Permissions needed for ARC on Rancher environment

[chenghuang-mdsol]

Hi, I'm using a Rancher cluster to host ARC. I can't have admin permissions since it's a shared cluster.
I wonder what permissions are needed to install ARC by helm.
When I try to install ARC using

helm upgrade --install --namespace gha-runners --set=authSecret.create=true --set=authSecret.github_token="xxxxx" --wait actions-runner-controller actions-runner-controller/actions-runner-controller --set nodeSelector."kubernetes\.io\/os"=linux

I got this permissions error:

Error: UPGRADE FAILED: cannot patch "actions-runner-controller-manager" with kind ClusterRole: clusterroles.rbac.authorization.k8s.io "actions-runner-controller-manager" is forbidden: user "u-xxxxxxx" (groups=["xxxx]) "system:authenticated" "system:cattle:authenticated"]) is attempting to grant RBAC permissions not currently held:
{APIGroups:[""], Resources:["events"], Verbs:["patch"]}
{APIGroups:[""], Resources:["persistentvolumeclaims"], Verbs:["delete" "get" "list" "patch" "update" "watch"]}
{APIGroups:[""], Resources:["pods"], Verbs:["create" "delete" "get" "list" "patch" "update" "watch"]}
{APIGroups:[""], Resources:["pods/finalizers"], Verbs:["create" "delete" "get" "list" "patch" "update" "watch"]}
{APIGroups:[""], Resources:["secrets"], Verbs:["watch"]}
{APIGroups:["actions.summerwind.dev"], Resources:["horizontalrunnerautoscalers"], Verbs:["create" "delete" "get" "list" "patch" "update" "watch"]}
{APIGroups:["actions.summerwind.dev"], Resources:["horizontalrunnerautoscalers/finalizers"], Verbs:["create" "delete" "get" "list" "patch" "update" "watch"]}
{APIGroups:["actions.summerwind.dev"], Resources:["horizontalrunnerautoscalers/status"], Verbs:["get" "patch" "update"]}
{APIGroups:["actions.summerwind.dev"], Resources:["runnerdeployments"], Verbs:["create" "delete" "get" "list" "patch" "update" "watch"]}
{APIGroups:["actions.summerwind.dev"], Resources:["runnerdeployments/finalizers"], Verbs:["create" "delete" "get" "list" "patch" "update" "watch"]}
{APIGroups:["actions.summerwind.dev"], Resources:["runnerdeployments/status"], Verbs:["get" "patch" "update"]}
{APIGroups:["actions.summerwind.dev"], Resources:["runnerreplicasets"], Verbs:["create" "delete" "get" "list" "patch" "update" "watch"]}
{APIGroups:["actions.summerwind.dev"], Resources:["runnerreplicasets/finalizers"], Verbs:["create" "delete" "get" "list" "patch" "update" "watch"]}
{APIGroups:["actions.summerwind.dev"], Resources:["runnerreplicasets/status"], Verbs:["get" "patch" "update"]}
{APIGroups:["actions.summerwind.dev"], Resources:["runners"], Verbs:["create" "delete" "get" "list" "patch" "update" "watch"]}
{APIGroups:["actions.summerwind.dev"], Resources:["runners/finalizers"], Verbs:["create" "delete" "get" "list" "patch" "update" "watch"]}
{APIGroups:["actions.summerwind.dev"], Resources:["runners/status"], Verbs:["get" "patch" "update"]}
{APIGroups:["actions.summerwind.dev"], Resources:["runnersets"], Verbs:["create" "delete" "get" "list" "patch" "update" "watch"]}
{APIGroups:["actions.summerwind.dev"], Resources:["runnersets/finalizers"], Verbs:["create" "delete" "get" "list" "patch" "update" "watch"]}
{APIGroups:["actions.summerwind.dev"], Resources:["runnersets/status"], Verbs:["get" "patch" "update"]}
{APIGroups:["apps"], Resources:["statefulsets"], Verbs:["create" "delete" "get" "list" "patch" "update" "watch"]}
{APIGroups:["apps"], Resources:["statefulsets/finalizers"], Verbs:["create" "delete" "get" "list" "patch" "update" "watch"]}
{APIGroups:["coordination.k8s.io"], Resources:["leases"], Verbs:["create" "get" "list" "update"]}

Here's the permissions I already have