# Disabling self-provisioners role

By default, when a user authenticates with Openshift via Oauth, it is part of the `self-provisioners` group. This group provides the ability to create new projects. On CentOS CI we do not want users to be able to create their own projects, as we have a system in place where we create a project and control the administrators of that project.

To disable the self-provisioner role do the following as outlined in the documentation[1].

```

oc describe clusterrolebinding.rbac self-provisioners

Name:		self-provisioners

Labels:		<none>

Annotations:	rbac.authorization.kubernetes.io/autoupdate=true

Role:

  Kind:	ClusterRole

  Name:	self-provisioner

Subjects:

  Kind	Name				Namespace

  ----	----				---------

  Group	system:authenticated:oauth

```

Remove the subjects that the self-provisioners role applies to.

```

oc patch clusterrolebinding.rbac self-provisioners -p '{"subjects": null}'

```

Verify the change occurred successfully

```

oc describe clusterrolebinding.rbac self-provisioners

Name:         self-provisioners

Labels:       <none>

Annotations:  rbac.authorization.kubernetes.io/autoupdate: true

Role:

  Kind:  ClusterRole

  Name:  self-provisioner

Subjects:

  Kind  Name  Namespace

  ----  ----  ---------

```

When the cluster is updated to a new version, unless we mark the role appropriately, the permissions will be restored after the update is complete.

Verify that the value is currently set to be restored after an update:

```

oc get clusterrolebinding.rbac self-provisioners -o yaml

```

```

apiVersion: authorization.openshift.io/v1

kind: ClusterRoleBinding

metadata:

  annotations:

    rbac.authorization.kubernetes.io/autoupdate: "true"

  ...

```

We wish to set this `rbac.authorization.kubernetes.io/autoupdate` to `false`. To patch this do the following.

```

oc patch clusterrolebinding.rbac self-provisioners -p '{ "metadata": { "annotations": { "rbac.authorization.kubernetes.io/autoupdate": "false" } } }'

```

### Resources

- [1] https://docs.openshift.com/container-platform/4.4/applications/projects/configuring-project-creation.html#disabling-project-self-provisioning_configuring-project-creation