// Module included in the following assembly:
//
// * configuring-an-openshift-cluster-by-deploying-an-application-with-cluster-configurations.adoc

:_mod-docs-content-type: PROCEDURE
[id="gitops-additional-permissions-for-cluster-config_{context}"]
= Adding permissions for cluster configuration

You can grant permissions for an Argo CD instance to manage cluster configuration. Create a cluster role with additional permissions and then create a new cluster role binding to associate the cluster role with a service account.

.Procedure

. Log in to the {product-title} web console as an admin.
. In the web console, select **User Management** -> **Roles** -> **Create Role**. Use the following `ClusterRole` YAML template to add rules to specify the additional permissions.
+
[source,yaml]
----
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secrets-cluster-role
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["*"]
----
. Click **Create** to add the cluster role.
. Now create the cluster role binding. In the web console, select **User Management** -> **Role Bindings** -> **Create Binding**.
. Select **All Projects** from the **Project** drop-down.
. Click **Create binding**.
. Select **Binding type** as **Cluster-wide role binding (ClusterRoleBinding)**.
. Enter a unique value for the **RoleBinding name**.
. Select the newly created cluster role or an existing cluster role from the drop down list.
. Select the **Subject** as **ServiceAccount** and the provide the **Subject namespace** and **name**.
.. **Subject namespace**: `openshift-gitops`
.. **Subject name**: `openshift-gitops-argocd-application-controller`
. Click **Create**. The YAML file for the `ClusterRoleBinding` object is as follows:
+
[source,yaml]
----
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cluster-role-binding
subjects:
  - kind: ServiceAccount
    name: openshift-gitops-argocd-application-controller
    namespace: openshift-gitops
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: admin
----

