Can't create ClusterRoleBindings or ClusterRoles for gitlab-admin-service-account

hi, i am trying to create the clusterRoleBindings and clusterRoles from this file to use the cluster with gitlab. this has previously worked with a native kubernetes cluster without microk8s.

gitlab-admin-service-account.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: gitlab-admin
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: gitlab-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: gitlab-admin
    namespace: kube-system

after applying the yaml file with

microk8s kubectl apply -f gitlab-admin-service-account.yaml

it logs following (as expected):

serviceaccount/gitlab-admin created
clusterrolebinding.rbac.authorization.k8s.io/gitlab-admin created

but the roles weren’t created when i try to find them in the dashboard nevertheless it can find the secret:

#!/bin/bash

microk8s kubectl delete -f gitlab-admin-service-account.yaml

microk8s kubectl cluster-info | grep 'Kubernetes master' | awk '/http/ {print $NF}'
token=$(microk8s kubectl get secrets | grep -o 'default-token-.....');
microk8s kubectl get secret $token -o jsonpath="{['data']['ca\.crt']}" | base64 --decode
microk8s kubectl apply -f gitlab-admin-service-account.yaml
microk8s kubectl -n kube-system describe secret $(microk8s kubectl -n kube-system get secret | grep gitlab-admin | awk '{print $1}')

but it won’t work with gitlab and i expect this to be related to it not even showing up in the interface ^^

i love this project, thank you and all the best paul

[balchua]

Hi Thanks for using MicroK8s. Quick question, did u enable rbac? microk8s enable rbac MicroK8s doesn’t enable rbac by default.

[balchua]

The manifest you have provided gave the ServiceAccount gitlab-admin a cluster-admin role. That’s what ClusterRoleBinding do. Simply mapping a ServiceAccount to a ClusterRole. It does not create a ClusterRole.