title: User "system:serviceaccount:gitlab:default" cannot get resource "deployments" in API group "apps" in the namespace "gitlab"
body: <p>I am trying to run a k8s deployment job from gitlab kubernetes executor.</p>
  <p>I deployed the kubernetes runner using helm as following.</p>
  <p>my values.yaml includes the following rbac rules:</p>
  <pre><code>rbac:
    create: true
    rules:
      - apiGroups: [&quot;&quot;]
        resources: [&quot;pods&quot;]
        verbs: [&quot;list&quot;, &quot;get&quot;, &quot;watch&quot;, &quot;create&quot;, &quot;delete&quot;]
      - apiGroups: [&quot;&quot;]
        resources: [&quot;pods/exec&quot;]
        verbs: [&quot;create&quot;]
      - apiGroups: [&quot;&quot;]
        resources: [&quot;pods/log&quot;]
        verbs: [&quot;get&quot;]
      - apiGroups: [&quot;&quot;]
        resources: [&quot;pods/attach&quot;]
        verbs: [&quot;list&quot;, &quot;get&quot;, &quot;create&quot;, &quot;delete&quot;, &quot;update&quot;]
      - apiGroups: [&quot;&quot;]
        resources: [&quot;secrets&quot;]
        verbs: [&quot;list&quot;, &quot;get&quot;, &quot;create&quot;, &quot;delete&quot;, &quot;update&quot;]      
      - apiGroups: [&quot;&quot;]
        resources: [&quot;configmaps&quot;]
        verbs: [&quot;list&quot;, &quot;get&quot;, &quot;create&quot;, &quot;delete&quot;, &quot;update&quot;]
      - apiGroups: [&quot;&quot;]
        resources: [&quot;services&quot;]
        verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;, &quot;create&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;delete&quot;]
      - apiGroups: [&quot;apps&quot;]
        resources: [&quot;deployments&quot;]
        verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;, &quot;create&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;delete&quot;]
  
  
    clusterWideAccess: true
  
    podSecurityPolicy:
      enabled: false
      resourceNames:
      - gitlab-runner
  </code></pre>
  <p>then</p>
  <pre><code>helm install --namespace gitlab gitlab-runner -f values.yaml gitlab/gitlab-runner
  </code></pre>
  <p>and, my .gitlab-ci.yml has the following stage:</p>
  <pre><code>  script:
      - mkdir -p /etc/deploy
      - echo $kube_config |base64 -d &gt; $KUBECONFIG
      - sed -i &quot;s/IMAGE_TAG/$CI_PIPELINE_ID/g&quot; deployment.yaml
      - cat deployment.yaml
      - kubectl apply -f deployment.yaml
  </code></pre>
  <p>and, I got the following error in pipeline logs:</p>
  <pre><code>$ kubectl apply -f deployment.yaml
  Error from server (Forbidden): error when retrieving current configuration of:
  Resource: &quot;apps/v1, Resource=deployments&quot;, GroupVersionKind: &quot;apps/v1, Kind=Deployment&quot;
  Name: &quot;java-demo&quot;, Namespace: &quot;gitlab&quot;
  Object: &amp;{map[&quot;apiVersion&quot;:&quot;apps/v1&quot; &quot;kind&quot;:&quot;Deployment&quot; &quot;metadata&quot;:map[&quot;annotations&quot;:map[&quot;kubectl.kubernetes.io/last-applied-configuration&quot;:&quot;&quot;] &quot;name&quot;:&quot;java-demo&quot; &quot;namespace&quot;:&quot;gitlab&quot;] &quot;spec&quot;:map[&quot;replicas&quot;:'\x01' &quot;selector&quot;:map[&quot;matchLabels&quot;:map[&quot;app&quot;:&quot;java-demo&quot;]] &quot;template&quot;:map[&quot;metadata&quot;:map[&quot;labels&quot;:map[&quot;app&quot;:&quot;java-demo&quot;]] &quot;spec&quot;:map[&quot;containers&quot;:[map[&quot;image&quot;:&quot;square2019/dummy-repo:555060965&quot; &quot;imagePullPolicy&quot;:&quot;Always&quot; &quot;name&quot;:&quot;java-demo&quot; &quot;ports&quot;:[map[&quot;containerPort&quot;:'\u1f90']]]]]]]]}
  from server for: &quot;deployment.yaml&quot;: deployments.apps &quot;java-demo&quot; is forbidden: User &quot;system:serviceaccount:gitlab:default&quot; cannot get resource &quot;deployments&quot; in API group &quot;apps&quot; in the namespace &quot;gitlab&quot;
  Error from server (Forbidden): error when retrieving current configuration of:
  Resource: &quot;/v1, Resource=services&quot;, GroupVersionKind: &quot;/v1, Kind=Service&quot;
  Name: &quot;java-demo&quot;, Namespace: &quot;gitlab&quot;
  Object: &amp;{map[&quot;apiVersion&quot;:&quot;v1&quot; &quot;kind&quot;:&quot;Service&quot; &quot;metadata&quot;:map[&quot;annotations&quot;:map[&quot;kubectl.kubernetes.io/last-applied-configuration&quot;:&quot;&quot;] &quot;name&quot;:&quot;java-demo&quot; &quot;namespace&quot;:&quot;gitlab&quot;] &quot;spec&quot;:map[&quot;ports&quot;:[map[&quot;name&quot;:&quot;java-demo&quot; &quot;port&quot;:'P' &quot;targetPort&quot;:'\u1f90']] &quot;selector&quot;:map[&quot;app&quot;:&quot;java-demo&quot;] &quot;type&quot;:&quot;ClusterIP&quot;]]}
  from server for: &quot;deployment.yaml&quot;: services &quot;java-demo&quot; is forbidden: User &quot;system:serviceaccount:gitlab:default&quot; cannot get resource &quot;services&quot; in API group &quot;&quot; in the namespace &quot;gitlab&quot;
  Cleaning up project directory and file based variables
  00:00
  ERROR: Job failed: command terminated with exit code 1
  </code></pre>
  <p>Am I missing some RBAC rules here?</p>
  <p>thank you!</p>
  <p>=== update 2022.06.04 =====</p>
  <pre><code>kubectl get role -n gitlab -o yaml
  apiVersion: v1
  items: []
  kind: List
  metadata:
    resourceVersion: &quot;&quot;
  </code></pre>
  <p>=== update 2022.06.05 ===</p>
  <p>Looking at the logic in <a href="https://gitlab.com/gitlab-org/charts/gitlab-runner/-/blob/main/templates/role.yaml" rel="nofollow noreferrer">https://gitlab.com/gitlab-org/charts/gitlab-runner/-/blob/main/templates/role.yaml</a>, I modified values.yaml with</p>
  <pre><code>clusterWideAccess: false
  </code></pre>
  <p>and, now i get the role as:</p>
  <pre><code>k get role -n gitlab -o yaml
  apiVersion: v1
  items:
  - apiVersion: rbac.authorization.k8s.io/v1
    kind: Role
    metadata:
      annotations:
        meta.helm.sh/release-name: gitlab-runner
        meta.helm.sh/release-namespace: gitlab
      creationTimestamp: &quot;2022-06-05T03:49:57Z&quot;
      labels:
        app: gitlab-runner
        app.kubernetes.io/managed-by: Helm
        chart: gitlab-runner-0.41.0
        heritage: Helm
        release: gitlab-runner
      name: gitlab-runner
      namespace: gitlab
      resourceVersion: &quot;283754&quot;
      uid: 8040b295-c9fc-47cb-8c5c-74cbf6c4d8a7
    rules:
    - apiGroups:
      - &quot;&quot;
      resources:
      - pods
      verbs:
      - list
      - get
      - watch
      - create
      - delete
    - apiGroups:
      - &quot;&quot;
      resources:
      - pods/exec
      verbs:
      - create
    - apiGroups:
      - &quot;&quot;
      resources:
      - pods/log
      verbs:
      - get
    - apiGroups:
      - &quot;&quot;
      resources:
      - pods/attach
      verbs:
      - list
      - get
      - create
      - delete
      - update
    - apiGroups:
      - &quot;&quot;
      resources:
      - secrets
      verbs:
      - list
      - get
      - create
      - delete
      - update
    - apiGroups:
      - &quot;&quot;
      resources:
      - configmaps
      verbs:
      - list
      - get
      - create
      - delete
      - update
    - apiGroups:
      - &quot;&quot;
      resources:
      - services
      verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
    - apiGroups:
      - apps
      resources:
      - deployments
      verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
  kind: List
  metadata:
    resourceVersion: &quot;&quot;
  </code></pre>
  <p>service account and RoleBinding</p>
  <pre><code>k get sa -n gitlab
  NAME            SECRETS   AGE
  default         1         3d2h
  gitlab-runner   1         2d2h
  
  k get RoleBinding -n gitlab
  NAME            ROLE                 AGE
  gitlab-runner   Role/gitlab-runner   9h
  </code></pre>
  <p>however, the same error persists.</p>
  <p>=== update 2022.06.06 ===</p>
  <p>I applied the following to fix the issue for the moment</p>
  <pre><code>kubectl create rolebinding --namespace=gitlab gitlab-runner-4 --role=gitlab-runner --serviceaccount=gitlab:default
  </code></pre>