Error while installing Helm chart using Terraform helm provider

Question

I am trying to install helm chart with Terraform Helm Provider using the following terraform script

I'm already succeed to use Kubernetes provider to deploy some k8s ressources, but it doesn't work with Helm

terraform v0.11.13

provider.helm v0.10

provider.kubernetes v1.9

provider "helm" {
  alias           = "prdops"
  service_account = "${kubernetes_service_account.tiller.metadata.0.name}"
  namespace       = "${kubernetes_service_account.tiller.metadata.0.namespace}"

kubernetes {
 host                   = "${google_container_cluster.prdops.endpoint}"
 alias                  = "prdops"
 load_config_file       = false
 username = "${google_container_cluster.prdops.master_auth.0.username}"
 password = "${google_container_cluster.prdops.master_auth.0.password}"
 client_certificate     = "${base64decode(google_container_cluster.prdops.master_auth.0.client_certificate)}"
 client_key             = "${base64decode(google_container_cluster.prdops.master_auth.0.client_key)}"
 cluster_ca_certificate = "${base64decode(google_container_cluster.prdops.master_auth.0.cluster_ca_certificate)}"
}

}

resource "kubernetes_service_account" "tiller" {
  provider = "kubernetes.prdops"
  metadata {
    name      = "tiller"
    namespace = "kube-system"
  }
}


resource "kubernetes_cluster_role_binding" "tiller" {
  provider = "kubernetes.prdops"
  metadata {
    name = "tiller"
  }

  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = "tiller"
 }
  subject {
    kind      = "ServiceAccount"
    name      = "${kubernetes_service_account.tiller.metadata.0.name}"
    namespace = "${kubernetes_service_account.tiller.metadata.0.namespace}"
    api_group = ""
  }
}


resource "helm_release" "jenkins" {
  provider = "helm.prdops"
  name      = "jenkins"
  chart     = "stable/jenkins"
}

but I'm geting the following error

  1 error(s) occurred:

* helm_release.jenkins: 1 error(s) occurred:

* helm_release.jenkins: rpc error: code = Unknown desc = configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list configmaps in the namespace "kube-system"

Blokje5 Blokje5 · Accepted Answer · 2019-07-03T12:29:24

Helm uses a server component (in Helm v2, they are getting rid of it in the new Helm v3) called tiller. In order for helm to function, tiller is assigned a service account to interact with the Kubernetes API. In this case it seems the service account of tiller has insufficient permissions to perform the operation.

Error while installing Helm chart using Terraform helm provider

2 Answers