<p>I am trying to setup a user that will have permissions to install using Helm 3 in to a specific namespace.  (For my CI/CD system.)</p>
<p>For example, if the user tries to run a <code>helm upgrade --install</code> with <code>--namespace=dev</code> then it works just fine.  But if they try <code>--namespace=test</code> it will fail.</p>
<p>But I finding my self overwhelmed by the options.  When creating a role you have to pick <code>apiGroups</code>, <code>resources</code> and <code>verbs</code>.  I see a resource called <code>deployments</code>, but I have read that secret access is also needed.  I have done some googling, but most hits are about configuring Helm 2 (with tiller).</p>
<p><strong>What are the minimum Kubernetes permissions needed to install using Helm 3?</strong></p>

<p>In Kubernetes,  best practice is to ensure that your application is operating in the scope that you have specified that is why you have to grant role to user or application-specific service account. Read more about service account permissions <a href="https://kubernetes.io/docs/admin/authorization/rbac/#service-account-permissions" rel="nofollow noreferrer">in the official Kubernetes docs</a>.</p>
<p>To restrict a user's access to a particular namespace, you can use either the  <code>edit</code>  or the  <code>admin</code>  role. If your charts create or interact with Roles and Rolebindings, you'll want to use the  <code>admin</code>  ClusterRole.</p>
<p>Additionally, you may also create a RoleBinding with  <code>cluster-admin</code>  access. Granting a user  <code>cluster-admin</code>  access at the namespace scope provides full control over every resource in the namespace, including the namespace itself.</p>
<p>For this example, we will create a user with the  <code>edit</code>  Role. First, create the namespace:</p>
<pre><code>$ kubectl create namespace your-namespace

</code></pre>
<p>Now, create a RoleBinding in that namespace, granting the user the  <code>edit</code>  role.</p>
<pre><code>$ kubectl create rolebinding steve-edit
    --clusterrole edit \​
    --user steve \​
    --namespace your-namespace
</code></pre>
<p>This command will create rolebinding <code>steve-edit</code>. This rolebinding grants the permissions defined in a clusterrole <code>edit</code> to a user <code>steve</code> for namespace <code>your-namespace</code></p>
<p><code>Edit</code> is default clusterrole which allows read/write access to most objects in a namespace. It does not allow viewing or modifying roles or rolebindings.</p>
<p>Take a look: <a href="https://helm.sh/docs/topics/rbac/#example-grant-a-user-readwrite-access-to-a-particular-namespace" rel="nofollow noreferrer">rbac-namespace-helm</a>.</p>
<p>Read about clusterroles: <a href="https://github.com/kubernetes/kubernetes/blob/master/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/cluster-roles.yaml" rel="nofollow noreferrer">rbac-clusteroles</a>, <a href="https://unofficial-kubernetes.readthedocs.io/en/latest/admin/authorization/rbac/" rel="nofollow noreferrer">kubernetes-authorization</a>.</p>
<p>You can also grant specific user read/write access at the cluster scope, so you will be able to install helm in any namespace. You have to grant the user either  <code>admin</code>  or  <code>cluster-admin</code>  access.</p>
<p>Read more here: <a href="https://helm.sh/docs/topics/rbac/#example-grant-a-user-readwrite-access-at-the-cluster-scope" rel="nofollow noreferrer">cluster-scope-rbac-helm</a>.</p>
