<p>My command <code>helm list</code> is failing with the message:</p>

<pre><code>Error: configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list configmaps in the namespace "kube-system"
</code></pre>

<p>And I found some results that tell me how to set up RBAC roles and rolebindings, like for example:</p>

<p><a href="https://stackoverflow.com/questions/46672523/helm-list-cannot-list-configmaps-in-the-namespace-kube-system">helm list : cannot list configmaps in the namespace &quot;kube-system&quot;</a></p>

<p>and </p>

<p><a href="https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/" rel="nofollow noreferrer">https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/</a></p>

<p>but these fail for me as well with this error:</p>

<pre><code>Error from server (Forbidden): error when creating "tiller-clusterrolebinding.yaml": clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "$USER" cannot create clusterrolebindings.rbac.authorization.k8s.io at the cluster scope: Required "container.clusterRoleBindings.create" permission.
</code></pre>

<p>Now after some searching I found this answer:</p>

<p><a href="https://stackoverflow.com/questions/49770624/cannot-create-clusterrolebinding-on-fresh-gke-cluster">Cannot create clusterrolebinding on fresh GKE cluster</a></p>

<p>Which gives this error:</p>

<pre><code>ERROR: (gcloud.projects.add-iam-policy-binding) User [$USER] does not have permission to access project [$PROJECT:setIamPolicy] (or it may not exist): The caller does not have permission
</code></pre>

<p>This last error finally seems to give me a good tip, I seem to not be an administrator/owner of this project, so I'm asking the owner of the project if he can give me those permissions. He's non-technical, so he'll have to do it through the GUI.</p>

Tinco
<p>You would need one of the following roles to create clusterrolebindings in k8s:</p>

<ul>
<li>Owner   </li>
<li>Kubernetes Engine Admin</li>
<li>Composer Worker</li>
</ul>

<p>You can check permissions and roles in Roles tab in GCP</p>

<p><a href="https://i.stack.imgur.com/HFwWy.png" rel="noreferrer"><img src="https://i.stack.imgur.com/HFwWy.png" alt="roles"></a></p>

<p>And you can assign one of these roles (or create a custom role) in IAM &amp; Admin Tab</p>

<p><a href="https://i.stack.imgur.com/0m9QF.png" rel="noreferrer"><img src="https://i.stack.imgur.com/0m9QF.png" alt="enter image description here"></a></p>

<p>You need one of the following roles with <strong>resourcemanager.projects.setIamPolicy</strong> permission to set IAM policy roles for somebody else (which I believe your admin does) </p>

<ul>
<li>Organization Administrator</li>
<li>Owner</li>
<li>Project IAM Admin</li>
</ul>

<p><a href="https://i.stack.imgur.com/FmFZw.png" rel="noreferrer"><img src="https://i.stack.imgur.com/FmFZw.png" alt="enter image description here"></a></p>

<p>Your project owner, organization administrator, or somebody with project IAM admin role will need to give your <strong>$USER</strong> one of the following roles, or create a custom role: Owner (less likely), Kubernetes Engine Admin (most likely, not following the security principle of <strong>least privilege</strong> though) or Composer Worker. Then your <strong>$USER</strong> will be able to create <code>clusterrolebindings.rbac.authorization.k8s.io at the cluster scope</code></p>
