0

我正在尝试使用以下 terraform 脚本使用 Terraform Helm Provider 安装 helm chart

我已经成功使用 Kubernetes 提供程序来部署一些 k8s 资源，但它不适用于 Helm

地形 v0.11.13

提供者.helm v0.10

提供者.kubernetes v1.9

provider "helm" {
  alias           = "prdops"
  service_account = "${kubernetes_service_account.tiller.metadata.0.name}"
  namespace       = "${kubernetes_service_account.tiller.metadata.0.namespace}"

kubernetes {
 host                   = "${google_container_cluster.prdops.endpoint}"
 alias                  = "prdops"
 load_config_file       = false
 username = "${google_container_cluster.prdops.master_auth.0.username}"
 password = "${google_container_cluster.prdops.master_auth.0.password}"
 client_certificate     = "${base64decode(google_container_cluster.prdops.master_auth.0.client_certificate)}"
 client_key             = "${base64decode(google_container_cluster.prdops.master_auth.0.client_key)}"
 cluster_ca_certificate = "${base64decode(google_container_cluster.prdops.master_auth.0.cluster_ca_certificate)}"
}

}

resource "kubernetes_service_account" "tiller" {
  provider = "kubernetes.prdops"
  metadata {
    name      = "tiller"
    namespace = "kube-system"
  }
}


resource "kubernetes_cluster_role_binding" "tiller" {
  provider = "kubernetes.prdops"
  metadata {
    name = "tiller"
  }

  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = "tiller"
 }
  subject {
    kind      = "ServiceAccount"
    name      = "${kubernetes_service_account.tiller.metadata.0.name}"
    namespace = "${kubernetes_service_account.tiller.metadata.0.namespace}"
    api_group = ""
  }
}


resource "helm_release" "jenkins" {
  provider = "helm.prdops"
  name      = "jenkins"
  chart     = "stable/jenkins"
}

但我收到以下错误

  1 error(s) occurred:

* helm_release.jenkins: 1 error(s) occurred:

* helm_release.jenkins: rpc error: code = Unknown desc = configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list configmaps in the namespace "kube-system"
4

2 回答 2

0

Helm 使用了一个称为 tiller 的服务器组件（在 Helm v2 中，他们正在新的 Helm v3 中去掉它）。为了使 helm 运行，为 tiller 分配了一个服务帐户以与 Kubernetes API 进行交互。在这种情况下，tiller 的服务帐户似乎没有足够的权限来执行操作。

于 2019-07-03T12:29:24.623 回答
0

请检查 tiller pod 是否在 kube-system 命名空间中运行。如果不重新安装 helm 并执行 helm init 以使分蘖 pod 出现，我希望这个问题能够得到解决。

于 2019-10-10T04:46:43.913 回答