<p>I have kubernetes Cluster v1.10 over centos 7 , bare-metal </p>

<pre><code>helm version
Client: &amp;version.Version{SemVer:"v2.11.0-rc.3", GitCommit:"28d295be2a94115b786ee277dffcc2b5483bde47", GitTreeState:"clean"}
Server: &amp;version.Version{SemVer:"v2.11.0-rc.3", GitCommit:"28d295be2a94115b786ee277dffcc2b5483bde47", GitTreeState:"clean"}
</code></pre>

<p>I am trying to install nginx using helm </p>

<pre><code>helm install stable/nginx-ingress --name nginx
</code></pre>

<p>It returns </p>

<pre><code>Error: release nginx failed: 
clusterroles.rbac.authorization.k8s.io "nginx-nginx-ingress" is 
forbidden: attempt to grant extra privileges: 
[PolicyRule{APIGroups:[""], Resources:["configmaps"], Verbs: 
["list"]} PolicyRule{APIGroups:[""], Resources:["configmaps"], 
Verbs:["watch"]} PolicyRule{APIGroups:[""], Resources: 
["endpoints"], Verbs:["list"]} PolicyRule{APIGroups:[""], 
Resources:["endpoints"], Verbs:["watch"]} PolicyRule{APIGroups: 
[""], Resources:["nodes"], Verbs:["list"]} PolicyRule{APIGroups: 
[""], Resources:["nodes"], Verbs:["watch"]} PolicyRule{APIGroups: 
[""], Resources:["pods"], Verbs:["list"]} PolicyRule{APIGroups: 
[""], Resources:["pods"], Verbs:["watch"]} PolicyRule{APIGroups: 
[""], Resources:["secrets"], Verbs:["list"]} PolicyRule{APIGroups: 
[""], Resources:["secrets"], Verbs:["watch"]} 
PolicyRule{APIGroups:[""], Resources:["nodes"], Verbs:["get"]} 
PolicyRule{APIGroups:[""], Resources:["services"], Verbs:["get"]} 
PolicyRule{APIGroups:[""], Resources:["services"], Verbs:["list"]} 
PolicyRule{APIGroups:[""], Resources:["services"], Verbs: 
["update"]} PolicyRule{APIGroups:[""], Resources:["services"], 
Verbs:["watch"]} PolicyRule{APIGroups:["extensions"], Resources: 
["ingresses"], Verbs:["get"]} PolicyRule{APIGroups:["extensions"], 
Resources:["ingresses"], Verbs:["list"]} PolicyRule{APIGroups: 
["extensions"], Resources:["ingresses"], Verbs:["watch"]} 
PolicyRule{APIGroups:[""], Resources:["events"], Verbs:["create"]} 
PolicyRule{APIGroups:[""], Resources:["events"], Verbs:["patch"]} 
PolicyRule{APIGroups:["extensions"], Resources: 
["ingresses/status"], Verbs:["update"]}] user=&amp; 
{system:serviceaccount:kube-system:default 8f248058-b684-11e8- 
b781-daf0a0c10949 [system:serviceaccounts 
system:serviceaccounts:kube-system system:authenticated] map[]} 
ownerrules=[] ruleResolutionErrors=[]
</code></pre>

<p>How can i solve this issue ? </p>

<p>Thank You :D </p>

AhmedMItman
<p>As <code>kubectl apply -f</code> is used to create or update resources, Helm, on the other hand, can be called Kubernetes Package Manager. The solution you have posted is a workaround as the question is about Helm and not how to create resources using the <code>kubectl apply</code>. Adding <code>--set rbac.create=false</code> indicates that you probably deployed Tiller with no RBAC support. The question is, was it done intentionally? If you don't have RBAC authorization turned on, you can keep using <code>--set rbac.create=false</code>; if you want RBAC on, you have to add Tiller service account the <code>cluster-admin</code> role. </p>

<p>You can find how to configure it properly <a href="https://github.com/helm/helm/blob/master/docs/rbac.md" rel="nofollow noreferrer">here.</a></p>

<p>More information about installation and configuration of Helm and Tiller is available <a href="https://docs.helm.sh/using_helm/" rel="nofollow noreferrer">here</a> and the detailed explanation of the similar case in this Github <a href="https://github.com/jetstack/cert-manager/issues/256" rel="nofollow noreferrer">issue</a>.</p>
