kubespray dashboard warning forbidden popups
kubectl create clusterrolebinding default-admin --clusterrole cluster-admin --serviceaccount=default:defaultseems to do the trick - I'd welcome an explanation though.(Is it an oversight in kubespray? I need to set up a variable there? Is it related to RBAC?)
The dashboard pod is running with default service account , and that account by default dont have permissions, you can see the token of the default service account inside th dashboard pod:
kubectl exec -it <dashboard-pod> bashls -al /var/run/secrets/kubernetes.io/serviceaccountThe command you run in your answer , sets the required permisions for the default service account used by dashboard pod.