<p>Here is a <code>ClusterRoleBinding</code> syntax that I found for creating Cluster role binding. Why does <code>apiGroup</code> needed to be specified when referring to role in <code>roleRef</code>? I have seen similar example in the <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">Kubernetes docs</a>. What is the possible explanation?</p>

<h2>Example 1</h2>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: read-secrets-global
subjects:
- kind: Group
  name: manager # Name is case sensitive
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: secret-reader
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<h2>Example 2</h2>

<pre><code>kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: traefik-ingress-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: traefik-ingress-controller
subjects:
- kind: ServiceAccount
  name: traefik-ingress-controller
  namespace: kube-system
</code></pre>

<p>All Kubernetes resources have group, version, name, so an <code>apiGroup</code> field is required to identify a group.<br>
For example, if you create your <a href="https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/" rel="nofollow noreferrer">Custom Resource Definition(CRD)</a>, you need setting these fields.<br>
below is the sample controller <a href="https://github.com/kubernetes/sample-controller/blob/master/artifacts/examples/crd.yaml" rel="nofollow noreferrer">example</a>:</p>

<pre><code>apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: foos.samplecontroller.k8s.io
spec:
  group: samplecontroller.k8s.io
  version: v1alpha1
  names:
    kind: Foo
    plural: foos
  scope: Namespaced
</code></pre>

<p>(<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#serviceaccount-v1-core" rel="nofollow noreferrer">ServiceAccount resource</a> is the core group. so I think ServiceAccount could be omitted a group field.)</p>
