Motivation

PR #3208 moved the web server to use the new tap APIService. This means that tap requests can be unauthorized when made from the linkerd-web service account. PR #3203 introduced a full access ClusterRole and binds linkerd-web to it, so these errors are not encountered right now.

If Linkerd is installed with --restrict-dashboard-privileges, then this error can occur and is displayed as an error banner shown below:

An error banner is probably not the best medium for communicating to the user that they are missing the authorization required for tapping the requested resources.

Proposed Solution

There was some follow-up discussion in #3208 where @adleong suggested moving this to the content of the Tap/Top table may be friendlier.