chore(docs): add guide for service accounts

[michelleN]

• closes Helm 2.2.3 not working properly with kubeadm 1.6.1 default RBAC rules #2224

[jascott1]

LGTM and much needed!

[michelleN]

Thanks @jascott1!
I updated this with a non cluster-admin example as well. Would you mind taking a peek when you have a chance?

[thomastaylor312]

This is really good and helpful. I left one small nit comment that doesn't need to be fixed if you don't want to.

[thomastaylor312]

Nit: Change "Read more about service account permissions in Kubernetes [in the official docs]" to "Read more about service account permissions [in the official Kubernetes docs]". Reads a little cleaner.

[seh]

One problem with this approach: Those with the ability to create pods in namespace "tiller-world" can use the "tiller" service account, attaining all the privileges meant for Tiller. That may be too generous when the normal permissions afforded to users are a subset of those you'd like to grant to Tiller.

[seh]

Another concern came to mind, after writing earlier: This arrangement is vulnerable to privilege escalation attack from people with limited access to this "tiller-world" namespace.

Say that someone has the following privileges in this namespace, and only these privileges:

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
 name: discover-tiller
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - list
- apiGroups:
  - ""
  resources:
  - pods/portforward
  verbs:
  - create
# Possibly even more restrictive:
# resourceNames:
# - <name of Tiller pod>

With those privileges, this person can run helm --tiller-namespace=tiller-world delete ..., or helm --tiller-namespace=tiller-world install ..., running any pods and reading any Secrets he likes within this namespace to which he wasn't supposed have any such privileges.

[seh]

It is strange to address the "namespaces" resource in a Role, as opposed to in a ClusterRole.