GitLab CI+Helm部署Minikube遇Secrets权限错误求助

尝试通过GitLab CI流水线将Java Spring项目部署到本地Minikube时，持续遇到权限错误：

ERROR: Job failed (system failure): prepare environment: setting up credentials: secrets is forbidden: User "system:serviceaccount:maverick:default" cannot create resource "secrets" in API group "" in the namespace "maverick". Check https://docs.gitlab.com/runner/shells/index.html#shell-profile-loading for more information

已在maverick命名空间部署GitLab Runner，相关配置如下：

ServiceAccount & RBAC配置 #

apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitlab-runner
  namespace: maverick
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: gitlab-runner
  namespace: maverick
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["list", "get", "watch", "create", "delete"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["create"]
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get"]
  - apiGroups: [""]
    resources: ["pods/attach"]
    verbs: ["list", "get", "create", "delete", "update"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["list", "get", "create", "delete", "update"]
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["list", "get", "watch", "create", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: gitlab-runner
  namespace: maverick
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: maverick
subjects:
- namespace: maverick
  kind: ServiceAccount
  name: gitlab-runner

GitLab Runner Values配置 #

gitlabUrl: https://gitlab.com/
runnerRegistrationToken: ".... my token .... "

runners:
  privileged: false
  tags: k8s
  serviceAccountName: gitlab-runner

gitlab-ci.yml #

docker-build-job:
  stage: docker-build
  image: $MAVEN_IMAGE
  script:
    - mvn jib:build -Djib.to.image=${CI_REGISTRY_IMAGE}:latest -Djib.to.auth.username=${CI_REGISTRY_USER} -Djib.to.auth.password=${CI_REGISTRY_PASSWORD}

deploy-job:
  image: alpine/helm:3.2.1
  stage: deploy
  tags:
    - k8s
  script:
    - helm upgrade ${APP_NAME} ./charts --install --values=./charts/values.yaml --namespace ${APP_NAME}
  rules:
    - if: $CI_COMMIT_BRANCH == 'master'
      when: always

Chart中的deployment.yaml #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: maverick
  namespace: maverick
spec:
  replicas: 1
  selector:
    matchLabels:
      app: maverick
  template:
    metadata:
      labels:
        app: maverick
    spec:
      containers:
        - name: maverick
          image: registry.gitlab.com/gfalco77/maverick:latest
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8001
      imagePullSecrets:
        - name: registry-credentials
---
apiVersion: v1
kind: Service
metadata:
  name: maverick
spec:
  ports:
    - name: maverick
      port: 8001
      targetPort: 8001
      protocol: TCP
  selector:
    app: maverick

已在maverick命名空间创建镜像拉取密钥registry-credentials：

apiVersion: v1
kind: Secret
metadata:
  name: registry-credentials
  namespace: maverick
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: .. base64 creds ..

尽管已配置GitLab Runner的Secrets创建权限，仍出现上述错误，需排查问题并解决。

错误信息明确显示，当前使用的是system:serviceaccount:maverick:default服务账号，而非配置的gitlab-runner账号，导致没有创建Secrets的权限。核心问题在于RoleBinding配置错误：

• 定义的Role名称为gitlab-runner，但RoleBinding的roleRef.name却写为maverick，导致权限绑定失败，GitLab Runner无法使用具备权限的gitlab-runner账号， fallback到default账号。

1. 修正RoleBinding配置
   将RoleBinding中的roleRef.name改为实际的Role名称gitlab-runner，修改后的配置如下：

   apiVersion: rbac.authorization.k8s.io/v1
   kind: RoleBinding
   metadata:
     name: gitlab-runner
     namespace: maverick
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: Role
     name: gitlab-runner  # 此处修改为正确的Role名称
   subjects:
   - namespace: maverick
     kind: ServiceAccount
     name: gitlab-runner
   

   应用修改：

   kubectl apply -f <your-rbac-file.yaml> -n maverick
   

2. 重启GitLab Runner Pod
   确保Runner使用更新后的权限配置，重启Runner Pod：

   kubectl delete pod -l app=gitlab-runner -n maverick
   

3. 验证服务账号权限
   检查gitlab-runner服务账号是否已正确绑定权限：

   kubectl auth can-i create secrets -n maverick --as=system:serviceaccount:maverick:gitlab-runner
   

   如果返回yes，说明权限配置生效。

4. 额外检查（可选）

   • 确认GitLab Runner的Values配置中serviceAccountName确实为gitlab-runner，且已正确应用到Runner部署。
   • 检查deploy-job指定的tags: k8s是否与Runner注册时的标签匹配，确保任务被正确调度到目标Runner。

内容的提问来源于stack exchange，提问作者Gfalco