安装Rancher cert-manager报错kube-system forbidden

默认情况下，Rancher会生成CA并用于cert-manager颁发证书以访问Rancher服务器界面。因为rancher是默认选项ingress.tls.source，我们ingress.tls.source在运行helm install命令时没有指定。

helm install stable/cert-manager   --name cert-manager   --namespace kube-system   --version v0.5.2

安装stable/cert-manager报错

Error: namespaces "kube-system" is forbidden: User "system:serviceaccount:kube-system:default" 
cannot get resource "namespaces" in API group "" in the namespace "kube-system"

解决办法：

kubectl create serviceaccount --namespace kube-system tiller
kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller

kubectl delete deployment tiller-deploy --namespace kube-system
helm init --service-account tiller

2：如果之前安装过，可能报错如下：

[[email?protected] ~]# helm install stable/cert-manager   --name cert-manager   --namespace kube-system   --version v0.5.2
Error: customresourcedefinitions.apiextensions.k8s.io "certificates.certmanager.k8s.io" already exists

解决办法：

查看现有 custom resource definition
[[email?protected] ~]# kubectl get customresourcedefinitions --all-namespaces=true |grep certmanager.*             
certificates.certmanager.k8s.io                                 2019-08-20T04:03:16Z
clusterissuers.certmanager.k8s.io                               2019-08-02T06:32:05Z
issuers.certmanager.k8s.io                                      2019-08-02T06:32:06Z

#删除
[[email?protected] ~]# kubectl delete customresourcedefinition 

kubectl delete customresourcedefinition  certificates.certmanager.k8s.io  
kubectl delete customresourcedefinition  clusterissuers.certmanager.k8s.io
kubectl delete customresourcedefinition  issuers.certmanager.k8s.io       

参考信息：https://github.com/jetstack/cert-manager/issues/870

再次执行安装

helm install stable/cert-manager   --name cert-manager   --namespace kube-system   --version v0.5.2

查看安装状态

kubectl -n kube-system rollout status deploy/cert-manager

cert-manager has been deployed successfully!

参考信息：推荐

https://helm.sh/docs/using_helm/#tiller-and-role-based-access-control