使用地形 helm 提供程序安装helm 图表时出错"用户"client"无法创建部署。命名空间中的扩展"kube-system""

Question

>我正在尝试使用以下地形脚本使用Helm Provider安装 helm

data "google_client_config" "current" {}
provider "helm" {
  tiller_image = "gcr.io/kubernetes-helm/tiller:${var.helm_version}"
  max_history  = 250
  kubernetes {
    host                   = "${google_container_cluster.eu.endpoint}"
    token                  = "${data.google_client_config.current.access_token}"
    client_certificate     = "${base64decode(google_container_cluster.eu.master_auth.0.client_certificate)}"
    client_key             = "${base64decode(google_container_cluster.eu.master_auth.0.client_key)}"
    cluster_ca_certificate = "${base64decode(google_container_cluster.eu.master_auth.0.cluster_ca_certificate)}"
  }
}
resource "helm_release" "mydatabase" {
  name  = "mydatabase"
  chart = "stable/mariadb"
  set {
    name  = "mariadbUser"
    value = "foo"
  }
  set {
    name  = "mariadbPassword"
    value = "qux"
  }
}

但是我收到以下错误

* helm_release.mydatabase: 1 error(s) occurred:
* helm_release.mydatabase: error installing: deployments.extensions is forbidden: User "client" cannot create deployments.extensions in the namespace "kube-system"

我认为当地形舵手提供者尝试安装舵柄时，就会发生这种情况，任何人都可以提供帮助

Answer 1

好吧，你走对了，但是......在这里我同意@hk'。

helm_release.mydatabase：安装错误：deployments.extensions is 禁止：用户"客户端"无法在 命名空间"kube-system

以上错误仅属于授权。很多人在安装和配置Helm提供程序时遇到了困难。例如 github 开放问题。有几个想法可能会对您有所帮助。

本文描述了可能对您有用的方法：头盔提供者是痛苦。其中有一个适合人们的解决方案。

下一步尝试：

resource "kubernetes_service_account" "tiller" {
  metadata {
    name      = "tiller"
    namespace = "kube-system"
  }
  automount_service_account_token = true
}
resource "kubernetes_cluster_role_binding" "tiller" {
  metadata {
    name = "tiller"
  }
  role_ref {
    kind      = "ClusterRole"
    name      = "cluster-admin"
    api_group = "rbac.authorization.k8s.io"
  }
  subject {
    kind = "ServiceAccount"
    name = "tiller"
    api_group = ""
    namespace = "kube-system"
  }
}
provider "helm" {
  version = "~> 0.7"
  debug           = true
  install_tiller  = true
  service_account = "${kubernetes_service_account.tiller.metadata.0.name}"
  namespace       = "${kubernetes_service_account.tiller.metadata.0.namespace}"
  tiller_image    = "gcr.io/kubernetes-helm/tiller:v2.11.0"
  kubernetes {
    config_path = "~/.kube/${var.env}"
  }
}

或

resource "kubernetes_service_account" "tiller" {
  metadata {
    name = "tiller"
    namespace = "kube-system"
  }
}
resource "kubernetes_cluster_role_binding" "tiller" {
  metadata {
        name = "tiller"
  }
  subject {
    api_group = "rbac.authorization.k8s.io"
    kind      = "User"
    name      = "system:serviceaccount:kube-system:tiller"
  }
  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind  = "ClusterRole"
    name = "cluster-admin"
  }
  depends_on = ["kubernetes_service_account.tiller"]
}
provider "helm" {
    tiller_image = "gcr.io/kubernetes-helm/tiller:v2.12.3"
    install_tiller = true
    service_account = "tiller"
    namespace = "kube-system"
}

Answer 2

这是与角色和授权相关的问题。 使用"Helm 重置"重置 HELM，然后运行以下命令来解决您的问题。

卷曲 https://raw.githubusercontent.com/helm/helm/master/scripts/get> get_helm.sh

CHMOD 700 get_helm.sh

./get_helm.sh

kubectl create serviceaccount --namespace kube-system tiller

Kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system：tiller

舵手初始化

kubectl patch deploy --namespace kube-system tiller-deploy -p '{"spec"：{"template"：{"spec"：{"serviceAccount"："tiller"}}}}'