Charts: Ngnix --set rbac.create=false is not working

[monika3376]

Hello,

tried to set rbac.create false, getting error. Command:
helm install stable/nginx-ingress --namespace kube-system --set rbac.create=false

Error:
Error: release handy-pike failed: clusterroles.rbac.authorization.k8s.io "handy-pike-nginx-ingress" is forbidden: attempt to grant extra privileges

replacement with new values.yaml is working fine.

Thanks,
Monika

[adam-resdiary]

I ran into the same issue. I did some digging and it looks like this is something that has been broken in the 0.19.0 release. I ran the following command multiple times, once for each version from 0.13.0 up to 0.19.0, and the last version where the flag was respected seems to be 0.18.0:

helm install stable/nginx-ingress --version 0.18.0 --name nginx-ingress --namespace ingress-nginx --set rbac.create=false,controller.publishService.enabled=true --dry-run --debug > nginx-ingress.0.18.0.log

[adam-resdiary]

I think I've maybe figured out what's going on here. In https://github.com/kubernetes/charts/pull/5169, a change was made that also defaults rbac.createRole and rbac.createClusterRole to true. So if I run the following command, I get the same behavior as before the change:

helm install stable/nginx-ingress --version 0.19.0 --namespace ingress-nginx --set rbac.create=false,rbac.createRole=false,rbac.createClusterRole=false,controller.publishService.enabled=true --dry-run --debug > nginx-ingress.0.19.0.log

Is this the intended behaviour? I also notice that these two options aren't listed in the configuration table on https://github.com/kubernetes/charts/tree/master/stable/nginx-ingress, and the default value for rbac.create is specified as false, even though it's now been changed to true.

I don't mind putting together a PR for the docs if that would help - I just am pretty new to Helm and Kubernetes, so I'm not completely sure I understand the options.

[alexvicegrab]

Confirmed, the key was:

--set rbac.create=false,rbac.createRole=false,rbac.createClusterRole=false

since one of the latest pull requests auto-set those to true without documenting --> Ingress RBAC was reactivated by default:

https://github.com/kubernetes/charts/commit/c60086ec0b260996281d337d67f2361f826f7029

[unguiculus]

I create #5639 which should make things better.