Failed to create clusterrole when trying to deploy nginx-ingress about helm-tiller HOT 11 CLOSED

I will open a PR to add that to docs

from helm-tiller.

Closing this issue as I created the PR GoogleCloudPlatform/cloud-builders-community#111

from helm-tiller.

ah, Google Cloud Build one example supports no RBAC only, as I got some those errors there too, need to find out why

from helm-tiller.

the only way I found for now, is to create and use service account which has cluster-admin role there

from helm-tiller.

Thank you, can you please tell me how can I make the plugin to use a service account with cluster-admin role?

from helm-tiller.

it is not the plugin itself, you need to put the service account to GCS bucket and part of cloud build step download it (of course it is better to encrypt it with KMS first), then add to helm.bash:

gcloud auth activate-service-account --key-file /gcloud-service-key.json

from helm-tiller.

I need to find a time to update the helm there to support service account

from helm-tiller.

Oh, thank you very much for guidance. Simple but effective 👍

from helm-tiller.

try for this user to add user=&{XXXXXXXXXX@XXXXXX RBAC role:

kubectl create clusterrolebinding cluster-admin-XXXXXXXXXX-XXXXXX \ 
   --clusterrole cluster-admin --user XXXXXXXXXX@XXXXXX

Of course replace xxx with the real user from the your logs :)

Such trick did work for me.

from helm-tiller.

ok, I dug deeper:

gcloud iam service-accounts describe [email protected]

it will describe the service account of the cloud-builder and the uniqueId: is your user you need for RBAC role.

So I made a simple shell script to create RBAC cluster-admin users:

#!/bin/bash -e

if [[ -n "$1" ]]; then
    if [[ "$1" = *"cloudbuild.gserviceaccount"* ]]; then
        user=$(gcloud iam service-accounts describe $1 | grep -o 'uniqueId.*' | awk -v FS="('|')" '{print $2}')
    else
        user="${1//./-}"
        user="${user//@/-}"
    fi
    echo "Setting user: $user"
    kubectl create clusterrolebinding cluster-admin-$user --clusterrole cluster-admin --user $user
else
    echo "No user is provided !!!"
fi

from helm-tiller.

Thank you very much 😊. I've not tried it yet but definitely will try it out tomorrow

from helm-tiller.