// Module included in the following assemblies:
//
// * extensions/ce/managing-ce.adoc

:_mod-docs-content-type: PROCEDURE

[id="olmv1-creating-a-cluster-rol-binding_{context}"]
= Creating a cluster role binding for an extension

After you have created a service account and cluster role, you must bind the cluster role to the service account with a cluster role binding manifest.

.Prerequisites

* Access to an {product-title} cluster using an account with `cluster-admin` permissions.
* You have created and applied the following resources for the extension you want to install:
** Namespace
** Service account
** Cluster role

.Procedure

. Create a cluster role binding to bind the cluster role to the service account, similar to the following example:
+
[source,yaml]
----
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: <extension>-installer-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: <extension>-installer-clusterrole
subjects:
- kind: ServiceAccount
  name: <extension>-installer
  namespace: <namespace>
----
+
.Example `pipelines-cluster-role-binding.yaml` file
[%collapsible]
====
[source,yaml]
----
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: pipelines-installer-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: pipelines-installer-clusterrole
subjects:
- kind: ServiceAccount
  name: pipelines-installer
  namespace: pipelines
----
====

. Apply the cluster role binding by running the following command:
+
[source,terminal]
----
$ oc apply -f pipelines-cluster-role-binding.yaml
----
