I'm trying to access the dashboard but I'm getting the following error

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "services \"kubernetes-dashboard\" is forbidden: User \"operation\" cannot get services/proxy in the namespace \"kube-system\"",
  "reason": "Forbidden",
  "details": {
    "name": "kubernetes-dashboard",
    "kind": "services"
  },
  "code": 403
}

My cluster role looks as the following.

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
    namespace: '*'
    name: pod-reader
rules:
    - apiGroups: ["", "extensions", "apps"]
      resources: ["pods"]
      verbs: ["get", "list", "watch"]

And my cluster role binding looks as the following.

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
    name: read-pods
roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: pod-reader
subjects:
    - kind: User
      name: operation
      namespace: kube-system

I'm well aware that this is fairly basic. But I tried to add all sorts of stuff to no avail. Any suggestions about how it should look?