Kubernetes cannot create resource "namespaces" in API group "" at the cluster scope even after creating rolebindings

Question

Im running a pipeline that creates a kubernetes namespace but when I run it I get:

Error from server (Forbidden): namespaces is forbidden: User "system:serviceaccount:gitlab-runner:default" cannot create resource "namespaces" in API group "" at the cluster scope

I created a ClusterRole and a ClusterRoleBinding to allow the service user default in the gitlab-runner namespace to create namespaces with:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: modify-namespace
rules:
  - apiGroups: [""]
    resources:
      - namespace
    verbs:
      - create

and:

ind: ClusterRoleBinding
metadata:
  name: modify-namespace-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: modify-namespace
subjects:
- kind: ServiceAccount
  name: default
  namespace: gitlab-runner

But that gives me the same error. What am I doing wrong?

Answer 1

• [""] in clusterrole manifest it should be just "". because [""] will be array where apiGroups expects a string.
• under resources it should be namespaces not namespace because :

kubectl api-resources | grep 'namespace\|NAME'
NAME                              SHORTNAMES   APIVERSION                             NAMESPACED   KIND
namespaces                        ns           v1                                     false        Namespace

• so clusterrole manifest should be as following :

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: modify-namespace
rules:
  - apiGroups: ""
    resources:
      - namespaces
    verbs:
      - create