<p>I'm attempting to grant a Kubernetes ServiceAccount the cluster-admin role using a ClusterRoleBinding:</p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins
  namespace: jenkins

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: jenkins
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: jenkins
  namespace: jenkins
</code></pre>

<p>...and I'm getting this error:</p>

<pre><code>The ClusterRoleBinding "jenkins" is invalid: roleRef: Invalid value: rbac.RoleRef{APIGroup:"rbac.authorization.k8s.io", Kind:"ClusterRole", Name:"cluster-admin"}:
 cannot change roleRef
</code></pre>

<p>I've verified that the ClusterRole does exist:</p>

<pre><code>kubectl get clusterrole
NAME                                                                   AGE
admin                                                                  1d
alb-ingress-controller                                                 1d
aws-node                                                               1d
cluster-admin                                                          1d
</code></pre>

<p>I've also attempted to attach other cluster roles to my service account and have been unable to do so.</p>

<p>I assume that this means you cannot attach cluster roles to service accounts and if that is the case then how do you grant cluster level permissions to a service account?</p>

<p>The error "cannot change roleRef" was referring to the fact that the ClusterRoleBinding I was trying to create already existed.</p>

<p>By running <code>kubectl get clusterrolebinding</code> I was able to see that the ClusterRoleBinding already existed.</p>

<p>After running <code>kubectl delete clusterrolebinding/jenkins</code> I was able to execute the YAML above successfully.</p>
