<p>Currently I'm facing the issue:</p>
<pre><code>ERROR: Job failed (system failure): 
prepare environment: 
setting up credentials: 
secrets is forbidden: 
User &quot;system:serviceaccount:default:gitlab-runner&quot; cannot create
resource &quot;secrets&quot; in API group &quot;&quot; in the namespace &quot;gitlab&quot;` 
after following the official documentation on how to integrate the GitLab Runner.
</code></pre>
<p>I'm using the following <code>runner-chart-values.yaml</code>:</p>
<pre><code># The GitLab Server URL (with protocol) that want to register the runner against
# ref: https://docs.gitlab.com/runner/commands/README.html#gitlab-runner-register
#
gitlabUrl: http://example.domain/

# The Registration Token for adding new runners to the GitLab Server. This must
# be retrieved from your GitLab instance.
# ref: https://docs.gitlab.com/ce/ci/runners/README.html
#
runnerRegistrationToken: &quot;&lt;token&gt;&quot;

# For RBAC support:
rbac:
    create: true
    rules:
      - apiGroups: [&quot;*&quot;]

# Run all containers with the privileged flag enabled
# This will allow the docker:dind image to run if you need to run Docker
# commands. Please read the docs before turning this on:
# ref: https://docs.gitlab.com/runner/executors/kubernetes.html#using-dockerdind
runners:
    privileged: true
</code></pre>
<p>Any clues what's going on?</p>
<p>Many thanks!</p>

<p>For me adding all necessary roles was the only solution that actually helped.</p>
<p>Here the corresponding runner-chart-values.yaml file:</p>
<pre><code>## GitLab Runner Image
gitlabUrl: http://example.domain/
runnerRegistrationToken: &quot;&lt;token&gt;&quot;

rbac:
  create: true
  rules:
    - apiGroups: [&quot;&quot;]
      resources: [&quot;pods&quot;]
      verbs: [&quot;list&quot;, &quot;get&quot;, &quot;watch&quot;, &quot;create&quot;, &quot;delete&quot;]
    - apiGroups: [&quot;&quot;]
      resources: [&quot;pods/exec&quot;]
      verbs: [&quot;create&quot;]
    - apiGroups: [&quot;&quot;]
      resources: [&quot;pods/log&quot;]
      verbs: [&quot;get&quot;]
    - apiGroups: [&quot;&quot;]
      resources: [&quot;pods/attach&quot;]
      verbs: [&quot;list&quot;, &quot;get&quot;, &quot;create&quot;, &quot;delete&quot;, &quot;update&quot;]
    - apiGroups: [&quot;&quot;]
      resources: [&quot;secrets&quot;]
      verbs: [&quot;list&quot;, &quot;get&quot;, &quot;create&quot;, &quot;delete&quot;, &quot;update&quot;]      
    - apiGroups: [&quot;&quot;]
      resources: [&quot;configmaps&quot;]
      verbs: [&quot;list&quot;, &quot;get&quot;, &quot;create&quot;, &quot;delete&quot;, &quot;update&quot;]      

runners:
  privileged: true
</code></pre>
