title: Cannot create cluster role in GKE even though I am owner and admin
body: <p>After creating a new GKE cluster, creating a cluster role failed with the following error:</p>
  <pre><code>Error from server (Forbidden): error when creating &quot;./role.yaml&quot;:
  clusterroles.rbac.authorization.k8s.io &quot;secret-reader&quot; is forbidden: 
  attempt to grant extra privileges: [PolicyRule{Resources:[&quot;secrets&quot;], 
  APIGroups:[&quot;&quot;], Verbs:[&quot;get&quot;]} PolicyRule{Resources:[&quot;secrets&quot;], 
  APIGroups:[&quot;&quot;], Verbs:[&quot;watch&quot;]} PolicyRule{Resources:[&quot;secrets&quot;], 
  APIGroups:[&quot;&quot;], Verbs:[&quot;list&quot;]}] user=&amp;{XXX@gmail.com  
  [system:authenticated] map[authenticator:[GKE]]} ownerrules= . 
  [PolicyRule{Resources:[&quot;selfsubjectaccessreviews&quot; 
  &quot;selfsubjectrulesreviews&quot;], APIGroups:[&quot;authorization.k8s.io&quot;], Verbs: 
  [&quot;create&quot;]} PolicyRule{NonResourceURLs:[&quot;/api&quot; &quot;/api/*&quot; &quot;/apis&quot; 
  &quot;/apis/*&quot; &quot;/healthz&quot; &quot;/swagger-2.0.0.pb-v1&quot; &quot;/swagger.json&quot; 
  &quot;/swaggerapi&quot; &quot;/swaggerapi/*&quot; &quot;/version&quot;], Verbs:[&quot;get&quot;]}] 
  ruleResolutionErrors=[]
  </code></pre>
  <p>My account has the following permissions in IAM:</p>
  <blockquote>
  <p>Kubernetes Engine Admin</p>
  <p>Kubernetes Engine Cluster Admin</p>
  <p>Owner</p>
  </blockquote>
  <p>This is my <code>role.yaml</code> (from the <a href="https://kubernetes.io/docs/admin/authorization/rbac/#role-and-clusterrole" rel="noreferrer">Kubernetes docs)</a>:</p>
  <pre><code>kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: secret-reader
  rules:
  - apiGroups: [&quot;&quot;]
    resources: [&quot;secrets&quot;]
    verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]
  </code></pre>
  <p>According to the <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control" rel="noreferrer">RBAC docs of GCloud</a>, I need to</p>
  <blockquote>
  <p>create a RoleBinding that gives your Google identity a cluster-admin role before attempting to create additional Role or ClusterRole permissions.</p>
  </blockquote>
  <p>So I tried <a href="https://projectriff.io/docs/running-on-gke-with-rbac/" rel="noreferrer">this</a>:</p>
  <pre><code>export GCP_USER=$(gcloud config get-value account | head -n 1)
  kubectl create clusterrolebinding cluster-admin-binding
  --clusterrole=cluster-admin --user=$GCP_USER
  </code></pre>
  <p>which succeeded, but I still get the same error when creating the cluster role.</p>
  <p>Any ideas what I might be doing wrong?</p>