<p>I have installed a cluster on Google Kubernetes Engine. </p>

<p>And then, I created namespace "staging"</p>

<pre><code>$ kubectl get namespaces
default       Active    26m
kube-public   Active    26m
kube-system   Active    26m
staging       Active    20m
</code></pre>

<p>Then, I switched to operate in the staging namespace</p>

<pre><code>$ kubectl config use-context staging
$ kubectl config current-context
staging
</code></pre>

<p>And then, I installed postgresql using helm on staging namespace</p>

<pre><code>helm install --name staging stable/postgresql
</code></pre>

<p>But I got: </p>

<blockquote>
  <p>Error: release staging failed: namespaces "staging" is forbidden: User "system:serviceaccount:kube-system:default" cannot get namespaces in the namespace "staging": Unknown user "system:serviceaccount:kube-system:default"</p>
</blockquote>

<p>What does it mean..?? How to get it working..??</p>

<p>Thank youu..</p>

<p>As your cluster is RBAC enabled, seems like your <code>tiller</code> Pod do not have enough permission.</p>

<p>You are using <code>default</code> ServiceAccount which lacks enough RBAC permission, tiller requires.</p>

<p>All you need to create ClusterRole, ClusterRoleBinding and ServiceAccount. With them you can provide necessary permission to your Pod.</p>

<p>Follow this steps</p>

<p>_1. Create ClusterRole <code>tiller</code></p>

<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: tiller
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]
</code></pre>

<blockquote>
  <p>Note: I have used full permission here.</p>
</blockquote>

<p>_2. Create ServiceAccount <code>tiller</code> in <code>kube-system</code> namespace</p>

<pre><code>$ kubectl create sa tiller -n kube-system
</code></pre>

<p>_3. Create ClusterRoleBinding <code>tiller</code></p>

<pre><code>kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: tiller
subjects:
- kind: ServiceAccount
  name: tiller
  namespace: kube-system
  apiGroup: ""
roleRef:
  kind: ClusterRole
  name: tiller
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>Now you need to use this ServiceAccount in your tiller Deployment.</p>

<p>As you already have one, edit that</p>

<pre><code>$ kubectl edit deployment -n kube-system tiller-deploy
</code></pre>

<p>Set <code>serviceAccountName</code> to <code>tiller</code> under PodSpec</p>

<p>Read more about <a href="https://kubernetes.io/docs/admin/authorization/rbac/" rel="noreferrer">RBAC</a></p>
