问题描述：
使用 helm 安装 prometheus ，出现如下错误：
Error: release monitor failed: clusterroles.rbac.authorization.k8s.io "monitor-prometheus-server" is forbidden: attempt to grant extra privileges: [PolicyRule{NonResourceURLs:["/metrics"], Verbs:["get"]}] user=&{system:serviceaccount:kube-system:tiller 8fc1bfb3-75d6-11e8-a678-5cf3fc1b923c [system:serviceaccounts system:serviceaccounts:kube-system system:authenticated] map[]} ownerrules=[PolicyRule{APIGroups:["authorization.k8s.io"], Resources:["selfsubjectaccessreviews" "selfsubjectrulesreviews"], Verbs:["create"]} PolicyRule{NonResourceURLs:["/api" "/api/*" "/apis" "/apis/*" "/healthz" "/openapi" "/openapi/*" "/swagger-2.0.0.pb-v1" "/swagger.json" "/swaggerapi" "/swaggerapi/*" "/version" "/version/"], Verbs:["get"]} PolicyRule{APIGroups:["*"], Resources:["*"], Verbs:["*"]}] ruleResolutionErrors=[]该问题是由于 Tiller 权限不足引起的，
方案1： 重新部署 Tiller，加上 --service-account 参数
helm reset
helm init --service-account tiller方案2：直接给 Tiller 打补丁
注意 命名空间、 tiller deployment 名称跟你的实际名字对应上
kubectl create serviceaccount --namespace kube-system tiller
kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
kubectl patch deploy --namespace kube-system tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'