Oh; when you launch it it's done with a service account and you have to choose whether it has access to the whole cluster or not. You need "Cluster" for things that deploy cluster-level resources (like this)