<p>so basically i changed my website to a new kubernetes cluster. Now it is necessary to enable RBAC. The pipeline runs without any errors but unfortunately the certmanager SSH doesn't work anymore. I installed certmanager with gitlab so now I'm wondering if this could have anything to do with the change to RBAC? Unfortunetally i'm new with RBAC so I don't really understand if it could be related or not. Can anybody help?</p>

<p>Here is a picture from the error when I run whynopadlock: </p>

<p><a href="https://i.stack.imgur.com/cFX9F.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/cFX9F.png" alt="whynopadlock 1"></a></p>

<p><a href="https://i.stack.imgur.com/MRYYP.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/MRYYP.png" alt="whynopadlock 2"></a></p>

<p>Edit: This is the output when I run:</p>

<pre><code>kubectl auth can-i --list --as=system:serviceaccount:gitlab-managed-apps:default
</code></pre>

<p><a href="https://i.stack.imgur.com/4xCb6.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/4xCb6.png" alt="enter image description here"></a></p>

<p>Deploy cert-manager to managed cluster for SSL certificates is an issue requested for the past two years (<a href="https://gitlab.com/gitlab-org/gitlab-foss/-/issues/40635" rel="nofollow noreferrer">issue 40635</a>)<br>
<a href="https://gitlab.com/gitlab-org/gitlab/-/issues/29650" rel="nofollow noreferrer">Issue 29650</a> shows the all process is not yet well documented.</p>

<p>But you still have an <a href="https://gitlab.com/gitlab-org/gitlab-foss/-/issues/40635#note_130063501" rel="nofollow noreferrer">ingress working with cert manager</a>, meaning having the annotations expected by a cert manager:</p>

<ul>
<li><code>kubernetes.io/ingress.class: nginx</code></li>
<li><code>kubernetes.io/tls-acme: "true"</code> </li>
</ul>

<p>That could help with <a href="https://docs.gitlab.com/charts/installation/rbac.html" rel="nofollow noreferrer">RBAC</a>, even though <a href="https://gitlab.com/gitlab-org/gitlab/issues/33186" rel="nofollow noreferrer">issue 33186</a> shows this setup as not fully working.</p>
