APIGroup:"rbac.authorization.k8s.io", Kind:"ClusterRole", Name:"kubernetes-dashboard"}: cannot change roleRef
What happened and how to fix it?
The error "cannot change roleRef" was referring to the fact that the ClusterRoleBinding already existed.
Try deleting the existing ClusterRoleBinding  kubernetes-dashboard
Run below to delete existing:
kubectl delete clusterrolebinding kubernetes-dashboard
After that try installing again. Let us know if that resolves the issue.
                I ran this command kubectl delete clusterrolebinding kubernetes-dashboard, then  kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/master/aio/deploy/recommended.yaml and still getting the same error.
– Skyblade
                Dec 3, 2019 at 19:58
                I still get this error. I use this manifest: raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-rc2/aio/…
– Mohammad Alavi
                Jan 26, 2020 at 17:59
issue is you missed this note :
NOTE: apiVersion of ClusterRoleBinding resource may differ between Kubernetes versions.
Prior to Kubernetes v1.8 the apiVersion was rbac.authorization.k8s.io/v1beta1.
This should solve this problem.
Edit1:
this issue talks about same problem.  specifically this comment. talks about
Role bindings are immutable
Cause here is
dashboard-adminuser.yaml sets roleRef.
yaml file you are applying later has roleRef in same namespace.
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kubernetes-dashboard
subjects:
  - kind: ServiceAccount
    name: kubernetes-dashboard
    namespace: kubernetes-dashboard
                My kubernetes version is 1.16.2, so I can use rbac.authorization.k8s.io/v1. I also checked kubectl api-versions which showed me both rbac.authorization.k8s.io/v1 and rbac.authorization.k8s.io/v1beta1, so it's not the case.
– Skyblade
                Dec 3, 2019 at 19:56
                After your edit I found dashboard project readme with the deployment instructions: github.com/kubernetes/dashboard. They are slightly different from the official kubernetes.io docs. I was able to start the Web UI process without errors, though I have another issue that prevents me from logging into it. So, I accept your answer as correct. Thank you!
– Skyblade
                Dec 5, 2019 at 19:08
kubectl apply -f dashboard-adminuser.yaml 
namespace/kubernetes-dashboard created
serviceaccount/admin-user created
clusterrolebinding.rbac.authorization.k8s.io/admin-user unchanged
3) Install dashboard
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0-beta6/aio/deploy/recommended.yaml
namespace/kubernetes-dashboard unchanged
serviceaccount/kubernetes-dashboard created
service/kubernetes-dashboard created
secret/kubernetes-dashboard-certs created
secret/kubernetes-dashboard-csrf created
secret/kubernetes-dashboard-key-holder created
configmap/kubernetes-dashboard-settings created
role.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard created
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-dashboard created
deployment.apps/kubernetes-dashboard created
service/dashboard-metrics-scraper created
deployment.apps/dashboard-metrics-scraper created
I'm getting this error too, solved by running dashboard through minikube:
minikube dashboard
Output:
🤔  Verifying dashboard health ...
🚀  Launching proxy ...
🤔  Verifying proxy health ...
🎉  Opening http://127.0.0.1:34653/api/v1/namespaces/kubernetes-dashboard/services/http:kubernetes-dashboard:/proxy/ in your default browser...
                Yes, it works, but my goal was to set up it manually using the guide not relying on minikube's implementation.
– Skyblade
                Jan 14, 2020 at 12:14
        
Thanks for contributing an answer to Stack Overflow!
Please be sure to answer the question. Provide details and share your research!
But avoid …
Asking for help, clarification, or responding to other answers.
Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.