<p>When deploying a service via a Helm Chart, the installation failed because the <code>tiller</code> serviceaccount was not allowed to create a <code>ServiceMonitor</code> resource.</p>

<p>Note:</p>

<ul>
<li><code>ServiceMonitor</code> is a CRD defined by the Prometheus Operator to automagically get metrics of running containers in Pods.</li>
<li>Helm Tiller is installed in a single namespace and the RBAC has been setup using Role and RoleBinding.</li>
</ul>

<p>I wanted to verify the permissions of the <code>tiller</code> serviceaccount.<br>
<code>kubectl</code> has the <code>auth can-i</code> command, queries like these (see below) always return <code>no</code>.</p>

<ul>
<li><code>kubectl auth can-i list deployment --as=tiller</code></li>
<li><code>kubectl auth can-i list deployment --as=staging:tiller</code></li>
</ul>

<p>What is the proper way to check permissions for a serviceaccount?<br>
How to enable the <code>tiller</code> account to create a ServiceMonitor resource?</p>

<p>After trying lots of things and Googling all over the universe I finally found <a href="https://docs.giantswarm.io/guides/securing-with-rbac-and-psp/#verifying-if-you-have-access" rel="noreferrer">this blogpost about Securing your cluster with RBAC and PSP</a> where an example is given how to check access for serviceaccounts.</p>

<p>The correct command is:<br>
<code>kubectl auth can-i &lt;verb&gt; &lt;resource&gt; --as=system:serviceaccount:&lt;namespace&gt;:&lt;serviceaccountname&gt; [-n &lt;namespace&gt;]</code></p>

<p>To check whether the <code>tiller</code> account has the right to create a <code>ServiceMonitor</code> object:<br>
<code>kubectl auth can-i create servicemonitor --as=system:serviceaccount:staging:tiller -n staging</code></p>

<p>Note: to solve my issue with the <code>tiller</code> account, I had to add rights to the <code>servicemonitors</code> resource in the <code>monitoring.coreos.com</code> apiGroup. After that change, the above command returned <code>yes</code> (finally) and the installation of our Helm Chart succeeded.</p>

<p>Updated <code>tiller-manager</code> role:</p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tiller-manager
  labels:
    org: ipos
    app: tiller
  annotations:
    description: "Role to give Tiller appropriate access in namespace"
    ref: "https://docs.helm.sh/using_helm/#example-deploy-tiller-in-a-namespace-restricted-to-deploying-resources-only-in-that-namespace"
rules:
- apiGroups: ["", "batch", "extensions", "apps"]
  resources: ["*"]
  verbs: ["*"]
- apiGroups:
    - monitoring.coreos.com
  resources:
    - servicemonitors
  verbs:
    - '*'
</code></pre>
