<h1>Introduction :</h1>
<p>I am trying to deploy a <strong>RabbitMq</strong> Helm Chart to GKE, with my Gitlab CI/CD pipeline. The command I use to install my chart is:</p>
<pre><code>helm upgrade --install rabbitmq --create-namespace --namespace kubi-app-main -f envs/main/rabbitmq/rabbitmq.yaml bitnami/rabbitmq
</code></pre>
<h3>envs/rabbitmq/rabbitmq.yaml:</h3>
<pre><code>auth:
  username: user
  password: password
# The used vhost is default-vhost
extraConfiguration: |-
  default_vhost = default-vhost
  default_permissions.configure = .*
  default_permissions.read = .*
  default_permissions.write = .*
</code></pre>
<p>The Gitlab job first connect to GKE cluster with gcloud:</p>
<pre><code>echo &quot;$SERVICE_ACCOUNT_KEY&quot; &gt; key.json
gcloud auth activate-service-account --key-file=key.json
gcloud config set project project-kubi-app
gcloud container clusters get-credentials cluster-1 --zone europe-west9-a --project project-kubi-app
</code></pre>
<h1>The Issue:</h1>
<p>But the helm upgrade fails:</p>
<blockquote>
<p>Error: roles.rbac.authorization.k8s.io is forbidden: User &quot;kubiapp-cluster-sa@project-kubi-app.iam.gserviceaccount.com&quot; cannot create resource &quot;roles&quot; in API group &quot;rbac.authorization.k8s.io&quot; in the namespace &quot;kubi-app-main&quot;: requires one of [&quot;container.roles.create&quot;] permission(s).</p>
</blockquote>
<ul>
<li>Checking the roles of the user (service account) on the project</li>
</ul>
<blockquote>
<p>gcloud projects get-iam-policy project-kubi-app  --flatten=&quot;bindings[].members&quot; --format='table(bindings.role)' --filter=&quot;bindings.members:kubiapp-cluster-sa@project-kubi-app.iam.gserviceaccount.com&quot;</p>
</blockquote>
<p>This will return <code>ROLE roles/editor</code>, meaning that my service account has an editor role on the project.</p>
<hr />
<p>From what I understand, the service account <strong>kubiapp-cluster-sa@project-kubi-app.iam.gserviceaccount.com</strong> has the editor role on the project <strong>project-kubi-app</strong>. <br>
<strong>BUT</strong> the service account that I am using can't create a role in the namespace <strong>kubi-app-main</strong>.<br>
I don't understand the use of this role, but it's origin is from the RabbitMq Helm Chart.<br></p>
<p>From the RabbitMq Helm Chart:</p>
<pre><code>...
# Source: rabbitmq/templates/rolebinding.yaml
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: rabbitmq-endpoint-reader
  namespace: &quot;kubi-app-main&quot;
  labels:
    app.kubernetes.io/name: rabbitmq
    helm.sh/chart: rabbitmq-10.1.8
    app.kubernetes.io/instance: rabbitmq
    app.kubernetes.io/managed-by: Helm
subjects:
  - kind: ServiceAccount
    name: rabbitmq
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: rabbitmq-endpoint-reader
...
---
</code></pre>
<hr />
<h1>EDIT:</h1>
<p>I have changed my service account role to Owner and now it works, but I would like to know the role required to create other roles.</p>

Hamza Ince
<p><code>roles/editor</code> allows you to create/update/delete resources for most/many services, but does not include the permission to perform any of those operations on roles in general.  <code>roles/owner</code>, on the other hand, does as it essentially makes you an admin of (almost every) resource.</p>
<p>For GKE, the usual role required to create/modify/update roles within the cluster is <code>roles/container.clusterAdmin</code>.  Check out <a href="https://cloud.google.com/iam/docs/understanding-roles#kubernetes-engine-roles" rel="nofollow noreferrer">GKE roles</a>.</p>
