Answers: <p>It is possible to get rid of this problem by uncheck the gitlab-managed cluster checkbox.  </p>
  
Answers: CC BY-SA 4.0
Answers: 2020-02-18T08:53:49.497Z
Answers: 2020-02-18T08:53:49.497Z
Answers: Majid Rajabi
Answers: <p>Going from this, your ClusterRole isn't configured to allow access to deployments, and the ClusterRole you've listed isn't properly bound to your service account. You could configure it with something like I did below as a troubleshooting measure/to make sure you're able to properly configure permissions and rule out an issue with the serviceaccount's role bindings. </p>
  
  <pre><code>apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-admin
    namespace: kube-system
  ---
  apiVersion: rbac.authorization.k8s.io/v1beta1
  kind: ClusterRoleBinding
  metadata:
    name: gitlab-admin-binding
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: deployment-reader
  subjects:
  - kind: ServiceAccount
    name: gitlab-admin
    namespace: kube-system
  </code></pre>
  
  <p>A new ClusterRole</p>
  
  <pre><code>kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: deployment-reader
  rules:
  - apiGroups: ["extensions", "apps"]
    resources: ["deployments"]
    verbs: ["get", "watch", "list"]
  </code></pre>
  
  <p>Then to check to make sure the service account can properly access the resource in the default namespace you can check with the following command</p>
  
  <pre><code>kubectl get deployments --as system:serviceaccount:kube-system:gitlab-admin -n default
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2020-02-12T07:19:20.197Z
Answers: Thank you. This help me to go out of the issue.
Answers: Majid Rajabi
Answers: CC BY-SA 4.0
Answers: 2020-02-10T14:47:26.930Z
Answers: 2020-02-10T14:47:26.930Z
Answers: Kanga_Roo
Body: <p>I integrate the existing kubernetes cluster to the gitlab instance (omnibus). I get the below error in the deployment stage of CI/CD pipeline:</p>
  
  <pre><code>Error from server (Forbidden): error when retrieving current configuration of:
   Resource: "apps/v1, Resource=deployments", GroupVersionKind: "apps/v1, Kind=Deployment"
   Name: "test-deployment", Namespace: "default"
   Object: &amp;{map["apiVersion":"apps/v1" "kind":"Deployment" "metadata":map["annotations":map["kubectl.kubernetes.io/last-applied-configuration":""] "name":"test-deployment" "namespace":"default"] "spec":map["replicas":'\x01' "selector":map["matchLabels":map["app":"test"]] "template":map["metadata":map["labels":map["app":"test"]] "spec":map["containers":[map["env":[map["name":"OHH_COMMON_REDEPLOY" "value":"Sun Feb  9 13:55:45 +0330 2020"]] "image":"192.168.10.6:5000/majid/hello-world:v0.01" "name":"test" "ports":[map["containerPort":'P']]]]]]]]}
   from server for: "deployment.yaml": deployments.apps "test-deployment" is forbidden: User "system:serviceaccount:kubetest-2-bina:kubetest-2-bina-service-account" cannot get resource "deployments" in API group "apps" in the namespace "default"
   ERROR: Job failed: exit status 1
  </code></pre>
  
  <p>There is my .gitlab-ci.yaml file:</p>
  
  <pre><code>deploy:
    image:
      name: lachlanevenson/k8s-kubectl:latest 
      entrypoint: ["/bin/sh", "-c"]
    stage: deploy
    environment:
      name: bina
      url: https://192.168.x.x
    only:
      - master
    script:
      - kubectl version
      - sed -ie "s/THIS_WILL_BE_REPLACED/$(date)/g" deployment.yaml
      - kubectl apply -f deployment.yaml --namespace=default
  </code></pre>
  
  <p>The deployment file look like this:</p>
  
  <pre><code>apiVersion: apps/v1 
  kind: Deployment
  metadata:
    name: test-deployment
  spec:
    selector:
      matchLabels:
        app: test
    replicas: 1
    template:
      metadata:
        labels:
          app: test
      spec:
        imagePullSecrets:
        - name: regcred
        containers:
        - name: test
          image: 192.168.10.6:5000/majid/hello-world:v0.01
          ports:
          - containerPort: 80
          env:
          - name: OHH_COMMON_REDEPLOY
            value: THIS_WILL_BE_REPLACED
  </code></pre>
  
  <p>I also create ServiceAccount and ClusterRoleBinding:</p>
  
  <pre><code>apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-admin
    namespace: kube-system
  ---
  apiVersion: rbac.authorization.k8s.io/v1beta1
  kind: ClusterRoleBinding
  metadata:
    name: gitlab-admin
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: cluster-admin
  subjects:
  - kind: ServiceAccount
    name: gitlab-admin
    namespace: kube-system
  </code></pre>
  
  <p>clusterRole definition:</p>
  
  <pre><code>kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: secret-reader
  rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "watch", "list"]
  </code></pre>
  
  <p>How can I resolve this issue?</p>
  
Comments: CC BY-SA 4.0
Comments: 2020-02-09T23:51:16.933Z
Comments: Can we see the ClusterRole definition?
Comments: Kanga_Roo
Comments: CC BY-SA 4.0
Comments: 2020-02-10T09:25:23.437Z
Comments: @Kanga_Roo I updated the question.
Comments: Majid Rajabi
Tags: <kubernetes><gitlab><cicd><gitlab-ci-runner><kubeadm>
Title: Error from server (Forbidden): error when retrieving current configuration of: Resource: "apps/v1, Resource=deployments",
UserDisplayName: Majid Rajabi
ThreadText: # Error from server (Forbidden): error when retrieving current configuration of: Resource: "apps/v1, Resource=deployments",
  
  (Asked by: username_0 on 2020-02-09)
  
  I integrate the existing kubernetes cluster to the gitlab instance (omnibus). I get the below error in the deployment stage of CI/CD pipeline:
  
  ```
  Error from server (Forbidden): error when retrieving current configuration of:
   Resource: "apps/v1, Resource=deployments", GroupVersionKind: "apps/v1, Kind=Deployment"
   Name: "test-deployment", Namespace: "default"
   Object: &{map["apiVersion":"apps/v1" "kind":"Deployment" "metadata":map["annotations":map["kubectl.kubernetes.io/last-applied-configuration":""] "name":"test-deployment" "namespace":"default"] "spec":map["replicas":'\x01' "selector":map["matchLabels":map["app":"test"]] "template":map["metadata":map["labels":map["app":"test"]] "spec":map["containers":[map["env":[map["name":"OHH_COMMON_REDEPLOY" "value":"Sun Feb  9 13:55:45 +0330 2020"]] "image":"192.168.10.6:5000/username_0/hello-world:v0.01" "name":"test" "ports":[map["containerPort":'P']]]]]]]]}
   from server for: "deployment.yaml": deployments.apps "test-deployment" is forbidden: User "system:serviceaccount:kubetest-2-bina:kubetest-2-bina-service-account" cannot get resource "deployments" in API group "apps" in the namespace "default"
   ERROR: Job failed: exit status 1
  
  ```
  
  There is my .gitlab-ci.yaml file:
  
  ```
  deploy:
    image:
      name: lachlanevenson/k8s-kubectl:latest 
      entrypoint: ["/bin/sh", "-c"]
    stage: deploy
    environment:
      name: bina
      url: https://192.168.x.x
    only:
      - master
    script:
      - kubectl version
      - sed -ie "s/THIS_WILL_BE_REPLACED/$(date)/g" deployment.yaml
      - kubectl apply -f deployment.yaml --namespace=default
  
  ```
  
  The deployment file look like this:
  
  ```
  apiVersion: apps/v1 
  kind: Deployment
  metadata:
    name: test-deployment
  spec:
    selector:
      matchLabels:
        app: test
    replicas: 1
    template:
      metadata:
        labels:
          app: test
      spec:
        imagePullSecrets:
        - name: regcred
        containers:
        - name: test
          image: 192.168.10.6:5000/username_0/hello-world:v0.01
          ports:
          - containerPort: 80
          env:
          - name: OHH_COMMON_REDEPLOY
            value: THIS_WILL_BE_REPLACED
  
  ```
  
  I also create ServiceAccount and ClusterRoleBinding:
  
  ```
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-admin
    namespace: kube-system
  ---
  apiVersion: rbac.authorization.k8s.io/v1beta1
  kind: ClusterRoleBinding
  metadata:
    name: gitlab-admin
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: cluster-admin
  subjects:
  - kind: ServiceAccount
    name: gitlab-admin
    namespace: kube-system
  
  ```
  
  clusterRole definition:
  
  ```
  kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: secret-reader
  rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "watch", "list"]
  
  ```
  
  How can I resolve this issue?
  
  **Tags:** kubernetes, gitlab, cicd, gitlab-ci-runner, kubeadm
  
  > **Comments:**
  > **username_1**: Can we see the ClusterRole definition?  
  > **username_0**: @username_1 I updated the question.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2020-02-10. Score: 3 | Accepted answer
  
  Going from this, your ClusterRole isn't configured to allow access to deployments, and the ClusterRole you've listed isn't properly bound to your service account. You could configure it with something like I did below as a troubleshooting measure/to make sure you're able to properly configure permissions and rule out an issue with the serviceaccount's role bindings.
  
  ```
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-admin
    namespace: kube-system
  ---
  apiVersion: rbac.authorization.k8s.io/v1beta1
  kind: ClusterRoleBinding
  metadata:
    name: gitlab-admin-binding
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: deployment-reader
  subjects:
  - kind: ServiceAccount
    name: gitlab-admin
    namespace: kube-system
  
  ```
  
  A new ClusterRole
  
  ```
  kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: deployment-reader
  rules:
  - apiGroups: ["extensions", "apps"]
    resources: ["deployments"]
    verbs: ["get", "watch", "list"]
  
  ```
  
  Then to check to make sure the service account can properly access the resource in the default namespace you can check with the following command
  
  ```
  kubectl get deployments --as system:serviceaccount:kube-system:gitlab-admin -n default
  
  ```
  
  > **Comments:**
  > **username_0**: Thank you. This help me to go out of the issue.  
  
  ---
  
  ### Answer by username_0 on 2020-02-18. Score: 0
  
  It is possible to get rid of this problem by uncheck the gitlab-managed cluster checkbox.
  
  
  ---
  
  