<p>I changed something and deployed on a new cluster then I got this error even though I didn't change anything in the code. Has anybody seen it before?</p>

<p>from server for: </p>

<pre><code>"/builds/dropcunt/nettmoster.com/deployment/webapp.yml": ingresses.extensions "nettmoster.comn-273414" is forbidden: User "system:serviceaccount:gitlab-managed-apps:default" cannot get resource "ingresses" in API group "extensions" in the namespace "nettmoster-com-9777808"
59 Error from server (Forbidden): error when retrieving current configuration of:
</code></pre>

<p>As suggested I run<code>kubectl auth can-i --list --as=system:serviceaccount:gitlab-managed-apps:default</code></p>

<p>It returns: 
<a href="https://i.stack.imgur.com/8aEoE.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/8aEoE.png" alt="enter image description here"></a></p>

<p>This is a RBAC problem. The service account <code>system:serviceaccount:gitlab-managed-apps:default</code> does not have permission to get <code>ingress</code> resource in the new cluster. </p>

<p>You can compare what permission a service account have by running below command in both the cluster</p>

<pre><code>kubectl auth can-i --list --as=system:serviceaccount:gitlab-managed-apps:default
</code></pre>

<p>Run below commands to get permission via RBAC</p>

<pre><code>kubectl create role ingress-reader --verb=get,list,watch,update --resource=ingress    
kubectl create rolebinding ingress-reader-role --role=ingress-reader --serviceaccount=gitlab-managed-apps:default
</code></pre>
