My command helm list
is failing with the message:
Error: configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list configmaps in the namespace "kube-system"
And I found some results that tell me how to set up RBAC roles and rolebindings, like for example:
helm list : cannot list configmaps in the namespace "kube-system"
and
https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/
but these fail for me as well with this error:
Error from server (Forbidden): error when creating "tiller-clusterrolebinding.yaml": clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "$USER" cannot create clusterrolebindings.rbac.authorization.k8s.io at the cluster scope: Required "container.clusterRoleBindings.create" permission.
Now after some searching I found this answer:
Cannot create clusterrolebinding on fresh GKE cluster
Which gives this error:
ERROR: (gcloud.projects.add-iam-policy-binding) User [$USER] does not have permission to access project [$PROJECT:setIamPolicy] (or it may not exist): The caller does not have permission
This last error finally seems to give me a good tip, I seem to not be an administrator/owner of this project, so I'm asking the owner of the project if he can give me those permissions. He's non-technical, so he'll have to do it through the GUI.
You would need one of the following roles to create clusterrolebindings in k8s:
You can check permissions and roles in Roles tab in GCP
And you can assign one of these roles (or create a custom role) in IAM & Admin Tab
You need one of the following roles with resourcemanager.projects.setIamPolicy permission to set IAM policy roles for somebody else (which I believe your admin does)
Your project owner, organization administrator, or somebody with project IAM admin role will need to give your $USER one of the following roles, or create a custom role: Owner (less likely), Kubernetes Engine Admin (most likely, not following the security principle of least privilege though) or Composer Worker. Then your $USER will be able to create clusterrolebindings.rbac.authorization.k8s.io at the cluster scope