<p>I've installed GitLab runner on a kubernetes cluster under a namespace <code>gitlab-runner</code>. Like so</p>

<pre><code># cat &lt;&lt;EOF | kubectl create -f -
{
  "apiVersion": "v1",
  "kind": "Namespace",
  "metadata": {
    "name": "gitlab-runner",
    "labels": {
      "name": "gitlab-runner"
    }
  }
}

# helm repo add gitlab https://charts.gitlab.io
# cat &lt;&lt;EOF|helm install --namespace gitlab-runner gitlab-runner -f - gitlab/gitlab-runner
gitlabUrl: https://gitlab.mycompany.com
runnerRegistrationToken: "c................Z"
</code></pre>

<p>The GitLab runner properly registers with the GitLab project but all jobs fail. </p>

<p>A quick look into the GitLab runner logs tells me that the service account used by the GitLab runner lack the proper permissions:</p>

<pre><code># kubectl logs --namespace gitlabrunner gitlab-runner-gitlab-runner-xxxxxxxxx
ERROR: Job failed (system failure): pods is forbidden: User "system:serviceaccount:gitlabrunner:default" cannot create resource "pods" in API group "" in the namespace "gitlab-runner"  duration=42.095493ms job=37482 project=yyy runner=xxxxxxx
</code></pre>

<p>What permission does the gitlab runner kubernetes executor need?</p>

<p>I couldn't find in the <a href="https://docs.gitlab.com/runner/" rel="noreferrer">GitLab runner documentation</a> a list of permissions but I try adding permissions one by one and I compiled a list of the permission required for basic functioning.</p>

<p>The gitlab runner will use the service account <code>system:serviceaccount:gitlab-runner:default</code> so we need to create a role and assign that role to that service account.</p>

<pre><code># cat &lt;&lt;EOF | kubectl create -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: gitlab-runner
  namespace: gitlab-runner
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["list", "get", "watch", "create", "delete"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["create"]
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get"]

# kubectl create rolebinding --namespace=gitlab-runner gitlab-runner-binding --role=gitlab-runne r --serviceaccount=gitlab-runner:default
</code></pre>

<p>With that role assigned to the service account, GitLab runner will be able to create, execute and delete the pod and also access the logs. </p>
