diff --git a/cluster/gce/gci/configure-helper.sh b/cluster/gce/gci/configure-helper.sh
index d1056308203..91fe619b571 100644
--- a/cluster/gce/gci/configure-helper.sh
+++ b/cluster/gce/gci/configure-helper.sh
@@ -509,7 +509,7 @@ rules:
     # Ingress controller reads `configmaps/ingress-uid` through the unsecured port.
     # TODO(#46983): Change this to the ingress controller service account.
     users: ["system:unsecured"]
-    namespaces: ["kube-sytem"]
+    namespaces: ["kube-system"]
     verbs: ["get"]
     resources:
       - group: "" # core
@@ -521,7 +521,7 @@ rules:
       - group: "" # core
         resources: ["nodes"]
   - level: None
-    groups: ["system:nodes"]
+    userGroups: ["system:nodes"]
     verbs: ["get"]
     resources:
       - group: "" # core
@@ -532,7 +532,7 @@ rules:
       - system:kube-scheduler
       - system:serviceaccount:kube-system:endpoint-controller
     verbs: ["get", "update"]
-    namespaces: ["kube-sytem"]
+    namespaces: ["kube-system"]
     resources:
       - group: "" # core
         resources: ["endpoints"]