Unsupported value: "rbac.authorization.k8s.io"

Question

When I try to

kubectl create -f cloudflare-argo-rolebinding.yml

this RoleBinding

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cloudflare-argo-rolebinding
  namespace: default
subjects:
- kind: ServiceAccount
  name: cloudflare-argo
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: cloudflare-argo-role
  apiGroup: rbac.authorization.k8s.io

I get this error :

The RoleBinding "cloudflare-argo-rolebinding" is invalid: subjects[0].apiGroup: Unsupported value: "rbac.authorization.k8s.io": supported values: ""

Any idea ? I'm on DigitalOcean using their new Kubernetes service if it helps.

Answer 1

I think problem is using wrong apiGroup.

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cloudflare-argo-rolebinding
  namespace: default
subjects:
- kind: ServiceAccount
  name: cloudflare-argo
  # apiGroup is ""(core/v1) for service_account
  apiGroup: ""
roleRef:
  kind: Role
  name: cloudflare-argo-role
  apiGroup: rbac.authorization.k8s.io

Answer 2

ServiceAccount subjects are in the v1 API, which is apiGroup ""