安裝Rancher cert-manager報錯kube-system forbidden

1：Rancher生成證書服務報錯

默認狀況下，Rancher會生成CA並用於cert-manager頒發證書以訪問Rancher服務器界面。由於rancher是默認選項ingress.tls.source，咱們ingress.tls.source在運行helm install命令時沒有指定。

helm install stable/cert-manager \
  --name cert-manager \
  --namespace kube-system \
  --version v0.5.2

安裝stable/cert-manager報錯

Error: namespaces "kube-system" is forbidden: User "system:serviceaccount:kube-system:default" 
cannot get resource "namespaces" in API group "" in the namespace "kube-system"

解決辦法：

kubectl create serviceaccount --namespace kube-system tiller
kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller

kubectl delete deployment tiller-deploy --namespace kube-system
helm init --service-account tiller

2：若是以前安裝過，可能報錯以下：

[root@kubm-01 ~]# helm install stable/cert-manager   --name cert-manager   --namespace kube-system   --version v0.5.2
Error: customresourcedefinitions.apiextensions.k8s.io "certificates.certmanager.k8s.io" already exists

解決辦法：

查看現有 custom resource definition
[root@kubm-01 ~]# kubectl get customresourcedefinitions --all-namespaces=true |grep certmanager.*             
certificates.certmanager.k8s.io                                 2019-08-20T04:03:16Z
clusterissuers.certmanager.k8s.io                               2019-08-02T06:32:05Z
issuers.certmanager.k8s.io                                      2019-08-02T06:32:06Z

#刪除
[root@kubm-01 ~]# kubectl delete customresourcedefinition 

kubectl delete customresourcedefinition  certificates.certmanager.k8s.io  
kubectl delete customresourcedefinition  clusterissuers.certmanager.k8s.io
kubectl delete customresourcedefinition  issuers.certmanager.k8s.io       

參考信息：https://github.com/jetstack/cert-manager/issues/870

再次執行安裝

helm install stable/cert-manager \
  --name cert-manager \
  --namespace kube-system \
  --version v0.5.2

查看安裝狀態

kubectl -n kube-system rollout status deploy/cert-manager

cert-manager has been deployed successfully!

參考信息：推薦

https://helm.sh/docs/using_helm/#tiller-and-role-based-access-control