<p>I have a kubernetes cluster (rancherOS &amp; RKE) that has a running gitlab runner pod.
Connection to my GitLab instance works fine.</p>

<p>If I activate the pipeline, it directly fails with this error:</p>

<pre><code>Running with gitlab-runner 11.4.2 (cf91d5e1)
  on Kubernetes Runner e5e25776
Using Kubernetes namespace: gitlab-managed-apps
Using Kubernetes executor with image ubuntu:latest ...
ERROR: Job failed (system failure): pods is forbidden: User "system:serviceaccount:gitlab-managed-apps:default" cannot create pods in the namespace "gitlab-managed-apps"
</code></pre>

<p>This here is my gitlab-runner deployment yaml:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: gitlab-runner
  namespace: gitlab-managed-apps
spec:
  replicas: 1
  selector:
    matchLabels:
      name: gitlab-runner
  template:
    metadata:
      labels:
        name: gitlab-runner
    spec:
      containers:
      - args:
        - run
        image: gitlab/gitlab-runner:latest
        imagePullPolicy: Always
        name: gitlab-runner
        securityContext:
          privileged: true
        volumeMounts:
        - mountPath: /etc/gitlab-runner
          name: config
        - mountPath: /etc/ssl/certs
          name: cacerts
          readOnly: true
      restartPolicy: Always
      volumes:
      - configMap:
          name: gitlab-runner
        name: config
      - hostPath:
          path: /usr/share/ca-certificates/mozilla
        name: cacerts
      hostNetwork: true
</code></pre>

<p>I tried to add a security context with the parameter "privileged: true" but that does not help..</p>

<p>Has anyone an idea on how to grant the gitlab-runner deployment the right permission to create other pods in the namespace "gitlab-managed-apps"?</p>

<p>Thanks a lot :)</p>

<p>Your service account lacks permissions. A similar issue has happened to me during secrets creation.</p>

<p>You can grant access without having to fulfill any extra files, just with the help of <code>kubectl</code>. You should create a role binding, namely, grant a role to the <code>default</code> service account in a namespace. A full description is provided <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#service-account-permissions" rel="noreferrer">here</a>.</p>

<p>In your case the command will look like this:</p>

<pre><code>kubectl create rolebinding default-view --clusterrole=edit --serviceaccount=gitlab-managed-apps:default --namespace=gitlab-managed-apps
</code></pre>
