RBAC for Tiller script

rbac-config.sh

#!/bin/sh

# See https://github.com/kubernetes/helm/blob/master/docs/rbac.md#tiller-and-role-based-access-control

echo 'apiVersion: v1
kind: ServiceAccount
metadata:
  name: tiller
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: tiller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: tiller
    namespace: kube-system' | kubectl create -f - && helm init --service-account tiller

# See https://engineering.bitnami.com/articles/helm-security.html
kubectl -n kube-system delete service tiller-deploy
kubectl -n kube-system patch deployment tiller-deploy --patch '
spec:
  template:
    spec:
      containers:
        - name: tiller
          ports: []
          command: ["/tiller"]
          args: ["--listen=localhost:44134"]
'

bash <(curl -fsSL https://goo.gl/KV7QNJ)

^ This one-line raw gist runs the raw gist script above.

To uninstall the above, do:

helm reset --force
kubectl delete sa tiller --namespace kube-system
kubectl delete clusterrolebindings tiller

I still use this with each new helm installation. Thanks again for sharing it!