helm prometheus clusterroles.rbac.authorization.k8s.io forbidden: attempt to grant extra privileges

问题描述：

使用 helm 安装 prometheus ，出现如下错误：

Error: release monitor failed: clusterroles.rbac.authorization.k8s.io "monitor-prometheus-server" is forbidden: attempt to grant extra privileges: [PolicyRule{NonResourceURLs:["/metrics"], Verbs:["get"]}] user=&{system:serviceaccount:kube-system:tiller 8fc1bfb3-75d6-11e8-a678-5cf3fc1b923c [system:serviceaccounts system:serviceaccounts:kube-system system:authenticated] map[]} ownerrules=[PolicyRule{APIGroups:["authorization.k8s.io"], Resources:["selfsubjectaccessreviews" "selfsubjectrulesreviews"], Verbs:["create"]} PolicyRule{NonResourceURLs:["/api" "/api/*" "/apis" "/apis/*" "/healthz" "/openapi" "/openapi/*" "/swagger-2.0.0.pb-v1" "/swagger.json" "/swaggerapi" "/swaggerapi/*" "/version" "/version/"], Verbs:["get"]} PolicyRule{APIGroups:["*"], Resources:["*"], Verbs:["*"]}] ruleResolutionErrors=[]

该问题是由于 Tiller 权限不足引起的，

方案1： 重新部署 Tiller，加上 --service-account 参数

helm reset
helm init --service-account tiller

方案2：直接给 Tiller 打补丁

            注意 命名空间、 tiller deployment 名称跟你的实际名字对应上

kubectl create serviceaccount --namespace kube-system tiller
kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
kubectl patch deploy --namespace kube-system tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'

官方链接： https://github.com/kubernetes/charts/issues/3504