This is the config.yaml i used while registering the runner using helm:
gitlabUrl: https://gitlab.com/
runnerRegistrationToken: "teste"
rbac:
create: true
clusterWideAccess: true
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["list", "get", "watch", "create", "delete"]
- apiGroups: [""]
resources: ["pods/exec"]
verbs: ["create"]
- apiGroups: [""]
resources: ["pods/log"]
verbs: ["get"]
- apiGroups: [""]
resources: ["pods/attach"]
verbs: ["list", "get", "create", "delete", "update"]
- apiGroups: [""]
resources: ["secrets"]
verbs: ["list", "get", "create", "delete", "update"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["list", "get", "create", "delete", "update"]
runners:
privileged: true
The runner registers in the project and it can run pipelines. This is just a sample pipeline:
deploy:
image:
name: bitnami/kubectl:latest
entrypoint: [""]
script:
- kubectl get pods --all-namespaces
- kubectl get all -o wide -n default
- kubectl get all -o wide
My idea would be to just test some stuff before running bigger stuff. I want to compile an npm project and apply the manifests generated by it, using kubectl apply. For that my permissions need to be ok but as you can see by the error they are not:
Running with gitlab-runner 14.7.0 (98daeee0)
on gitlab-runner-gitlab-runner-c9ff48788-mnjg4 TxcjDzRY
Preparing the "kubernetes" executor
00:00
Using Kubernetes namespace: gitlab
Using Kubernetes executor with image bitnami/kubectl:latest ...
Using attach strategy to execute scripts...
Preparing environment
Waiting for pod gitlab/runner-txcjdzry-project-33497622-concurrent-0zmp85 to be running, status is Pending
Waiting for pod gitlab/runner-txcjdzry-project-33497622-concurrent-0zmp85 to be running, status is Pending
ContainersNotReady: "containers with unready status: [build helper]"
ContainersNotReady: "containers with unready status: [build helper]"
Running on runner-txcjdzry-project-33497622-concurrent-0zmp85 via gitlab-runner-gitlab-runner-c9ff48788-mnjg4...
Getting source from Git repository
00:02
Fetching changes with git depth set to 20...
Initialized empty Git repository in /builds/rafaelmoreira1180778/home-media-center/.git/
Created fresh repository.
Checking out 8082bd65 as master...
Skipping Git submodules setup
Executing "step_script" stage of the job script
00:01
$ kubectl get pods --all-namespaces
Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:gitlab:default" cannot list resource "pods" in API group "" at the cluster scope
Cleaning up project directory and file based variables
00:01
ERROR: Job failed: command terminated with exit code 1
Can anyone help me understand why this is happening? What have I missed? Also: do i have to re-register the runner or can I upgrade the helm chart with the new config?