使用Terraform Helm provider安装helm chart时出错

Question

我正在尝试使用以下Terraform脚本安装带有terraform helm Provider的Helm chart

我已经成功地使用Kubernetes provider部署了一些k8s资源，但它不适用于Helm

terraform v0.11.13

provider.helm v0.10

provider.kubernetes v1.9

provider "helm" {
  alias           = "prdops"
  service_account = "${kubernetes_service_account.tiller.metadata.0.name}"
  namespace       = "${kubernetes_service_account.tiller.metadata.0.namespace}"

kubernetes {
 host                   = "${google_container_cluster.prdops.endpoint}"
 alias                  = "prdops"
 load_config_file       = false
 username = "${google_container_cluster.prdops.master_auth.0.username}"
 password = "${google_container_cluster.prdops.master_auth.0.password}"
 client_certificate     = "${base64decode(google_container_cluster.prdops.master_auth.0.client_certificate)}"
 client_key             = "${base64decode(google_container_cluster.prdops.master_auth.0.client_key)}"
 cluster_ca_certificate = "${base64decode(google_container_cluster.prdops.master_auth.0.cluster_ca_certificate)}"
}

}

resource "kubernetes_service_account" "tiller" {
  provider = "kubernetes.prdops"
  metadata {
    name      = "tiller"
    namespace = "kube-system"
  }
}


resource "kubernetes_cluster_role_binding" "tiller" {
  provider = "kubernetes.prdops"
  metadata {
    name = "tiller"
  }

  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = "tiller"
 }
  subject {
    kind      = "ServiceAccount"
    name      = "${kubernetes_service_account.tiller.metadata.0.name}"
    namespace = "${kubernetes_service_account.tiller.metadata.0.namespace}"
    api_group = ""
  }
}


resource "helm_release" "jenkins" {
  provider = "helm.prdops"
  name      = "jenkins"
  chart     = "stable/jenkins"
}

但是我得到了以下错误

  1 error(s) occurred:

* helm_release.jenkins: 1 error(s) occurred:

* helm_release.jenkins: rpc error: code = Unknown desc = configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list configmaps in the namespace "kube-system"

Answer 1

Helm使用了一个叫做tiller的服务器组件(在Helm v2中，他们在新的Helm v3中去掉了它)。为了让helm正常工作，tiller被分配了一个服务帐户来与Kubernetes API交互。在这种情况下，似乎tiller的服务帐户没有足够的权限执行该操作。

Answer 2

请检查tiller pod是否在kube-system命名空间中运行。如果没有，请重新安装helm并执行helm init，这样操纵器pod就会出现，我希望这个问题能得到解决。