helm - cannot get resource "namespaces" in API group

Question

I installed Kubernetes, helm on the Ubuntu 16.04.6 Box, I want to deploy kubernetes-dashboard using helm but getting below error while installing it

$ helm install stable/kubernetes-dashboard --name dashboard-demo
Error: release dashboard-demo failed: namespaces "default" is forbidden: User "system:serviceaccount:kube-system:default" cannot get resource "namespaces" in API group "" in the namespace "default"

$ helm list
Error: configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list resource "configmaps" in API group "" in the namespace "kube-system"

Tools Version:

$ kubectl version
Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.1", GitCommit:"b7394102d6ef778017f2ca4046abbaa23b88c290", GitTreeState:"clean", BuildDate:"2019-04-08T17:11:31Z", GoVersion:"go1.12.1", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.1", GitCommit:"b7394102d6ef778017f2ca4046abbaa23b88c290", GitTreeState:"clean", BuildDate:"2019-04-08T17:02:58Z", GoVersion:"go1.12.1", Compiler:"gc", Platform:"linux/amd64"}

$ helm version
Client: &version.Version{SemVer:"v2.13.1", GitCommit:"618447cbf203d147601b4b9bd7f8c37a5d39fbb4", GitTreeState:"clean"}
Server: &version.Version{SemVer:"v2.13.1", GitCommit:"618447cbf203d147601b4b9bd7f8c37a5d39fbb4", GitTreeState:"clean"}

$ kubectl get pods --all-namespaces
NAMESPACE     NAME                                       READY   STATUS             RESTARTS   AGE
kube-system   calico-kube-controllers-58dc446999-zrwz6   1/1     Running            0          4h41m
kube-system   calico-node-wjczq                          1/1     Running            0          4h41m
kube-system   coredns-fb8b8dccf-fp9gx                    1/1     Running            0          4h41m
kube-system   coredns-fb8b8dccf-q574t                    1/1     Running            0          4h41m
kube-system   etcd-ubuntu1                               1/1     Running            1          4h40m
kube-system   kube-apiserver-ubuntu1                     1/1     Running            1          4h40m
kube-system   kube-controller-manager-ubuntu1            1/1     Running            2          4h40m
kube-system   kube-proxy-ztmms                           1/1     Running            1          4h41m
kube-system   kube-scheduler-ubuntu1                     1/1     Running            2          4h41m
kube-system   tiller-deploy-864c6f45bb-2585b             1/1     Running            0          6m55s

helm updated to latest version.

I followed this : https://stackoverflow.com/questions/46672523/helm-list-cannot-list-configmaps-in-the-namespace-kube-system but still facing same issue, how can we fixed it ?

Answer 1

Check https://github.com/helm/helm/issues/3130, this might help. I followed the instruction in the post:

kubectl --namespace kube-system create serviceaccount tiller

kubectl create clusterrolebinding tiller --clusterrole cluster-admin --serviceaccount=kube-system:tiller

helm init --service-account tiller --upgrade

This works for me.

Answer 2

By default, tiller stores release information in ConfigMaps in the namespace where it is running.

You can refer to the official Helm RBAC documentation for more information on setting up different RBAC scenarios for Tiller.

Kubernetes authorizes API requests using the API server. It evaluates all of the request attributes against all policies and allows or denies the request. All parts of an API request must be allowed by some policy in order to proceed. This means that permissions are denied by default.

For more details see: kubernetes authorization