<p>I have a managed kubernetes setup, called Cluster Container Engine (<strong>CCE</strong>), in the Open Telekom Cloud. Their documentation can be found <a href="https://docs.otc.t-systems.com/en-us/cce/doc/download/20190103/20190103195909_573ac4f813.pdf" rel="nofollow noreferrer">online</a>.</p>

<p>My CCE has one master and three nodes. I can access the CCE through <code>kubectl</code> and deploy new pods onto it. When installing <code>helm/tiller</code> with RBAC according to <a href="https://helm.sh/docs/using_helm/#role-based-access-control" rel="nofollow noreferrer">the official docs</a> I noticed that the <code>ServiceAccount</code> secret is mounted with very restricted permissions:</p>

<pre class="lang-sh prettyprint-override"><code>$ ls -al /var/run/secrets/kubernetes.io/serviceaccount/..data/
total 16
drwxr-xr-x    2 root     root           100 Feb 25 15:20 .
drwxrwxrwt    3 root     root           140 Feb 25 15:20 ..
-rw-------    1 root     root          8011 Feb 25 15:20 ca.crt
-rw-------    1 root     root            11 Feb 25 15:20 namespace
-rw-------    1 root     root           852 Feb 25 15:20 token
</code></pre>

<p>Only <code>root</code> can access these files which unfortunately means that the <code>helm/tiller</code> installation, which relies on the linux user <code>nobody</code>, fails.</p>

<p>I already have another kubernetes cluster running in azure (also managed, i.e. an AKS instance); pods created in the AKS kubernetes receive general read-access to the service account secret:</p>

<pre class="lang-sh prettyprint-override"><code>$ # the azure cluster
$ ls -al /var/run/secrets/kubernetes.io/serviceaccount/..data/
total 12
drwxr-xr-x 2 root root  100 Jan 24 08:12 .
drwxrwxrwt 3 root root  140 Jan 24 08:12 ..
-rw-r--r-- 1 root root 1720 Jan 24 08:12 ca.crt
-rw-r--r-- 1 root root    7 Jan 24 08:12 namespace
-rw-r--r-- 1 root root 1183 Jan 24 08:12 token
</code></pre>

<p>I'm looking for ideas on how to relax the file-access-permissions to match those in azure. This would enable non-root users to access the service account secrets and allow me to use <code>helm</code>. Any ideas?</p>

<hr>

<p>Output from <code>kubectl version</code>:</p>

<pre><code>Client Version: version.Info{Major:"1", Minor:"12", GitVersion:"v1.12.2", GitCommit:"17c77c7898218073f14c8d573582e8d2313dc740", GitTreeState:"clean", BuildDate:"2018-10-24T06:54:59Z", GoVersion:"go1.10.4", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"9+", GitVersion:"v1.9.2-CCE2.0.7-B003", GitCommit:"302f471a1e2caa114c9bb708c077fbb363aa2f13", GitTreeState:"clean", BuildDate:"2018-06-20T03:27:16Z", GoVersion:"go1.9.2", Compiler:"gc", Platform:"linux/amd64"}
</code></pre>

<p>All nodes use <code>EulerOS_2.0_SP2</code> with kernel version <code>3.10.0-327.59.59.46.h38.x86_64</code>.</p>

elemakil
<p>The permissions will be changed one of the March-2019-releases for CCE. You will be able to run Helm as you are used to latest end of March.</p>
