# Cannot get resource "ingressroutes" in API group "traefik.containo.us" in the namespace "traefik" (Gitlab + K3s)

**URL:** <https://community.traefik.io/t/cannot-get-resource-ingressroutes-in-api-group-traefik-containo-us-in-the-namespace-traefik-gitlab-k3s/9775>\
**Category:** Traefik v2\
**Tags:** kubernetes-ingress\
**Created:** [February 20, 2021, 3:49pm UTC](https://community.traefik.io/t/cannot-get-resource-ingressroutes-in-api-group-traefik-containo-us-in-the-namespace-traefik-gitlab-k3s/9775 "2021-02-20T15:49:47Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![jakubhajek](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/jakubhajek/32/3389_2.png) [@jakubhajek](https://community.traefik.io/u/jakubhajek)\
**Post date:** [February 22, 2021, 9:47am UTC](https://community.traefik.io/t/cannot-get-resource-ingressroutes-in-api-group-traefik-containo-us-in-the-namespace-traefik-gitlab-k3s/9775/2 "2021-02-22T09:47:46Z")

</div>

Hello @jaydrogers 👋

Thanks a lot for sending a detailed description of the issue you experience.

Based on the error message you got I think that it can be related to RBAC configuration in the Kubernetes cluster.

The user (`alpha-test-8-production-service-account`) that is connecting has no privileges to access `Ingressroute` resources. That's why you got 403 Forbidden once you try to apply your configuration via GitLab.

I've just performed a quick test and created a new user that has permission to work with the following resources:

- `deployments`
- `services`
- `IngressRoutes` that are specifically related to Traefik Proxy

I think that should be enough to perform deployment (but it can be modified according to GitLab needs). What you are interested in is `apiGroups` for `traefik.containo.us`

On those resources, I defined privileges that can be executed by the user such as: `create`, `list`, `update, `patch`,

```auto
---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: alpha-sa
  namespace: default

---

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: role-with-privileges-to-deploy
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "create", "list", "update", "patch"]
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["get", "create", "list", "update", "patch"]
  - apiGroups: ["traefik.containo.us"]
    resources: ["ingressroutes"]
    verbs: ["get", "create", "list", "update", "patch"]

---

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: user-with-privileges
  namespace: default
subjects:
  - kind: ServiceAccount
    name: alpha-sa
    namespace: default
roleRef:
  kind: Role
  name: role-with-privileges-to-deploy
  apiGroup: rbac.authorization.k8s.io

---

```

Once you apply that config you can test what the user can do in your cluster.

Can the user `create` IngressRoutes objects?

```auto
➜ kubectl auth can-i create ingressroutes -n default --as system:serviceaccount:default:alpha-sa
yes

```

Can I `update`, `patch`, `list` the already created Ingressroutes resources?

```auto
➜ kubectl auth can-i update ingressroutes -n default --as system:serviceaccount:default:alpha-sa
yes

```

```auto
➜ kubectl auth can-i patch ingressroutes -n default --as system:serviceaccount:default:alpha-sa
yes

```

```auto
➜ kubectl auth can-i list ingressroutes -n default --as system:serviceaccount:default:alpha-sa
yes

```

Can I `delete` the IngressRoutes resource?

```auto
➜ kubectl auth can-i delete ingressroutes -n default --as system:serviceaccount:default:alpha-sa
no

```

Based on that example you can try to update privileges for a user you are connecting from Gitlbab to your K8S cluster should solve your issue.

Hope that helps!

---

_[View the full topic](https://community.traefik.io/t/cannot-get-resource-ingressroutes-in-api-group-traefik-containo-us-in-the-namespace-traefik-gitlab-k3s/9775)._