<p>I'm running kubernetes v1.11.5 and I'm installing helm with a tiller deployment for each namespace. 
Let's focus on a single namespace. This is the tiller service account configuration:</p>

<pre><code>---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tiller
  namespace: marketplace-int
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tiller-manager
  namespace: marketplace-int
rules:
- apiGroups:
  - ""
  - extensions
  - apps
  - rbac.authorization.k8s.io
  - roles.rbac.authorization.k8s.io
  - authorization.k8s.io
  resources: ["*"]
  verbs: ["*"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tiller-binding
  namespace: marketplace-int
subjects:
- kind: ServiceAccount
  name: tiller
  namespace: marketplace-int
roleRef:
  kind: Role
  name: tiller-manager
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>When I try to deploy a chart I get this error:</p>

<pre><code>Error: release citest failed: roles.rbac.authorization.k8s.io "marketplace-int-role-ns-admin" is forbidden: 
attempt to grant extra privileges: 
[{[*] [*] [*] [] []}] user=&amp;{system:serviceaccount:marketplace-int:tiller 5c6af739-1023-11e9-a245-0ab514dfdff4 
[system:serviceaccounts system:serviceaccounts:marketplace-int system:authenticated] map[]} 
ownerrules=[{[create] [authorization.k8s.io] [selfsubjectaccessreviews selfsubjectrulesreviews] [] []} 
{[get] [] [] [] [/api /api/* /apis /apis/* /healthz /openapi /openapi/* /swagger-2.0.0.pb-v1 /swagger.json /swaggerapi /swaggerapi/* /version /version/]} 
{[*] [ extensions apps rbac.authorization.k8s.io roles.rbac.authorization.k8s.io authorization.k8s.io] [*] [] []}] ruleResolutionErrors=[]
</code></pre>

<p>The error comes when trying to create rbac config for that namespace (with tiller sa):</p>

<pre><code># Source: marketplace/templates/role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: citest
    chart: marketplace-0.1.0
    heritage: Tiller
    release: citest
    namespace: marketplace-int
  name: marketplace-int-role-ns-admin
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]
</code></pre>

<p>The error message clearly says that the tiller service account doesn't have permission for <code>roles.rbac.authorization.k8s.io</code> but that permission is granted as showed previously.</p>

<pre><code>$kubectl describe role tiller-manager
Name:         tiller-manager
Labels:       &lt;none&gt;
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"Role","metadata":{"annotations":{},"name":"tiller-manager","namespace":"marketplace-i...
PolicyRule:
  Resources                          Non-Resource URLs  Resource Names  Verbs
  ---------                          -----------------  --------------  -----
  *                                  []                 []              [*]
  *.apps                             []                 []              [*]
  *.authorization.k8s.io             []                 []              [*]
  *.extensions                       []                 []              [*]
  *.rbac.authorization.k8s.io        []                 []              [*]
  *.roles.rbac.authorization.k8s.io  []                 []              [*]
</code></pre>

<p>Honestly, I don't fully understand the error message to check if the <code>ownerrules</code> are fine and I'm trying to find out what does it means this kind of messages that seems to be related with the role description: <code>{[*] [*] [*] [] []}</code></p>

<p>Any clue about what permissions I am missing?</p>

RuBiCK
<p>This is due to permission escalation prevention in RBAC. See <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#privilege-escalation-prevention-and-bootstrapping" rel="noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/#privilege-escalation-prevention-and-bootstrapping</a> for details. </p>

<p>Permission to create a role object is necessary, but not sufficient. </p>

<p>A user can only create/update a role if at least one of the following things is true:</p>

<ol>
<li><p>they already have all the permissions contained in the role, at the same scope as the object being modified (cluster-wide for a ClusterRole, within the same namespace or cluster-wide for a Role). In your case, that would mean the user attempting to create the role must already have <code>apiGroups=*, resources=*, verbs=*</code> permissions within the namespace where it is attempting to create the role. You can grant this by granting the cluster-admin clusterrole to the serviceaccount within that namespace with a rolebinding. </p></li>
<li><p>they are given explicit permission to perform the "escalate" verb on the roles or clusterroles resource in the rbac.authorization.k8s.io API group (Kubernetes 1.12 and newer)</p></li>
</ol>
