无法在 Kubernetes 集群中执行 GitLab Runner：无法在命名空间“gitlab”中的 API 组“”中创建资源“秘密”

Question

目前我正面临这个问题：

ERROR: Job failed (system failure): 
prepare environment: 
setting up credentials: 
secrets is forbidden: 
User "system:serviceaccount:default:gitlab-runner" cannot create
resource "secrets" in API group "" in the namespace "gitlab"` 
after following the official documentation on how to integrate the GitLab Runner.

我正在使用以下runner-chart-values.yaml：

# The GitLab Server URL (with protocol) that want to register the runner against
# ref: https://docs.gitlab.com/runner/commands/README.html#gitlab-runner-register
#
gitlabUrl: http://example.domain/

# The Registration Token for adding new runners to the GitLab Server. This must
# be retrieved from your GitLab instance.
# ref: https://docs.gitlab.com/ce/ci/runners/README.html
#
runnerRegistrationToken: "<token>"

# For RBAC support:
rbac:
    create: true
    rules:
      - apiGroups: ["*"]

# Run all containers with the privileged flag enabled
# This will allow the docker:dind image to run if you need to run Docker
# commands. Please read the docs before turning this on:
# ref: https://docs.gitlab.com/runner/executors/kubernetes.html#using-dockerdind
runners:
    privileged: true

有什么线索吗？

非常感谢！

Answer 1

扩展 Harsh 的答案：请确保您在活动的“gitlab-runner”命名空间下工作或使用密钥 --namespace=gitlab-runner。要在活动命名空间之间切换，请使用以下命令：

kubens gitlab-runner

所以你不需要每次都使用--namespace=gitlab-runner。

JFYI，我已经从我的 k8s 集群上的文章中完成了这些步骤，它对我来说很好。

Answer 2

看起来命名空间不匹配，但是您可以尝试以下选项

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: gitlab-runner
  namespace: gitlab-runner
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["list", "get", "watch", "create", "delete"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["create"]
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get"]

确保您将 Role 的服务帐户创建到正确的命名空间。

创建角色绑定的命令

kubectl create rolebinding --namespace=gitlab-runner gitlab-runner-binding --role=gitlab-runner --serviceaccount=gitlab-runner:default

这里有很好的文档：https://medium.com/@ruben.laguna/installing-a-gitlab-runner-on-kubernetes-ac386c924bc8