<p>Im running a pipeline that creates a kubernetes namespace but when I run it I get:</p>
<pre><code>Error from server (Forbidden): namespaces is forbidden: User &quot;system:serviceaccount:gitlab-runner:default&quot; cannot create resource &quot;namespaces&quot; in API group &quot;&quot; at the cluster scope
</code></pre>
<p>I created a <code>ClusterRole</code> and a <code>ClusterRoleBinding</code> to allow the service user <code>default</code> in the <code>gitlab-runner</code> namespace to create namespaces with:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: modify-namespace
rules:
  - apiGroups: [&quot;&quot;]
    resources:
      - namespace
    verbs:
      - create
</code></pre>
<p>and:</p>
<pre><code>ind: ClusterRoleBinding
metadata:
  name: modify-namespace-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: modify-namespace
subjects:
- kind: ServiceAccount
  name: default
  namespace: gitlab-runner
</code></pre>
<p>But that gives me the same error.
What am I doing wrong?</p>

<ul>
<li>[&quot;&quot;] in clusterrole manifest it should be just <code>&quot;&quot;</code>.
because [&quot;&quot;] will be array where apiGroups expects a string.</li>
<li>under <code>resources</code> it should be <code>namespaces</code> not <code>namespace</code> because :</li>
</ul>
<pre><code>kubectl api-resources | grep 'namespace\|NAME'
NAME                              SHORTNAMES   APIVERSION                             NAMESPACED   KIND
namespaces                        ns           v1                                     false        Namespace
</code></pre>
<ul>
<li>so clusterrole manifest should be as following :</li>
</ul>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: modify-namespace
rules:
  - apiGroups: &quot;&quot;
    resources:
      - namespaces
    verbs:
      - create
</code></pre>
