<p>I'm trying to install Prometheus on my K8S cluster</p>

<p>when I run command </p>

<pre><code>kubectl get namespaces
</code></pre>

<p>I got the following namespace:</p>

<pre><code>default       Active   26h
kube-public   Active   26h
kube-system   Active   26h
monitoring    Active   153m
prod          Active   5h49m
</code></pre>

<p>Now I want to create the Prometheus via </p>

<pre><code>helm install stable/prometheus --name prom -f k8s-values.yml
</code></pre>

<p>and I got <strong>error:</strong></p>

<blockquote>
  <p>Error: release prom-demo failed: namespaces "default" is forbidden:
  User "system:serviceaccount:kube-system:default" cannot get resource
  "namespaces" in API group "" in the namespace "default"</p>
</blockquote>

<p>even if I switch to  <code>monitoring</code> ns I got the same error,</p>

<p>the k8s-values.yml look like following</p>

<pre><code>rbac:
  create: false
server:
  name: server

  service:
    nodePort: 30002
    type: NodePort
</code></pre>

<p>Any idea what could be missing here ?</p>

<p>You are getting this error because you are using RBAC without giving the right permissions.<br /></p>

<p><strong>Give the tiller permissions:</strong><br />
<em>taken from <a href="https://github.com/helm/helm/blob/master/docs/rbac.md" rel="nofollow noreferrer">https://github.com/helm/helm/blob/master/docs/rbac.md</a></em></p>

<p>Example: Service account with cluster-admin role
In rbac-config.yaml:</p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: tiller
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tiller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: tiller
    namespace: kube-system
</code></pre>

<p><em>Note: The cluster-admin role is created by default in a Kubernetes cluster, so you don't have to define it explicitly.</em></p>

<pre><code>$ kubectl create -f rbac-config.yaml
serviceaccount "tiller" created
clusterrolebinding "tiller" created
$ helm init --service-account tiller
</code></pre>

<p><strong>Create a service account for prometheus:<br /></strong>
Change the value of <code>rbac.create</code> to <code>true</code>:</p>

<pre><code>rbac:
  create: true
server:
  name: server

  service:
    nodePort: 30002
    type: NodePort
</code></pre>
