Permission problems on fresh k3s install with ArgoCD

[a-bali]

Describe the bug

I installed a fresh k3s cluster and deployed headlamp with the manifest below. I then followed the 3 steps in the install guide, got the token, logged in successfully but I get permission issues such as:

nodes.metrics.k8s.io is forbidden: User "system:serviceaccount:kube-system:headlamp-admin" cannot list resource "nodes" in API group "metrics.k8s.io" at the cluster scope

and

events is forbidden: User "system:serviceaccount:kube-system:headlamp-admin" cannot list resource "events" in API group "" at the cluster scope
etc.

Basically I cannot get anything to show in the UI.

I used the manifest below for installing:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: headlamp
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://kubernetes-sigs.github.io/headlamp/
    chart: headlamp
    targetRevision: 0.31.1
    helm:
      values: |


        ingress:
          enabled: true
          className: "traefik"
          annotations:
            kubernetes.io/ingress.class: "traefik"
            cert-manager.io/cluster-issuer: "letsencrypt-dns"
          hosts:
            - host: headlamp.example.com
              paths:
                - path: /
                  type: ImplementationSpecific
          tls:
            - hosts:
                - headlamp.example..com
              secretName: headlamp-tls

  destination:
    server: https://kubernetes.default.svc
    namespace: apps
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

To Reproduce

Steps to reproduce the bug:

1. Install k3s and ArgoCD
2. Install headlamp with manifest above
3. Execute the steps in the install guide to get the token
4. Login with the token

Environment (please provide info about your environment):

k3s v1.32.5

[a-bali]

Further investigation shows that the helm install creates wrong clusterrolebinding (subject name is headlamp instead of headlamp-admin), to be further investigated why...