<p>I'd like to create a Service Account which is allowed to do <code>oc port-forward</code> on OpenShift.com Online (AKA <code>kubectl port-forward</code> on Kubernetes), but can't for the life of me figure out which of the many roles I see in <code>oc get clusterrole</code> would permit that? (<code>oc get role</code> is empty.)</p>

<pre><code>error: error upgrading connection: pods "minecraft-storeys-maker-40-ps85h" is forbidden: User "system:serviceaccount:learn-study:oc-port-forward-container" cannot create pods/portforward in the namespace "learn-study": User "system:serviceaccount:learn-study:oc-port-forward-container" cannot create pods/portforward in project "learn-study"
</code></pre>

<p>So based on this error message I've tried "pods/portforward", but no good:</p>

<pre><code>oc policy add-role-to-user pods/portforward -z oc-port-forward-container
Error from server (BadRequest): Name parameter invalid: "pods/portforward": may not contain '/'
</code></pre>

<p>Also just "portforward" is no good:</p>

<pre><code>oc policy add-role-to-user portforward -z oc-port-forward-container 
Error from server (NotFound): rolebindings.authorization.openshift.io "portforward" not found
</code></pre>

<p>It's for <a href="https://github.com/OASIS-learn-study/oc-port-forward-container" rel="nofollow noreferrer">https://github.com/OASIS-learn-study/oc-port-forward-container</a>.</p>

vorburger
<p>In OpenShift the <code>edit</code> and <code>admin</code> cluster roles should have <code>create</code> permissions on <code>pods/portforward</code>.</p>
<p>Therefore, a command such as <code>oc policy add-role-to-user edit -z &lt;your-sa-name&gt;</code> should add the permissions you need.</p>
