Unable to install kubernetes charts on specified namespace

问题

I have installed a cluster on Google Kubernetes Engine.

And then, I created namespace "staging"

$ kubectl get namespaces
default       Active    26m
kube-public   Active    26m
kube-system   Active    26m
staging       Active    20m

Then, I switched to operate in the staging namespace

$ kubectl config use-context staging
$ kubectl config current-context
staging

And then, I installed postgresql using helm on staging namespace

helm install --name staging stable/postgresql

But I got:

Error: release staging failed: namespaces "staging" is forbidden: User "system:serviceaccount:kube-system:default" cannot get namespaces in the namespace "staging": Unknown user "system:serviceaccount:kube-system:default"

What does it mean..?? How to get it working..??

Thank youu..

回答1:

As your cluster is RBAC enabled, seems like your tiller Pod do not have enough permission.

You are using default ServiceAccount which lacks enough RBAC permission, tiller requires.

All you need to create ClusterRole, ClusterRoleBinding and ServiceAccount. With them you can provide necessary permission to your Pod.

Follow this steps

_1. Create ClusterRole tiller

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: tiller
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]

Note: I have used full permission here.

_2. Create ServiceAccount tiller in kube-system namespace

$ kubectl create sa tiller -n kube-system

_3. Create ClusterRoleBinding tiller

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: tiller
subjects:
- kind: ServiceAccount
  name: tiller
  namespace: kube-system
  apiGroup: ""
roleRef:
  kind: ClusterRole
  name: tiller
  apiGroup: rbac.authorization.k8s.io

Now you need to use this ServiceAccount in your tiller Deployment.

As you already have one, edit that

$ kubectl edit deployment -n kube-system tiller-deploy

Set serviceAccountName to tiller under PodSpec

回答2:

Try:

helm init --upgrade --service-account tiller

as suggested by Scott S in this comment.

来源：https://stackoverflow.com/questions/48556971/unable-to-install-kubernetes-charts-on-specified-namespace

标签

Kubernetes

kubernetes-helm