From 086dfd5cb94283f337b9c53f4b0c33a746ae01d6 Mon Sep 17 00:00:00 2001 From: Travis Nielsen Date: Wed, 30 Aug 2017 11:38:27 -0700 Subject: [PATCH] docs: tiller must be updated for rbac before installing the chart --- Documentation/helm-operator.md | 42 ++++++++++++++++------------------ 1 file changed, 20 insertions(+), 22 deletions(-) diff --git a/Documentation/helm-operator.md b/Documentation/helm-operator.md index a931458eb..9fee5dde6 100644 --- a/Documentation/helm-operator.md +++ b/Documentation/helm-operator.md @@ -16,6 +16,25 @@ This chart bootstraps a [rook-operator](https://github.com/rook/rook) deployment - Kubernetes 1.6+ with Beta APIs & ThirdPartyResources enabled +### RBAC + +If role-based access control (RBAC) is enabled in your cluster, you may need to give Tiller (the server-side component of Helm) additional permissions. **If RBAC is not enabled, be sure to set `rbacEnable` to `false` when installing the chart.** + +1. Create a ServiceAccount for Tiller in the `kube-system` namespace + ```console + $ kubectl -n kube-system create sa tiller + ``` + +2. Create a ClusterRoleBinding for Tiller + ```console + $ kubectl create clusterrolebinding tiller --clusterrole cluster-admin --serviceaccount=kube-system:tiller + ``` + +3. Patch Tiller's Deployment to use the new ServiceAccount + ```console + $ kubectl -n kube-system patch deploy/tiller-deploy -p '{"spec": {"template": {"spec": {"serviceAccountName": "tiller"}}}}' + ``` + ## Installing To install the chart from out published registry, run the following: @@ -25,7 +44,7 @@ $ helm repo add rook- http://charts.rook.io/ $ helm install rook-/rook ``` -Be sure to replace `` with `alpha`, `beta`, `stable` or `master`, for example: +Be sure to replace `` with `alpha` or `master` (in the future `beta` and `stable` when available), for example: ```console $ helm repo add rook-alpha http://charts.rook.io/alpha @@ -41,27 +60,6 @@ $ cd cluster/charts/rook $ helm install --name rook --namespace rook . ``` -### RBAC - -If role-based access control (RBAC) is enabled in your cluster, you may need to give Tiller (the server-side component of Helm) additional permissions. **If RBAC is not enabled, be sure to set `rbacEnable` to `false` when installing the chart.** - -1. Create a ServiceAccount for Tiller in the `kube-system` namespace - ```console - $ kubectl -n kube-system create sa tiller - ``` - -2. Create a ClusterRoleBinding for Tiller - - ```console - $ kubectl create clusterrolebinding tiller --clusterrole cluster-admin --serviceaccount=kube-system:tiller - ``` - -3. Patch Tiller's Deployment to use the new ServiceAccount - - ```console - $ kubectl -n kube-system patch deploy/tiller-deploy -p '{"spec": {"template": {"spec": {"serviceAccountName": "tiller"}}}}' - ``` - ## Uninstalling the Chart To uninstall/delete the `rook` deployment: