configure-tiller-helm.html.md.erb

---
title: Configuring Tiller
owner: PKS
---

Tiller runs inside the Kubernetes cluster and requires access to the Kubernetes API.
If you use role-based access control (RBAC) in PKS, perform the steps in this section to grant
Tiller permission to access the API.

1. Create a service account for Tiller and bind it to the `cluster-admin` role by adding the following section to `rbac-config.yaml`:

    ```yaml
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: tiller
      namespace: kube-system
    ---
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRoleBinding
    metadata:
      name: tiller
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: cluster-admin
    subjects:
      - kind: ServiceAccount
        name: tiller
        namespace: kube-system
    ```

1. Apply the service account and role by running the following command:
  <pre class="terminal">
  $ kubectl create -f rbac-config.yaml
  </pre>

1. Download and install the [Helm CLI](https://github.com/kubernetes/helm/releases).

1. Deploy Helm using the service account by running the following command:
  <pre class="terminal">
  $ helm init --service-account tiller
  </pre>

1. Run `helm ls` to verify that the permissions are configured.

To apply more granular permissions to the Tiller service account, see the [Helm RBAC](https://github.com/kubernetes/helm/blob/master/docs/rbac.md) documentation.