GitLab Runner集成Kubernetes集群报错：无法在gitlab命名空间创建Secrets资源

Hey there, let's break down this error and fix it quickly.

The error message tells you exactly what's wrong: the ServiceAccount system:serviceaccount:default:gitlab-runner doesn't have permission to create secrets in the gitlab namespace.

Looking at your runner-chart-values.yaml, the RBAC rules you defined are incomplete. You only specified apiGroups: ["*"] but didn't list which resources the ServiceAccount can interact with, or what actions (verbs) it's allowed to perform on those resources. GitLab Runner needs to create Secrets to manage job credentials when using the Kubernetes executor, so this missing permission is blocking it.

Here's the corrected configuration you need to update in your values file:

# Keep your existing config, update only the rbac section
rbac:
  create: true
  rules:
  # Grant permissions for core API group resources (Secrets, Pods, etc.)
  - apiGroups: [""]  # Empty string targets Kubernetes' core API group (where Secrets live)
    resources: ["secrets"]
    verbs: ["create", "get", "list", "delete"]  # Allow necessary Secret operations
  # Add these if your runner needs to manage pods, logs, or configmaps (common requirements)
  - apiGroups: [""]
    resources: ["pods", "pods/exec", "pods/log", "configmaps"]
    verbs: ["create", "get", "list", "delete", "update"]

runners:
  privileged: true
  # Don't forget to fill in your actual GitLab URL and registration token!
  gitlabUrl: "https://your-gitlab-instance.com"
  runnerRegistrationToken: "your-registration-token-here"

Once you've updated the values file, redeploy the GitLab Runner Helm chart to apply the new permissions:

# If upgrading an existing deployment
helm upgrade --install gitlab-runner gitlab/gitlab-runner -f runner-chart-values.yaml

# If this is a fresh install
helm install gitlab-runner gitlab/gitlab-runner -f runner-chart-values.yaml

This should resolve the permission error—your runner will now have the necessary access to create Secrets in the gitlab namespace, plus other common permissions it needs to manage Kubernetes jobs.

内容的提问来源于stack exchange，提问作者andreas.teich