Question

我正在尝试使用以下Terraform脚本通过Terraform Helm Provider安装Helm Chart

我已经成功使用Kubernetes提供程序部署了一些k8s资源，但不适用于Helm

terraform v0.11.13

provider.helm v0.10

provider.kubernetes v1.9

provider "helm" {
  alias           = "prdops"
  service_account = "${kubernetes_service_account.tiller.metadata.0.name}"
  namespace       = "${kubernetes_service_account.tiller.metadata.0.namespace}"

kubernetes {
 host                   = "${google_container_cluster.prdops.endpoint}"
 alias                  = "prdops"
 load_config_file       = false
 username = "${google_container_cluster.prdops.master_auth.0.username}"
 password = "${google_container_cluster.prdops.master_auth.0.password}"
 client_certificate     = "${base64decode(google_container_cluster.prdops.master_auth.0.client_certificate)}"
 client_key             = "${base64decode(google_container_cluster.prdops.master_auth.0.client_key)}"
 cluster_ca_certificate = "${base64decode(google_container_cluster.prdops.master_auth.0.cluster_ca_certificate)}"
}

}

resource "kubernetes_service_account" "tiller" {
  provider = "kubernetes.prdops"
  metadata {
    name      = "tiller"
    namespace = "kube-system"
  }
}


resource "kubernetes_cluster_role_binding" "tiller" {
  provider = "kubernetes.prdops"
  metadata {
    name = "tiller"
  }

  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = "tiller"
 }
  subject {
    kind      = "ServiceAccount"
    name      = "${kubernetes_service_account.tiller.metadata.0.name}"
    namespace = "${kubernetes_service_account.tiller.metadata.0.namespace}"
    api_group = ""
  }
}


resource "helm_release" "jenkins" {
  provider = "helm.prdops"
  name      = "jenkins"
  chart     = "stable/jenkins"
}

但是出现以下错误

  1 error(s) occurred:

* helm_release.jenkins: 1 error(s) occurred:

* helm_release.jenkins: rpc error: code = Unknown desc = configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list configmaps in the namespace "kube-system"

Answer 1

Helm使用一个称为耕till的服务器组件（在Helm v2中，他们正在新的Helm v3中摆脱它）。为了使头盔发挥作用，为分er器分配了一个服务帐户，以便与Kubernetes API进行交互。在这种情况下，分of的服务帐户似乎没有足够的权限执行该操作。

Answer 2

请检查分till荚是否在kube系统名称空间中运行。如果不重新安装头盔并进行头盔初始化，以便出现分till荚，我希望这个问题将得到解决。

使用Terraform Helm提供程序安装Helm图表时出错

2 个答案: