<p>I am using the Mirantis kubeadm-dind-cluster repository (<a href="https://github.com/Mirantis/kubeadm-dind-cluster" rel="nofollow noreferrer">https://github.com/Mirantis/kubeadm-dind-cluster</a>) as my Kubernetes install; I came across this error when attempting to run a container -</p>

<pre><code>panic: customresourcedefinitions.apiextensions.k8s.io is forbidden: User "system:serviceaccount:default:default" cannot create customresourcedefinitions.apiextensions.k8s.io at the cluster scope
</code></pre>

<p>So I attempted to add cluster-admin permissions to my account:</p>

<pre><code>kubectl create clusterrolebinding serviceaccounts-cluster-admin --clusterrole=cluster-admin  --group=system:serviceaccounts
</code></pre>

<p>And get the following error:</p>

<pre><code>Error: unknown flag: --clusterrole
</code></pre>

<p>Why is this? How do I fix this or get around it? I'm not sure how to convert the command into a YAML file to "kubectl create -f" to but it seems like that might be the way to go. </p>

<p>All three nodes are on version 1.8.6.</p>

<p>What version of kubectl are you using? Be sure you are using a version that includes the <code>kubectl create clusterrolebinding</code> command</p>

<p>If your version of kubectl does not support that command, you can try creating it directly via a yaml file (though I'm not sure whether 1.5.x kubectl was happy submitting versions of API objects it didn't know about):</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: serviceaccounts-cluster-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:serviceaccounts
</code></pre>
