<p>I want to add role from namespace <code>kube-system</code> in my <code>MyRoleBinding.yaml</code> file like that:</p>

<pre><code>kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata: 
  name: myrolebinding
  namespace: default
subjects: 
- kind: ServiceAccount 
  name: myservice
  namespace: default
  apiGroup: ""
roleRef: 
  kind: Role
  name: system:controller:token-cleaner
  namespace: kube-system
  apiGroup: "" 
</code></pre>

<p>But when I run <code>kubectl apply -f MyRoleBinding.yaml</code> I get:  </p>

<blockquote>
  <p>error: error validating "MyRoleBinding.yaml": error validating data:
  ValidationError(RoleBinding.roleRef): <strong>unknown</strong> field "namespace" in
  io.k8s.api.rbac.v1.RoleRef; if you choose to ignore these errors, turn
  validation off with --validate=false</p>
</blockquote>

<p>I am running in the <code>default</code> namespace, is it because of this ?<br>
I tried to run:<br>
<code>kubectl apply -f MyRoleBinding.yaml --namespace=kube-system</code> but I am getting the same error.  </p>

<p>I also tried to add an existing role in the <code>defaul</code> namespace by using:  </p>

<pre><code>roleRef: 
  kind: Role
  name: read-pods
  namespace: default
  apiGroup: "" 
</code></pre>

<p>and I got the same error.  </p>

<p>The <code>roleRef</code> field doesn't support namespace. You can use <code>roleRef</code> either with ClusterRoles which are not namespaced or with Roles which always has to be in the same namespace as the RoleBinding. See also the <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#roleref-v1-rbac-authorization-k8s-io" rel="noreferrer">reference</a>.</p>
