<p>It is possible to get rid of this problem by uncheck the gitlab-managed cluster checkbox.  </p>

CC BY-SA 4.0
2020-02-18T08:53:49.497Z
2020-02-18T08:53:49.497Z
Majid Rajabi
<p>Going from this, your ClusterRole isn't configured to allow access to deployments, and the ClusterRole you've listed isn't properly bound to your service account. You could configure it with something like I did below as a troubleshooting measure/to make sure you're able to properly configure permissions and rule out an issue with the serviceaccount's role bindings. </p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitlab-admin
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: gitlab-admin-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: deployment-reader
subjects:
- kind: ServiceAccount
  name: gitlab-admin
  namespace: kube-system
</code></pre>

<p>A new ClusterRole</p>

<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: deployment-reader
rules:
- apiGroups: ["extensions", "apps"]
  resources: ["deployments"]
  verbs: ["get", "watch", "list"]
</code></pre>

<p>Then to check to make sure the service account can properly access the resource in the default namespace you can check with the following command</p>

<pre><code>kubectl get deployments --as system:serviceaccount:kube-system:gitlab-admin -n default
</code></pre>

CC BY-SA 4.0
2020-02-12T07:19:20.197Z
Thank you. This help me to go out of the issue.
Majid Rajabi
CC BY-SA 4.0
2020-02-10T14:47:26.930Z
2020-02-10T14:47:26.930Z
Kanga_Roo
<p>I integrate the existing kubernetes cluster to the gitlab instance (omnibus). I get the below error in the deployment stage of CI/CD pipeline:</p>

<pre><code>Error from server (Forbidden): error when retrieving current configuration of:
 Resource: "apps/v1, Resource=deployments", GroupVersionKind: "apps/v1, Kind=Deployment"
 Name: "test-deployment", Namespace: "default"
 Object: &amp;{map["apiVersion":"apps/v1" "kind":"Deployment" "metadata":map["annotations":map["kubectl.kubernetes.io/last-applied-configuration":""] "name":"test-deployment" "namespace":"default"] "spec":map["replicas":'\x01' "selector":map["matchLabels":map["app":"test"]] "template":map["metadata":map["labels":map["app":"test"]] "spec":map["containers":[map["env":[map["name":"OHH_COMMON_REDEPLOY" "value":"Sun Feb  9 13:55:45 +0330 2020"]] "image":"192.168.10.6:5000/majid/hello-world:v0.01" "name":"test" "ports":[map["containerPort":'P']]]]]]]]}
 from server for: "deployment.yaml": deployments.apps "test-deployment" is forbidden: User "system:serviceaccount:kubetest-2-bina:kubetest-2-bina-service-account" cannot get resource "deployments" in API group "apps" in the namespace "default"
 ERROR: Job failed: exit status 1
</code></pre>

<p>There is my .gitlab-ci.yaml file:</p>

<pre><code>deploy:
  image:
    name: lachlanevenson/k8s-kubectl:latest 
    entrypoint: ["/bin/sh", "-c"]
  stage: deploy
  environment:
    name: bina
    url: https://192.168.x.x
  only:
    - master
  script:
    - kubectl version
    - sed -ie "s/THIS_WILL_BE_REPLACED/$(date)/g" deployment.yaml
    - kubectl apply -f deployment.yaml --namespace=default
</code></pre>

<p>The deployment file look like this:</p>

<pre><code>apiVersion: apps/v1 
kind: Deployment
metadata:
  name: test-deployment
spec:
  selector:
    matchLabels:
      app: test
  replicas: 1
  template:
    metadata:
      labels:
        app: test
    spec:
      imagePullSecrets:
      - name: regcred
      containers:
      - name: test
        image: 192.168.10.6:5000/majid/hello-world:v0.01
        ports:
        - containerPort: 80
        env:
        - name: OHH_COMMON_REDEPLOY
          value: THIS_WILL_BE_REPLACED
</code></pre>

<p>I also create ServiceAccount and ClusterRoleBinding:</p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitlab-admin
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: gitlab-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: gitlab-admin
  namespace: kube-system
</code></pre>

<p>clusterRole definition:</p>

<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]
</code></pre>

<p>How can I resolve this issue?</p>

CC BY-SA 4.0
2020-02-09T23:51:16.933Z
Can we see the ClusterRole definition?
Kanga_Roo
CC BY-SA 4.0
2020-02-10T09:25:23.437Z
@Kanga_Roo I updated the question.
Majid Rajabi
<kubernetes><gitlab><cicd><gitlab-ci-runner><kubeadm>
Error from server (Forbidden): error when retrieving current configuration of: Resource: "apps/v1, Resource=deployments",
Majid Rajabi
# Error from server (Forbidden): error when retrieving current configuration of: Resource: "apps/v1, Resource=deployments",

(Asked by: username_0 on 2020-02-09)

I integrate the existing kubernetes cluster to the gitlab instance (omnibus). I get the below error in the deployment stage of CI/CD pipeline:
Error from server (Forbidden): error when retrieving current configuration of:
 Resource: "apps/v1, Resource=deployments", GroupVersionKind: "apps/v1, Kind=Deployment"
 Name: "test-deployment", Namespace: "default"
 Object: &{map["apiVersion":"apps/v1" "kind":"Deployment" "metadata":map["annotations":map["kubectl.kubernetes.io/last-applied-configuration":""] "name":"test-deployment" "namespace":"default"] "spec":map["replicas":'\x01' "selector":map["matchLabels":map["app":"test"]] "template":map["metadata":map["labels":map["app":"test"]] "spec":map["containers":[map["env":[map["name":"OHH_COMMON_REDEPLOY" "value":"Sun Feb  9 13:55:45 +0330 2020"]] "image":"192.168.10.6:5000/majid/hello-world:v0.01" "name":"test" "ports":[map["containerPort":'P']]]]]]]]}
 from server for: "deployment.yaml": deployments.apps "test-deployment" is forbidden: User "system:serviceaccount:kubetest-2-bina:kubetest-2-bina-service-account" cannot get resource "deployments" in API group "apps" in the namespace "default"
 ERROR: Job failed: exit status 1

There is my .gitlab-ci.yaml file:
deploy:
  image:
    name: lachlanevenson/k8s-kubectl:latest 
    entrypoint: ["/bin/sh", "-c"]
  stage: deploy
  environment:
    name: bina
    url: https://192.168.x.x
  only:
    - master
  script:
    - kubectl version
    - sed -ie "s/THIS_WILL_BE_REPLACED/$(date)/g" deployment.yaml
    - kubectl apply -f deployment.yaml --namespace=default

The deployment file look like this:
apiVersion: apps/v1 
kind: Deployment
metadata:
  name: test-deployment
spec:
  selector:
    matchLabels:
      app: test
  replicas: 1
  template:
    metadata:
      labels:
        app: test
    spec:
      imagePullSecrets:
      - name: regcred
      containers:
      - name: test
        image: 192.168.10.6:5000/majid/hello-world:v0.01
        ports:
        - containerPort: 80
        env:
        - name: OHH_COMMON_REDEPLOY
          value: THIS_WILL_BE_REPLACED

I also create ServiceAccount and ClusterRoleBinding:
apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitlab-admin
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: gitlab-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: gitlab-admin
  namespace: kube-system

clusterRole definition:
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]

How can I resolve this issue?

**Tags:** kubernetes, gitlab, cicd, gitlab-ci-runner, kubeadm

> **Comments:**
> **username_1**: Can we see the ClusterRole definition?  
> **username_0**: @username_1 I updated the question.  

---

## 2 answers

### Answer by username_1 on 2020-02-10. Score: 3 | Accepted answer

Going from this, your ClusterRole isn't configured to allow access to deployments, and the ClusterRole you've listed isn't properly bound to your service account. You could configure it with something like I did below as a troubleshooting measure/to make sure you're able to properly configure permissions and rule out an issue with the serviceaccount's role bindings. 
apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitlab-admin
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: gitlab-admin-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: deployment-reader
subjects:
- kind: ServiceAccount
  name: gitlab-admin
  namespace: kube-system

A new ClusterRole
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: deployment-reader
rules:
- apiGroups: ["extensions", "apps"]
  resources: ["deployments"]
  verbs: ["get", "watch", "list"]

Then to check to make sure the service account can properly access the resource in the default namespace you can check with the following command
kubectl get deployments --as system:serviceaccount:kube-system:gitlab-admin -n default

> **Comments:**
> **username_0**: Thank you. This help me to go out of the issue.  

---

### Answer by username_0 on 2020-02-18. Score: 0

It is possible to get rid of this problem by uncheck the gitlab-managed cluster checkbox.


---

