Skip to content

RoleBinding: Gitlab-runner-operator creates `gitlab-runner-app-rolebinding` with hard-coded namespace value

Prerequisites:

  1. Deployed gitlab-runner-operator to custom namespace in OKD 4.7.*.
  2. Set up Gitlan CI Runner.
  3. Started test job to check runner availability and performance.

Issue:

ERROR: Job failed (system failure): prepare environment: secrets is forbidden: User "system:serviceaccount:mynamespace:gitlab-runner-sa" cannot create resource "secrets" in API group "" in the namespace "mynamespace". Check https://docs.gitlab.com/runner/shells/index.html#shell-profile-loading for more information

After some investigation it was found out that gitlab-runner-app-rolebinding RoleBinding object has a hard-coded value in namespace field which is gitlab-runner-system.

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: gitlab-runner-app-rolebinding
  namespace: mynamespace
subjects:
  - kind: ServiceAccount
    name: gitlab-runner-sa
    namespace: gitlab-runner-system # here should be namespace where gitlab-runner-operator is deployed
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: gitlab-runner-app-role

@ggeorgiev_gitlab FYI

Edited by Anna Muravska