Not able to execute GitLab Runner in Kubernetes cluster: cannot create resource "secrets" in API group "" in the namespace "gitlab"

ONLINECAST

2 min read

·

05-10-2024

7

0

Share

Can't Run GitLab Runner in Kubernetes: "cannot create resource 'secrets' in API group '' in the namespace 'gitlab'" Error

This error message usually indicates a problem with permissions within your Kubernetes cluster. You're likely trying to run a GitLab Runner within a namespace called "gitlab," but the Runner lacks the necessary permissions to create secrets. Let's dive into understanding the problem and how to fix it.

The Scenario:

You've installed a GitLab Runner on your Kubernetes cluster, aiming to use it for CI/CD tasks. The Runner uses a service account to access the cluster, but when attempting to register the Runner, you encounter the error: "cannot create resource 'secrets' in API group '' in the namespace 'gitlab'".

Understanding the Error

The error message itself gives us valuable clues:

• "cannot create resource 'secrets'": This tells us that the Runner is attempting to create a secret within the cluster. Secrets are used to store sensitive information like passwords, tokens, and other credentials.
• "in API group ''": This suggests the Runner is using an older Kubernetes API version where secrets were not part of a specific API group.
• "in the namespace 'gitlab'": This points to the namespace where the Runner is running. It's likely that the service account used by the Runner does not have the appropriate permissions to create secrets within the "gitlab" namespace.

Troubleshooting Steps

1. Verify Namespace Permissions:

   • Use kubectl get sa -n gitlab to see the service account used by the Runner.
   • Verify that the service account has the "create" permission for secrets in the "gitlab" namespace. You can check using kubectl auth can-i create secrets --as=gitlab:default

2. Create a Role and RoleBinding:

   • If the service account doesn't have the necessary permissions, you'll need to create a Role and RoleBinding.
   • Create a Role called gitlab-runner-role with the following rules:

     apiVersion: rbac.authorization.k8s.io/v1
     kind: Role
     metadata:
       name: gitlab-runner-role
       namespace: gitlab
     rules:
     - apiGroups: ["v1"]
       resources: ["secrets"]
       verbs: ["create", "get", "update", "delete"]
     

   • Create a RoleBinding called gitlab-runner-binding that associates the gitlab-runner-role with the service account:

     apiVersion: rbac.authorization.k8s.io/v1
     kind: RoleBinding
     metadata:
       name: gitlab-runner-binding
       namespace: gitlab
     subjects:
     - kind: ServiceAccount
       name: default
       apiGroup: rbac.authorization.k8s.io
     roleRef:
       kind: Role
       name: gitlab-runner-role
       apiGroup: rbac.authorization.k8s.io
     

3. Restart the Runner:

   • After creating the Role and RoleBinding, restart the GitLab Runner Pod.

4. Alternative: Use a "Runner" Namespace:

   • If you don't want to grant the service account permission to create secrets in the "gitlab" namespace, consider creating a dedicated "runner" namespace and running the GitLab Runner there. You can then grant the Runner service account permissions to create secrets within the "runner" namespace.

Conclusion

The "cannot create resource 'secrets'" error in GitLab Runner on Kubernetes is often caused by a lack of permissions. By ensuring your service account has the correct permissions, you can easily resolve this issue and start using the Runner for your CI/CD needs.

Remember to always prioritize security, so granting permissions should be done with careful consideration and appropriate security measures. It's also a good practice to review and update permissions periodically to maintain optimal security.