Helm in a kops cluster with RBAC 

I created a K8S cluster on AWS with kops.

I ran helm init to install tiller in the cluster.

I ran helm list  to see if it worked.

I got this:

That sucked. And google proved … reluctant. What I could figure out is:

Causes

  • kops sets up the cluster with RBAC enabled (which is good)
  • helm (well, tiller) uses a standard role for doing things (which might be ok, at least it was with my stackpoint cluster), but in that case (for whatever reason) it did not have sufficient privileges
  • so we need to prepare some cluster admin roles for helm to use

Fixes

Just do exactly as it says in the helm docs 🙂 :

  • apply the RBAC yaml file which creates the kube-system/tiller service account, and binds this to the cluster-admin  role.
  • install helm with: helm init --service-account tiller

Is that secure? Not so much. With helm you can still do anything to the cluster at all. I might get to this in a later post.