<p>I'm trying to setup a gitlab kubernetes agent and runner for my in-cluster CICD pipeline.
My gitlab.ci is something on the line of:</p>
<pre><code>stages:
  - deploy

deploy-new-images:
  stage: deploy
  image:
    name: alpine/helm:3.7.1
    entrypoint: [&quot;&quot;]
  script:
    - helm list --all-namespaces
  tags:
    - staging
    - test
</code></pre>
<p>Gitlab is able to start the container for this particular job but fails with the following error:</p>
<pre><code>Error: list: failed to list: secrets is forbidden: User &quot;system:serviceaccount:gitlab:default&quot; cannot list resource &quot;secrets&quot; in API group &quot;&quot; at the cluster scope
</code></pre>
<p>My agent deployment has a service account named <code>gitlab</code>. This service account is associated to the default admin ClusterRole via a ClusterRoleBinding; it is also associated with a Role via a RoleBinding resource.
The role has the following definition :</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  creationTimestamp: &quot;2022-04-14T15:27:27Z&quot;
  labels:
    app: gitlab-agent
  name: gitlab-agent
  namespace: gitlab
  resourceVersion: &quot;44732&quot;
  uid: 0b09cabe-826f-4c7c-a864-3192e0c9ea42
rules:
- apiGroups:
  - &quot;&quot;
  resources:
  - '*'
  verbs:
  - '*'
</code></pre>
<p>The gitlab runner on the other hand was deployed via Helm using the following values:</p>
<pre><code>  image: &quot;gitlab/gitlab-runner:alpine-v14.9.0&quot;
  imagePullPolicy: &quot;Always&quot;
  replicas: 5
  gitlabUrl: https://gitlab.com
  runnerRegistrationToken: &quot;{{ vault_gitlab_runner_registration_token }}&quot;
  unregisterRunners: true
  logLevel: &quot;debug&quot;
  rbac:
    create: true
    rules:
    - resources: [&quot;*&quot;]
      verbs: [&quot;*&quot;]
    - apiGroups: [&quot;&quot;]
      resources: [&quot;*&quot;]
      verbs: [&quot;*&quot;]
  clusterWideAccess: true
  metrics:
    enabled: false
  runners:
    executor: kubernetes
    locked: false
    tags: &quot;staging,test&quot;
    name: &quot;test-staging-gitlab-runner&quot;
    runUntagged: false
    config: |
      [[runners]]
        [runners.kubernetes]
          namespace = &quot;gitlab&quot;
          image = &quot;ubuntu:20.04&quot;
</code></pre>
<p>It seems to me that both the agent and the runner have sufficient permissions and yet the helm list command is failing. Any idea?</p>

<p><strong>In short:</strong> In your gitlab-runner values file, add the setting <code>service_account = &quot;gitlab&quot;</code> under <code>[runners.kubernetes]</code>.</p>
<p><strong>Explanation:</strong> The actual pod that executes the job is not the gitlab-runner pod, nor the gitlab agent pod. Gitlab runner kubernetes executor spawns a new pod for each job. The place to set the service account name for these pods is in the above setting.</p>
<p>The error message above shows that the pod running the job was using the default service account for the <code>gitlab</code> namespace. this service account doesn't (and shouldn't) have the required permissions.</p>
<p>The section <code>runners.config</code> in the values file, ends up in the config.toml file that configures the runner. Here is the documentation about config.toml for kubernetes executor: <a href="https://docs.gitlab.com/runner/executors/kubernetes.html#other-configtoml-settings" rel="nofollow noreferrer">https://docs.gitlab.com/runner/executors/kubernetes.html#other-configtoml-settings</a></p>
<p>And here is the <a href="https://docs.gitlab.com/runner/executors/kubernetes.html#kubernetes-executor-interaction-diagram" rel="nofollow noreferrer">Kubernetes executor interaction diagram</a></p>
