I recently was trying to get Helm up and running on a new AKS (Azure Kubernetes Service) cluster, and got an error during the Tiller configuration step. If you’re reading this, you might have hit the same issue, and I’ll explain you how to resolve this.

The issue itself is related to RBAC

(at least in my case) the issue was related to RBAC. RBAC in Kubernetes is a mechanism to allow or deny specific users to take certain actions against the cluster. Those actions are describes in a role.

There are two concepts that are necessary for RBAC, a Role and an RoleBinding. Both are available in either a namespace-specific version (Role and RoleBinding) or cluster-wide (ClusterRole and ClusterRoleBinding). A Role sets the permissions that can be granted to a user – the RoleBinding links a user to a specific Role.

The server side component of helm (at least until helm v3, which will drop the Tiller comporent), needs those RBAC permissions to execute its deployments against the Kubernetes cluster. This role and role assignment needs to be created prior to installing Tiller on the cluster. So, let’s have a look at how to create this role and role assignment for Tiller to be able to install.

Solving the issue, the quick and dirty way

The easiest way to solve this problem is by executing the following 2 commands:

kubectl create serviceaccount --namespace kube-system tiller
kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller

The first one will create a serviceaccount, the second one creates the clusterrolebinding to a built-in cluster role called cluster-admin (all access). And with that, you are able to install Tiller on your Kubernetes cluster.

helm init --service-account tiller

Please be very mindful when doing this on your production clusters. Giving Tiller the cluster-admin role gives Tiller the full set of keys to your kingdom. It might make sense to setup Tiller per namespace or give it limited access to certain namespaces.

Solving the issue, the YAML way

Who ever said yaml was hard? You can setup the service account and clusterrolebinding as well via Kubernetes YAML files.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: tiller
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tiller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: tiller
    namespace: kube-system

Afterwards, you can go ahead and apply this yaml file and get tiller installed.

kubectl create -f rbac-config.yaml
helm init --service-account tiller

In summary

If you run into the issue I had while installing Helm/Tiller, I hope you found a quick solution in this quick post. Please be mindful about assigning the cluster-admin role to Tiller as Tiller will be able to control everything across your cluster.