<p>I've been pulling my hair out over this for too many hours... I'm pretty new to kubernetes so I know I must be missing something.</p>

<p><strong>"ERROR: Job failed (system failure): the server does not allow access to the requested resource (post pods)"</strong></p>

<p>We have a GitLab instance setup on a VM, and another VM with the GitLab runner installed. Both live in Google Cloud Compute Engine.</p>

<p>We also have a Kubernetes cluster spun up on Google Cloud.</p>

<p>When the runner attempts to run, it results in the following:</p>

<pre><code>Running with gitlab-runner 10.0.2 (a9a76a50)
  on rd-002-optic-nexus (21590677)
Using Kubernetes namespace: gitlab
Using Kubernetes executor with image docker:git ...
ERROR: Job failed (system failure): the server does not allow access to the requested resource (post pods)
</code></pre>

<p>Due to the Runner being "external" to the cluster, my only option is to authenticate to the API server via "client certificate" authentication.</p>

<p>I'm using the cluster ca.crt provided from the Google Cloud Console, and have followed <a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/#overview" rel="nofollow noreferrer">Kubernetes guide</a> to create a client cert. However, I just can't get it to work.</p>

<ul>
<li>I can ping the Kubernetes server no problem from the (Runner) VM.</li>
<li>GitLab is hooked up to the runner and does attempt to use it (hence the output above).</li>
<li>In the kubernetes cluster, we've:

<ul>
<li>created the namespace "gitlab".</li>
<li>created a service account "gitlab-sa" in the "gitlab" namespace.</li>
<li>generated and approved the client certificate ok (csr details below).</li>
</ul></li>
<li>The certificates on the runner have read permissions for everyone.</li>
</ul>

<p>I must be missing something somewhere. </p>

<h3>GitLab Runner Config</h3>

<pre><code>concurrent = 1
check_interval = 0
[[runners]]
  name = "rd-002-optic-nexus"
  url = "https://our.gitlab.instance.com/"
  token = "21590677f31b57bce610ef3f4cb20d"
  executor = "kubernetes"
  [runners.kubernetes]
    host = "https://111.222.x.xxx"
    cert_file = "/usr/local/share/ca-certificates/kube-client.crt"
    key_file = "/usr/local/share/ca-certificates/kube-client.key"
    ca_file = "/usr/local/share/ca-certificates/kubernetes-ca.crt"
    namespace = "gitlab"
    namespace_overwrite_allowed = ""
    privileged = false
    cpu_limit = "1"
    memory_limit = "1Gi"
    service_cpu_limit = "1"
    service_memory_limit = "1Gi"
    helper_cpu_limit = "500m"
    helper_memory_limit = "100Mi"
    [runners.kubernetes.node_selector]
      gitlab = "true"
</code></pre>

<h3>Kubernetes Client CSR</h3>

<pre><code>apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: gitlab-sa.gitlab
spec:
  groups:
  - system:authenticated
  request: $(cat server.csr | base64 | tr -d '\n')
  usages:
  - digital signature
  - key encipherment
  - server auth
</code></pre>

<p>Any thoughts? Anything I'm missing?</p>

<p>Your client certificate has a usage for server auth instead of client auth. For your TLS client to use the certificate to authenticate to the Kubernetes apiserver it needs to provide a certificate with the client auth usage. </p>
