Repository: jupyterhub/zero-to-jupyterhub-k8s

Issue #344: Fails to deploy on RBAC enabled cluster
Created: 2017-12-11T12:02:10Z
helm install jupyterhub/jupyterhub --version=v0.5.0-aee2160 --name=datalab-jupyterhub --namespace=ox  -f config.yaml --set prePuller.enabled=false
fails with
Error: release datalab-jupyterhub failed: clusterroles.rbac.authorization.k8s.io "nginx-datalab-jupyterhub" is forbidden: attempt to grant extra privileges: [PolicyRule{Resources:["configmaps"], APIGroups:[""], Verbs:["list"]} PolicyRule{Resources:["configmaps"], APIGroups:[""], Verbs:["watch"]} PolicyRule{Resources:["endpoints"], APIGroups:[""], Verbs:["list"]} PolicyRule{Resources:["endpoints"], APIGroups:[""], Verbs:["watch"]} PolicyRule{Resources:["nodes"], APIGroups:[""], Verbs:["list"]} PolicyRule{Resources:["nodes"], APIGroups:[""], Verbs:["watch"]} PolicyRule{Resources:["pods"], APIGroups:[""], Verbs:["list"]} PolicyRule{Resources:["pods"], APIGroups:[""], Verbs:["watch"]} PolicyRule{Resources:["secrets"], APIGroups:[""], Verbs:["list"]} PolicyRule{Resources:["secrets"], APIGroups:[""], Verbs:["watch"]} PolicyRule{Resources:["namespaces"], ResourceNames:["ox"], APIGroups:[""], Verbs:["get"]} PolicyRule{Resources:["nodes"], APIGroups:[""], Verbs:["get"]} PolicyRule{Resources:["services"], APIGroups:[""], Verbs:["get"]} PolicyRule{Resources:["services"], APIGroups:[""], Verbs:["list"]} PolicyRule{Resources:["services"], APIGroups:[""], Verbs:["update"]} PolicyRule{Resources:["services"], APIGroups:[""], Verbs:["watch"]} PolicyRule{Resources:["ingresses"], APIGroups:["extensions"], Verbs:["get"]} PolicyRule{Resources:["ingresses"], APIGroups:["extensions"], Verbs:["list"]} PolicyRule{Resources:["ingresses"], APIGroups:["extensions"], Verbs:["watch"]} PolicyRule{Resources:["events"], APIGroups:[""], Verbs:["create"]} PolicyRule{Resources:["events"], APIGroups:[""], Verbs:["patch"]} PolicyRule{Resources:["ingresses/status"], APIGroups:["extensions"], Verbs:["update"]}] user=&{system:serviceaccount:kube-system:tiller 2a92a2cb-dbed-11e7-ac49-0a58ac1f0f75 [system:serviceaccounts system:serviceaccounts:kube-system system:authenticated] map[]} ownerrules=[] ruleResolutionErrors=[clusterroles.rbac.authorization.k8s.io "cluster-admin" not found]
I am using ACS if that matters.

Duplicate issue #355: rbac error on aks: "cluster-admin" not found
Created: 2017-12-15T23:38:30Z
With rbac and prepuller enabled, helm install produces the following with a cluster on aks:
Error: clusterroles.rbac.authorization.k8s.io "pre-puller-staging-1" is forbidden: attempt to grant extra privileges: [PolicyRule{Resources:["nodes"], APIGroups:[""], Verbs:["get"]} PolicyRule{Resources:["nodes"], APIGroups:[""], Verbs:["list"]}] user=&{system:serviceaccount:kube-system:tiller a3017e57-e1ea-11e7-8e60-0a58ac1f0630 [system:serviceaccounts system:serviceaccounts:kube-system system:authenticated] map[]} ownerrules=[] ruleResolutionErrors=[clusterroles.rbac.authorization.k8s.io "cluster-admin" not found]

Disabling rbac enabled helm to work. Note that I wasn't following the current Azure instructions and setup the cluster with az aks. In case this is helpful:
$ kubectl get clusterrolebinding -o=yaml
apiVersion: v1
items:
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    creationTimestamp: 2017-12-15T22:52:38Z
    name: tiller
    namespace: ""
    resourceVersion: "3235"
    selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/tiller
    uid: _some_long_uuid_
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: cluster-admin
  subjects:
  - kind: ServiceAccount
    name: tiller
    namespace: kube-system
kind: List
metadata:
  resourceVersion: ""
  selfLink: ""

Closing comment (2017-12-16T02:04:12Z): This is a duplicate of #344