I've create a service account for helm; the account works with kubectl
, but the service account token is not being mounted in tiller's pod. Here's the Deployment's definition:
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
annotations:
deployment.kubernetes.io/revision: "1"
creationTimestamp: 2019-04-29T08:56:59Z
generation: 1
labels:
app: helm
name: tiller
name: tiller-deploy
namespace: kube-system
resourceVersion: "560527"
selfLink: /apis/extensions/v1beta1/namespaces/kube-system/deployments/tiller-deploy
uid: bf5f4010-6a5c-11e9-b714-52540012345d
spec:
replicas: 1
selector:
matchLabels:
app: helm
name: tiller
strategy:
rollingUpdate:
maxSurge: 1
maxUnavailable: 1
type: RollingUpdate
template:
metadata:
creationTimestamp: null
labels:
app: helm
name: tiller
spec:
automountServiceAccountToken: true
containers:
- env:
- name: TILLER_NAMESPACE
value: kube-system
- name: TILLER_HISTORY_MAX
value: "0"
image: kubernetes-helm/tiller:v2.13.1
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 3
httpGet:
path: /liveness
port: 44135
scheme: HTTP
initialDelaySeconds: 1
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
name: tiller
ports:
- containerPort: 44134
hostPort: 44134
name: tiller
protocol: TCP
- containerPort: 44135
hostPort: 44135
name: http
protocol: TCP
readinessProbe:
failureThreshold: 3
httpGet:
path: /readiness
port: 44135
scheme: HTTP
initialDelaySeconds: 1
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
resources: {}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
dnsPolicy: ClusterFirst
hostNetwork: true
restartPolicy: Always
schedulerName: default-scheduler
securityContext: {}
serviceAccount: tiller
serviceAccountName: tiller
terminationGracePeriodSeconds: 30
Here's the service account definition:
apiVersion: v1
kind: ServiceAccount
metadata:
name: tiller
namespace: kube-system
automountServiceAccountToken: true
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: tiller
subjects:
- kind: ServiceAccount
name: tiller
namespace: kube-system
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io
Kubernetes version is 1.8.2, is installed on bare-metal. Installation method is manual.
Control plane commands:
kube-apiserver --token-auth-file /etc/kubernetes/useraccount --authorization-mode RBAC,ABAC,AlwaysDeny --authorization-policy-file /etc/kubernetes/abac.json --secure-port 5587 --bind-address 1.1.1.1 --insecure-port 0 --service-cluster-ip-range 172.16.0.0/12 --etcd-servers http://1.1.1.1:2379,http://1.1.1.2:2379,http://1.1.1.3:2379 --tls-cert-file apisrv.crt --tls-private-key-file apisrv.key --cert-dir=kubernetes --advertise-address 1.1.1.1 --service-node-port-range 1024-65535 --service-account-key-file sa.crt
kube-controller-manager --kubeconfig kubeconf_admin.yaml --cluster-cidr 192.168.0.0/16 --service-account-private-key-file sa.key --root-ca-file sa.crt --leader-elect true