diff --git a/pkg/apis/rbac/helpers.go b/pkg/apis/rbac/helpers.go index 5a246ab4509..549aedc98fc 100644 --- a/pkg/apis/rbac/helpers.go +++ b/pkg/apis/rbac/helpers.go @@ -215,9 +215,8 @@ func (r *PolicyRuleBuilder) Rule() (PolicyRule, error) { return PolicyRule{}, fmt.Errorf("non-resource rule may not have apiGroups, resources, or resourceNames: %#v", r.PolicyRule) } case len(r.PolicyRule.Resources) > 0: - if len(r.PolicyRule.NonResourceURLs) != 0 { - return PolicyRule{}, fmt.Errorf("resource rule may not have nonResourceURLs: %#v", r.PolicyRule) - } + // resource rule may not have nonResourceURLs + if len(r.PolicyRule.APIGroups) == 0 { // this a common bug return PolicyRule{}, fmt.Errorf("resource rule must have apiGroups: %#v", r.PolicyRule)