title: Cannot use helm upgrade in a gitlab-runner due forbidden secret access rules
body: <p>I want to use execute helm on a gitlab-runner on my kubernetes in gitlab pipelines.</p>
  
  <p>My gitlab.ci.yaml:</p>
  
  <pre><code># Deployment step
  deploy:
    stage: deploy
    image: alpine/helm:latest
    script:
      - helm --namespace gitlab upgrade initial ./iot/
    tags:
      - k8s
      - dev
  </code></pre>
  
  <p>What i have done so far:</p>
  
  <ol>
  <li>Installed the gitlab-runner on my kubernetes with helm (<a href="https://docs.gitlab.com/runner/install/kubernetes.html" rel="nofollow noreferrer">https://docs.gitlab.com/runner/install/kubernetes.html</a>)</li>
  </ol>
  
  <p>My values.yaml:</p>
  
  <pre><code>image: gitlab/gitlab-runner:alpine-v11.6.0
  
  imagePullPolicy: IfNotPresent
  
  gitlabUrl: https://gitlab.com/
  
  runnerRegistrationToken: "mytoken"
  
  unregisterRunners: true
  
  terminationGracePeriodSeconds: 3600
  
  concurrent: 10
  
  checkInterval: 30
  
  ## For RBAC support:
  rbac:
    create: true
    ## Define specific rbac permissions.
    # resources: ["pods", "pods/exec", "secrets"] 
    # verbs: ["get", "list", "watch", "create", "patch", "delete"]
    ## Run the gitlab-bastion container with the ability to deploy/manage containers of jobs cluster-wide or only within namespace
    clusterWideAccess: false
  
  metrics:
    enabled: true
  ## Configuration for the Pods that that the runner launches for each new job
  ##
  runners:
    ## Default container image to use for builds when none is specified
    ##
    image: ubuntu:16.04
  
    locked: false
    tags: "k8s,dev"
    privileged: true
  
    namespace: gitlab
    pollTimeout: 180
    outputLimit: 4096
  
    cache: {}
    ## Build Container specific configuration
    ##
    builds: {}
      # cpuLimit: 200m memoryLimit: 256Mi cpuRequests: 100m memoryRequests: 128Mi
    ## Service Container specific configuration
    ##
    services: {}
      # cpuLimit: 200m memoryLimit: 256Mi cpuRequests: 100m memoryRequests: 128Mi
    ## Helper Container specific configuration
    ##
    helpers: {}
  securityContext:
    fsGroup: 65533
    runAsUser: 100
  ## Configure resource requests and limits ref: http://kubernetes.io/docs/user-guide/compute-resources/
  ##
  resources: {}
  
  affinity: {}
  
  nodeSelector: {}
  
  tolerations: []
  
  envVars:
      name: RUNNER_EXECUTOR
      value: kubernetes
  ## list of hosts and IPs that will be injected into the pod's hosts file
  hostAliases: []
  
  podAnnotations: {}
  
  podLabels: {}
  </code></pre>
  
  <ol start="3">
  <li>gitlab-runner is succesfully connected with gitlab.com</li>
  </ol>
  
  <p>But i get the following message on gitlab when executing the deployment step:</p>
  
  <pre><code> Error: UPGRADE FAILED: query: failed to query with labels: secrets is forbidden: User "system:serviceaccount:gitlab:default" cannot list resource "secrets" in API group "" in the namespace "gitlab"
  </code></pre>
  
  <p>I've checked my RBAC ClusterRules and they are all per default set to a wildcard on verbs and ressources but i have also tried to set the needed rights:</p>
  
  <pre><code>  resources: ["pods", "pods/exec", "secrets"] 
    verbs: ["get", "list", "watch", "create", "patch", "delete"]
  </code></pre>
  
  <p>Nothing worked :-(
  When i have done wrong?</p>