openshift: allow serviceaccount to create project

Question

i created a service account for gitlab oc create serviceaccount gitlab-sa

i assigned to this service account an edit role for the project and for the cluster

oc policy add-role-to-user edit -z gitlab-sa and oc policy add-cluster-role-to-user -z gitlab-sa

i can successfully login using oc login openshift-server --token=gitlab-sa-token but when i create a new project oc new-project foo

i get: Error from server (Forbidden): You may not request a new project via this API

How can i allow this serviceaccount to create a new project ?

Answer 1

Try oc policy add-cluster-role-to-user self-provisioner -z gitlab-sa. Service accounts aren't able to create projects by default.

Answer 2

The command

oc adm policy add-cluster-role-to-user self-provisioner -z [service-account-username] -n [namespace]

works for me.