Introduction

The error "dial tcp 10.44.0.2:8443: connect: connection refused" when accessing the Kubernetes dashboard means the API server cannot reach the dashboard pod on port 8443. The IP 10.44.0.2 is the dashboard pod's ClusterIP, and 8443 is its HTTPS port. "Connection refused" indicates the dashboard pod is either not running, crashed, listening on a different port, or blocked by a network policy. The fix depends on which of these is the cause.

The Error

Error trying to reach service: 'dial tcp 10.44.0.2:8443: connect: connection refused'

This error appears in the browser when you access the dashboard URL through kubectl proxy or a NodePort/LoadBalancer service. The Kubernetes API server is proxying the request to the dashboard service, but the backend pod rejects the TCP connection.

Step 1: Check if the Dashboard Pod Is Running

kubectl get pods -n kubernetes-dashboard

Expected output:

NAME                                         READY   STATUS    RESTARTS   AGE
kubernetes-dashboard-6c7b7fc4b8-x2kpl       1/1     Running   0          3h
dashboard-metrics-scraper-5b8896d7fc-qnz4l   1/1     Running   0          3h

If the STATUS is CrashLoopBackOff, Error, or Pending, the dashboard is not running. Check the logs:

kubectl logs -n kubernetes-dashboard deployment/kubernetes-dashboard

Common log errors:

• Certificate issues: dashboard cannot find or load its TLS certificate
• Permission denied: RBAC prevents the dashboard from accessing the API
• Port already in use: another process is using port 8443

Step 2: Verify the Service Configuration

kubectl get svc -n kubernetes-dashboard

NAME                        TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)    AGE
kubernetes-dashboard        ClusterIP   10.96.45.123   <none>        443/TCP    3h
dashboard-metrics-scraper   ClusterIP   10.96.45.124   <none>        8000/TCP   3h

Check that the service port and target port match what the pod is listening on:

kubectl describe svc kubernetes-dashboard -n kubernetes-dashboard

Port:              443/TCP
TargetPort:        8443/TCP
Endpoints:         10.44.0.2:8443

If Endpoints is <none>, the service cannot find any matching pods. This means the pod labels do not match the service selector, or no pods are running.

Step 3: Check Pod Labels Match Service Selector

1# Get the service selector
2kubectl get svc kubernetes-dashboard -n kubernetes-dashboard -o jsonpath='{.spec.selector}'
3# Output: {"k8s-app":"kubernetes-dashboard"}
4
5# Check pod labels
6kubectl get pods -n kubernetes-dashboard --show-labels

The pod must have the label k8s-app=kubernetes-dashboard for the service to route traffic to it.

Step 4: Verify Network Connectivity

Test connectivity from within the cluster:

1# Run a temporary debug pod
2kubectl run test-net --rm -it --image=busybox -n kubernetes-dashboard -- sh
3
4# From inside the debug pod, try to reach the dashboard
5wget --no-check-certificate -qO- https://kubernetes-dashboard:443
6# Or directly by pod IP
7wget --no-check-certificate -qO- https://10.44.0.2:8443

If this also fails with "connection refused," the dashboard pod is genuinely not listening. If it works from the debug pod but not from outside, the issue is with the proxy or network policy.

Step 5: Check kubectl proxy Configuration

The most common access method:

1# Start the proxy
2kubectl proxy
3
4# Access the dashboard at:
5# http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/

Common mistakes in the URL:

• Missing https: prefix: http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/kubernetes-dashboard:/proxy/ fails because the service uses HTTPS
• Wrong namespace: the dashboard may be in kubernetes-dashboard or kube-system depending on installation method
• Proxy not running: the proxy must remain running in a terminal session

Step 6: Reinstall the Dashboard

If the pod is in a crash loop or the configuration is broken, reinstall:

1# Delete existing installation
2kubectl delete -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yaml
3
4# Reinstall
5kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yaml
6
7# Wait for pods to be ready
8kubectl rollout status deployment/kubernetes-dashboard -n kubernetes-dashboard

For Kubernetes Dashboard v3 (newer versions):

helm repo add kubernetes-dashboard https://kubernetes.github.io/dashboard/
helm upgrade --install kubernetes-dashboard kubernetes-dashboard/kubernetes-dashboard \
  --create-namespace --namespace kubernetes-dashboard

Step 7: Create a Service Account for Access

The dashboard often shows the error page because there is no valid authentication token:

1# Create admin user
2kubectl create serviceaccount dashboard-admin -n kubernetes-dashboard
3kubectl create clusterrolebinding dashboard-admin \
4  --clusterrole=cluster-admin \
5  --serviceaccount=kubernetes-dashboard:dashboard-admin
6
7# Get the token
8kubectl create token dashboard-admin -n kubernetes-dashboard

Copy the token and paste it into the dashboard login page.

Alternative Access Methods

1# NodePort — expose dashboard on a node port
2kubectl patch svc kubernetes-dashboard -n kubernetes-dashboard \
3  -p '{"spec": {"type": "NodePort"}}'
4kubectl get svc kubernetes-dashboard -n kubernetes-dashboard
5# Access at https://<node-ip>:<node-port>
6
7# Port forward — simpler than kubectl proxy
8kubectl port-forward -n kubernetes-dashboard svc/kubernetes-dashboard 8443:443
9# Access at https://localhost:8443

Common Pitfalls

• Wrong namespace: Older installations put the dashboard in kube-system. Newer versions use kubernetes-dashboard. Check both: kubectl get pods -A | grep dashboard.
• NetworkPolicy blocking traffic: If you have NetworkPolicies in the kubernetes-dashboard namespace, they may block ingress from the API server. Add a policy that allows traffic from kube-system or the API server CIDR.
• Self-signed certificate warnings: The dashboard uses a self-signed TLS certificate by default. Browsers block this with NET::ERR_CERT_AUTHORITY_INVALID. Accept the risk or install a valid certificate.
• Dashboard version incompatible with cluster: Dashboard v2.x requires Kubernetes 1.21+. Dashboard v3.x requires Kubernetes 1.25+. An incompatible version crashes on startup. Check the compatibility matrix in the dashboard release notes.
• Minikube-specific access: On Minikube, use minikube dashboard which handles proxy setup automatically. Manual kubectl proxy may not work correctly with Minikube's networking.

Summary

• "Connection refused" means the dashboard pod is not accepting connections on port 8443
• Check pod status first: kubectl get pods -n kubernetes-dashboard
• Verify the service has endpoints: kubectl describe svc kubernetes-dashboard -n kubernetes-dashboard
• Ensure pod labels match the service selector
• Use kubectl port-forward as a simpler alternative to kubectl proxy
• Reinstall the dashboard if the pod is in a crash loop
• Create a service account and token for dashboard authentication