helm: helm install/upgrade/reset hangs on kube 1.8

Hello. We just upgraded to kubernetes 1.8, and I cannot perform any commands on helm, it hangs everytime, and the log on tiller does not show any thing. Here my information:

$ kubectl version
Client Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.3", GitCommit:"f0efb3cb883751c5ffdbe6d515f3cb4fbe7b7acd", GitTreeState:"clean", BuildDate:"2017-11-08T18:39:33Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.2+coreos.0", GitCommit:"4c0769e81ab01f47eec6f34d7f1bb80873ae5c2b", GitTreeState:"clean", BuildDate:"2017-10-25T16:24:46Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}

$ helm version 
Client: &version.Version{SemVer:"v2.7.0", GitCommit:"08c1144f5eb3e3b636d9775617287cc26e53dba4", GitTreeState:"clean"}
(it hangs here)

Tiler upgrade works:

$ helm init --upgrade
$HELM_HOME has been configured at /home/renault/.helm.

Tiller (the Helm server-side component) has been upgraded to the current version.
Happy Helming!

Even helm reset hangs:

$ helm reset --debug --force
[debug] Created tunnel using local port: '46474'

[debug] SERVER: "localhost:46474"
(hang)

Tiller-deploy pod does not show anything in the log once started:

[main] 2017/11/13 09:37:29 Starting Tiller v2.7.0 (tls=false)
[main] 2017/11/13 09:37:29 GRPC listening on :44134
[main] 2017/11/13 09:37:29 Probes listening on :44135
[main] 2017/11/13 09:37:29 Storage driver is ConfigMap
[main] 2017/11/13 09:37:29 Max history per release is 0

I tried restarting my PC and manually destroying all tiller resources on the cluster, the reinstallation of tiller works (helm init) but then, nothing. For example if I install any application in it:

$ helm install /path/to/chart \
                 --version=v0.1.0 \
                 --name=appname \
                 --namespace=sandboxname \
                 --debug \
                 -f config.yaml
[debug] Created tunnel using local port: '36848'

[debug] SERVER: "localhost:36848"

[debug] Original chart version: "v0.1.0"
[debug] CHART PATH:  /path/to/chart
(hang here)

Do you have any idea on how to debug it? Thanks

About this issue

Original URL
State: closed
Created 7 years ago
Comments: 16 (5 by maintainers)

Most upvoted comments

Per https://github.com/kubernetes/helm/issues/2224#issuecomment-356344286, the following commands resolved the error for me:

kubectl create serviceaccount --namespace kube-system tiller
kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
kubectl patch deploy --namespace kube-system tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'

vhosakot on Jan 9, 2018

Hi @Stibbons, sorry we didn’t get back to you sooner. I’m just getting back from vacation. Let me take a look at this after I get some ☕️ and 🍞.

bacongobbler on Nov 14, 2017

ingress controllers only proxy HTTP connections. Tiller communicates over gRPC, so exposing tiller through an ingress route won’t work.

It’s not recommended to expose tiller to the outside world anyways unless you enable TLS auth for tiller as anyone with direct access to tiller will have access to manage, install and uninstall cluster resources. It wouldn’t be a good day for your sysadmins when they realize their production clusters are running random bitcoin miner agents. 😉

It would be better if I had an error message to better advise on how to fix your RBAC setup.

bacongobbler on Nov 17, 2017