<p>Kubernetes doesn't allow RoleRef of RoleBinding to be updated.<br />
When I command like below, kubernetes shows error:&quot;cannot change roleRef&quot;</p>
<pre><code>$ kubectl apply -f - &lt;&lt; EOF
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: test-crb
subjects:
- kind: User
  name: user@acme.com
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: edit
  apiGroup: rbac.authorization.k8s.io
EOF
clusterrolebinding &quot;test-crb&quot; created

$ kubectl apply -f - &lt;&lt; EOF
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: test-crb
subjects:
- kind: User
  name: user@acme.com
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: view
  apiGroup: rbac.authorization.k8s.io
EOF
The ClusterRoleBinding &quot;test-crb&quot; is invalid: roleRef: Invalid value: rbac.RoleRef{APIGroup:&quot;rbac.authorization.k8s.io&quot;, Kind:&quot;ClusterRole&quot;, Name:&quot;view&quot;}: cannot change roleRef
</code></pre>
<p>What I want to know is the reason.<br />
Why kubernetes doesn't allow users to update RoleRef?<br />
Is there some special reason?</p>

<p>roleRef is immutable,You need to delete and recreate the referenced role/clusterorle.  Here is the related <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#clusterrolebinding-example" rel="nofollow noreferrer">documentation</a>.</p>
<blockquote>
<p>After you create a binding, you cannot change the Role or ClusterRole
that it refers to. If you try to change a binding's roleRef, you get a
validation error. If you do want to change the roleRef for a binding,
you need to remove the binding object and create a replacement.</p>
</blockquote>
<p><strong>&gt; There are two reasons for this restriction:</strong></p>
<blockquote>
<ol>
<li>Making roleRef immutable allows granting someone update permission on
an existing binding object, so that they can manage the list of
subjects, without being able to change the role that is granted to
those subjects.</li>
</ol>
</blockquote>
<blockquote>
<ol start="2">
<li>A binding to a different role is a fundamentally
different binding. Requiring a binding to be deleted/recreated in
order to change the roleRef ensures the full list of subjects in the
binding is intended to be granted the new role (as opposed to enabling
or accidentally modifying only the roleRef without verifying all of
the existing subjects should be given the new role's permissions).</li>
</ol>
</blockquote>
