<p>I'm following the official Helm <a href="https://docs.helm.sh/using_helm/#role-based-access-control" rel="nofollow noreferrer">documentation</a> for "Deploy Tiller in a namespace, restricted to deploying resources only in that namespace". Here is my bash script:</p>

<pre><code>Namespace="$1"

kubectl create namespace $Namespace
kubectl create serviceaccount "tiller-$Namespace" --namespace $Namespace
kubectl create role "tiller-role-$Namespace" /
    --namespace $Namespace /
    --verb=* /
    --resource=*.,*.apps,*.batch,*.extensions
kubectl create rolebinding "tiller-rolebinding-$Namespace" /
    --namespace $Namespace /
    --role="tiller-role-$Namespace" /
    --serviceaccount="$Namespace:tiller-$Namespace"
helm init /
    --service-account "tiller-$Namespace" /
    --tiller-namespace $Namespace
    --override "spec.template.spec.containers[0].command'='{/tiller,--storage=secret}"
    --upgrade
    --wait
</code></pre>

<p>Running <code>helm upgrade</code> gives me the following error:</p>

<blockquote>
  <p>Error: UPGRADE FAILED: configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list configmaps in the namespace "kube-system"</p>
</blockquote>

<p>Is there a bug in the official documentation? Have I read it wrong?</p>

<p>I'm not sure about <code>--resource</code> flag correct syntax in your script, whether asterisk symbols "*" are allowed here, look at this <a href="https://github.com/kubernetes/kubernetes/issues/62989" rel="nofollow noreferrer">issue</a> reported on GitHub.</p>

<pre><code>$ kubectl create role "tiller-role-$Namespace" \
--namespace $Namespace \
--verb=* \
--resource=*.,*.apps,*.batch,*.extensions
the server doesn't have a resource type "*"
</code></pre>

<p>But you can check this role object in your cluster:</p>

<p><code>kubectl get role tiller-role-$Namespace -n $Namespace -o yaml</code></p>

<p>Otherwise, try to create the role for <code>tiller</code> within yaml file as guided in the documentation:</p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tiller-manager
  namespace: tiller-world
rules:
- apiGroups: ["", "batch", "extensions", "apps"]
  resources: ["*"]
  verbs: ["*"]
</code></pre>

<p>Moreover, keep in mind that if you have installed <code>tiller</code> in the non-default namespace (<code>default</code>), it is necessary to specify namespace where <code>tiller</code> resides on, when you invoke <code>Helm</code> command:</p>

<pre><code>$ helm --tiller-namespace $Namespace version
Client: &amp;version.Version{SemVer:"v2.11.0", GitCommit:"2e55dbe1fdb5fdb96b75ff144a339489417b146b", GitTreeState:"clean"}
Server: &amp;version.Version{SemVer:"v2.11.0", GitCommit:"2e55dbe1fdb5fdb96b75ff144a339489417b146b", GitTreeState:"clean"}
</code></pre>
