helm list :“kube-system”네임 스페이스에있는 configmap을 나열 할 수 없습니다.

helm list :“kube-system”네임 스페이스에있는 configmap을 나열 할 수 없습니다.

---

kubernetes 8 클러스터에 helm 2.6.2를 설치했습니다. helm init잘 작동했습니다. 하지만 실행 helm list하면이 오류가 발생합니다.

 helm list
Error: configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list configmaps in the namespace "kube-system"

이 RABC 오류 메시지를 수정하는 방법은 무엇입니까?

---

다음 명령이 실행되면 :

kubectl create serviceaccount --namespace kube-system tiller
kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
kubectl patch deploy --namespace kube-system tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'      
helm init --service-account tiller --upgrade

실행되면 문제가 해결되었습니다.

---

보다 안전한 답변

허용되는 답변은 최고의 보안 솔루션이 아닌 Helm에 대한 전체 관리자 액세스 권한을 부여합니다. 조금 더 작업하면 Helm의 액세스를 특정 네임 스페이스로 제한 할 수 있습니다. Helm 문서 에 자세한 내용이 있습니다 .

$ kubectl create namespace tiller-world
namespace "tiller-world" created
$ kubectl create serviceaccount tiller --namespace tiller-world
serviceaccount "tiller" created

Tiller가 다음 tiller-world과 같이 모든 리소스를 관리 할 수 ​​있도록하는 역할을 정의합니다 role-tiller.yaml.

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tiller-manager
  namespace: tiller-world
rules:
- apiGroups: ["", "batch", "extensions", "apps"]
  resources: ["*"]
  verbs: ["*"]

그런 다음 다음을 실행하십시오.

$ kubectl create -f role-tiller.yaml
role "tiller-manager" created

에서 rolebinding-tiller.yaml,

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tiller-binding
  namespace: tiller-world
subjects:
- kind: ServiceAccount
  name: tiller
  namespace: tiller-world
roleRef:
  kind: Role
  name: tiller-manager
  apiGroup: rbac.authorization.k8s.io

그런 다음 다음을 실행하십시오.

$ kubectl create -f rolebinding-tiller.yaml
rolebinding "tiller-binding" created

나중에 네임 스페이스에 helm initTiller를 설치하기 위해 실행할 수 있습니다 tiller-world.

$ helm init --service-account tiller --tiller-namespace tiller-world

Now prefix all commands with --tiller-namespace tiller-world or set TILLER_NAMESPACE=tiller-world in your environment variables.

More Future Proof Answer

Stop using Tiller. Helm 3 removes the need for Tiller completely. If you are using Helm 2, you can use helm template to generate the yaml from your Helm chart and then run kubectl apply to apply the objects to your Kubernetes cluster.

helm template --name foo --namespace bar --output-dir ./output ./chart-template
kubectl apply --namespace bar --recursive --filename ./output -o yaml

---

Helm runs with "default" service account. You should provide permissions to it.

For read-only permissions:

kubectl create rolebinding default-view --clusterrole=view --serviceaccount=kube-system:default --namespace=kube-system

For admin access: Eg: to install packages.

kubectl create clusterrolebinding add-on-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:default

---

The default serviceaccount does not have API permissions. Helm likely needs to be assigned a service account, and that service account given API permissions. See the RBAC documentation for granting permissions to service accounts: https://kubernetes.io/docs/admin/authorization/rbac/#service-account-permissions

---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: tiller
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tiller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: tiller
    namespace: kube-system

kubectl apply -f your-config-file-name.yaml

and then update helm instalation to use serviceAccount:

helm init --service-account tiller --upgrade

---

I got a this error while trying to install tiller in offline mode, I thought the 'tiller' service account didn't have enough rights but at it turns out that a network policy was blocking the communication between tiller and the api-server.

The solution was to create a network policy for tiller allowing all egress communication of tiller

참고URL : https://stackoverflow.com/questions/46672523/helm-list-cannot-list-configmaps-in-the-namespace-kube-system