<p>I'm trying to use helm from my github actions runner to deploy to my GKE cluster but I'm running into a permissions error.</p>
<p>Using a google cloud service account for authentication</p>
<p><strong>GitHub Actions CI step</strong></p>
<pre><code>      - name: Install gcloud cli
        uses: google-github-actions/setup-gcloud@master
        with:
          version: latest
          project_id: ${{ secrets.GCLOUD_PROJECT_ID }}
          service_account_email: ${{ secrets.GCLOUD_SA_EMAIL }}
          service_account_key: ${{ secrets.GCLOUD_SA_KEY }}
          export_default_credentials: true

      - name: gcloud configure
        run: |
          gcloud config set project ${{secrets.GCLOUD_PROJECT_ID}};
          gcloud config set compute/zone ${{secrets.GCLOUD_COMPUTE_ZONE}};
          gcloud container clusters get-credentials ${{secrets.GCLOUD_CLUSTER_NAME}};

      - name: Deploy
        run: |
          ***
          helm upgrade *** ./helm \
            --install \
            --debug \
            --reuse-values \
            --set-string &quot;$overrides&quot;
</code></pre>
<p><strong>The error</strong></p>
<pre><code>history.go:56: [debug] getting history for release blog
Error: query: failed to query with labels: secrets is forbidden: User &quot;***&quot; cannot list resource &quot;secrets&quot; in API group &quot;&quot; in the namespace &quot;default&quot;: requires one of [&quot;container.secrets.list&quot;] permission(s).
helm.go:88: [debug] secrets is forbidden: User &quot;***&quot; cannot list resource &quot;secrets&quot; in API group &quot;&quot; in the namespace &quot;default&quot;: requires one of [&quot;container.secrets.list&quot;] permission(s).
</code></pre>

Casey Flynn
<p>It seems you're trying to deploy code by using the GKE <strong>viewer role</strong> , hence your getting the permission issue. You can create the required <strong>IAM policies</strong> and <strong>role based access control (RBAC)</strong> as per your <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/access-control" rel="nofollow noreferrer">requirement</a>.</p>
<p>You can also check kubernetes engine roles and responsibilities by using this <a href="https://cloud.google.com/iam/docs/understanding-roles#kubernetes-engine-roles" rel="nofollow noreferrer">reference</a>.</p>
