我正在尝试从gitlab kubernetes executor运行k8s部署作业。
我使用helm部署kubernetes runner如下。
myvalues.yaml包含以下rbac规则：

rbac:
  create: true
  rules:
    - apiGroups: [""]
      resources: ["pods"]
      verbs: ["list", "get", "watch", "create", "delete"]
    - apiGroups: [""]
      resources: ["pods/exec"]
      verbs: ["create"]
    - apiGroups: [""]
      resources: ["pods/log"]
      verbs: ["get"]
    - apiGroups: [""]
      resources: ["pods/attach"]
      verbs: ["list", "get", "create", "delete", "update"]
    - apiGroups: [""]
      resources: ["secrets"]
      verbs: ["list", "get", "create", "delete", "update"]      
    - apiGroups: [""]
      resources: ["configmaps"]
      verbs: ["list", "get", "create", "delete", "update"]
    - apiGroups: [""]
      resources: ["services"]
      verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
    - apiGroups: ["apps"]
      resources: ["deployments"]
      verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

  clusterWideAccess: true

  podSecurityPolicy:
    enabled: false
    resourceNames:
    - gitlab-runner

然后

helm install --namespace gitlab gitlab-runner -f values.yaml gitlab/gitlab-runner

而my .gitlab-ci.yml有以下阶段：

script:
    - mkdir -p /etc/deploy
    - echo $kube_config |base64 -d > $KUBECONFIG
    - sed -i "s/IMAGE_TAG/$CI_PIPELINE_ID/g" deployment.yaml
    - cat deployment.yaml
    - kubectl apply -f deployment.yaml

并且，我在管道日志中得到以下错误：

$ kubectl apply -f deployment.yaml
Error from server (Forbidden): error when retrieving current configuration of:
Resource: "apps/v1, Resource=deployments", GroupVersionKind: "apps/v1, Kind=Deployment"
Name: "java-demo", Namespace: "gitlab"
Object: &{map["apiVersion":"apps/v1" "kind":"Deployment" "metadata":map["annotations":map["kubectl.kubernetes.io/last-applied-configuration":""] "name":"java-demo" "namespace":"gitlab"] "spec":map["replicas":'\x01' "selector":map["matchLabels":map["app":"java-demo"]] "template":map["metadata":map["labels":map["app":"java-demo"]] "spec":map["containers":[map["image":"square2019/dummy-repo:555060965" "imagePullPolicy":"Always" "name":"java-demo" "ports":[map["containerPort":'\u1f90']]]]]]]]}
from server for: "deployment.yaml": deployments.apps "java-demo" is forbidden: User "system:serviceaccount:gitlab:default" cannot get resource "deployments" in API group "apps" in the namespace "gitlab"
Error from server (Forbidden): error when retrieving current configuration of:
Resource: "/v1, Resource=services", GroupVersionKind: "/v1, Kind=Service"
Name: "java-demo", Namespace: "gitlab"
Object: &{map["apiVersion":"v1" "kind":"Service" "metadata":map["annotations":map["kubectl.kubernetes.io/last-applied-configuration":""] "name":"java-demo" "namespace":"gitlab"] "spec":map["ports":[map["name":"java-demo" "port":'P' "targetPort":'\u1f90']] "selector":map["app":"java-demo"] "type":"ClusterIP"]]}
from server for: "deployment.yaml": services "java-demo" is forbidden: User "system:serviceaccount:gitlab:default" cannot get resource "services" in API group "" in the namespace "gitlab"
Cleaning up project directory and file based variables
00:00
ERROR: Job failed: command terminated with exit code 1

我是否在这里遗漏了一些RBAC规则？
谢谢你！
=更新2022.06.04 =

kubectl get role -n gitlab -o yaml
apiVersion: v1
items: []
kind: List
metadata:
  resourceVersion: ""

=更新2022.06.05 ==
查看https://gitlab.com/gitlab-org/charts/gitlab-runner/-/blob/main/templates/role.yaml中的逻辑，我修改了values.yaml，

clusterWideAccess: false

现在我的角色是

k get role -n gitlab -o yaml
apiVersion: v1
items:
- apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    annotations:
      meta.helm.sh/release-name: gitlab-runner
      meta.helm.sh/release-namespace: gitlab
    creationTimestamp: "2022-06-05T03:49:57Z"
    labels:
      app: gitlab-runner
      app.kubernetes.io/managed-by: Helm
      chart: gitlab-runner-0.41.0
      heritage: Helm
      release: gitlab-runner
    name: gitlab-runner
    namespace: gitlab
    resourceVersion: "283754"
    uid: 8040b295-c9fc-47cb-8c5c-74cbf6c4d8a7
  rules:
  - apiGroups:
    - ""
    resources:
    - pods
    verbs:
    - list
    - get
    - watch
    - create
    - delete
  - apiGroups:
    - ""
    resources:
    - pods/exec
    verbs:
    - create
  - apiGroups:
    - ""
    resources:
    - pods/log
    verbs:
    - get
  - apiGroups:
    - ""
    resources:
    - pods/attach
    verbs:
    - list
    - get
    - create
    - delete
    - update
  - apiGroups:
    - ""
    resources:
    - secrets
    verbs:
    - list
    - get
    - create
    - delete
    - update
  - apiGroups:
    - ""
    resources:
    - configmaps
    verbs:
    - list
    - get
    - create
    - delete
    - update
  - apiGroups:
    - ""
    resources:
    - services
    verbs:
    - get
    - list
    - watch
    - create
    - update
    - patch
    - delete
  - apiGroups:
    - apps
    resources:
    - deployments
    verbs:
    - get
    - list
    - watch
    - create
    - update
    - patch
    - delete
kind: List
metadata:
  resourceVersion: ""

服务帐户和RoleBinding

k get sa -n gitlab
NAME            SECRETS   AGE
default         1         3d2h
gitlab-runner   1         2d2h

k get RoleBinding -n gitlab
NAME            ROLE                 AGE
gitlab-runner   Role/gitlab-runner   9h

然而，同样的错误仍然存在。
=更新2022.06.06 =
我应用以下方法暂时解决了这个问题

kubectl create rolebinding --namespace=gitlab gitlab-runner-4 --role=gitlab-runner --serviceaccount=gitlab:default