https://docs.openshift.com/enterprise/latest/install_config/aggregate_logging.html

Then, enable the logging-deployer service account to edit the project contents. By default service accounts are not allowed to do this. The following example uses the logging project. Be sure to use the project created above in the following example:

$ oc policy add-role-to-user edit \
            system:serviceaccount:default:logging-deployer

^^^ this should be:

system:serviceaccount:logging:logging-deployer