RBAC | service account gl-gw-brigade-gitlab-gateway can't list pods

[vranystepan]

Hi, I believe that Role in charts/brigade-gitlab-gateway/templates/gateway-gitlab-role.yaml should contain one extra rule for pods:

rules:
- apiGroups: [""]
  resources: ["secrets"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: [""]
  resources: ["pods"]
verbs: ["list", "watch"]

otherwise I'm constantly getting following error:

E1111 08:33:21.181850       5 reflector.go:205] github.com/lukepatrick/brigade-gitlab-gateway/vendor/github.com/Azure/brigade/pkg/storage/kube/apicache/liststore.go:36: Failed to list *v1.Pod: pods is forbidden: User "system:serviceaccount:default:gl-gw-brigade-gitlab-gateway" cannot list pods in the namespace "default"

It seems that official Github GW has the same resources in the role specification https://github.com/Azure/brigade/blob/master/charts/brigade/templates/gateway-github-role.yaml#L28

My env:

• GKE
• Kubernetes 1.9.7-gke.7