diff --git a/scripts/gen-readonly-kubeconfig.sh b/scripts/gen-readonly-kubeconfig.sh
index ce3db90..4c1ca84 100755
--- a/scripts/gen-readonly-kubeconfig.sh
+++ b/scripts/gen-readonly-kubeconfig.sh
@@ -12,7 +12,10 @@ metadata:
   name: crole-customresources-readyonly
   labels:
     rbac.authorization.k8s.io/aggregate-to-view: "true"
-rules: []
+rules:
+- apiGroups: [""]
+  resources: ["pods/portforward"]
+  verbs: ["create"]
 ---
 apiVersion: v1
 kind: ServiceAccount