@@ -94,6 +94,13 @@ func fuzzInternalObject(t *testing.T, forVersion unversioned.GroupVersion, item

 				j.Subjects[i].FieldPath = ""

 			}

 		},

+		func(j *authorizationapi.PolicyRule, c fuzz.Continue) {

+			c.FuzzNoCustom(j)

+			// if no groups are found, then we assume "".  This matches defaulting

+			if len(j.APIGroups) == 0 {

+				j.APIGroups = []string{""}

+			}

+		},

 		func(j *authorizationapi.ClusterRoleBinding, c fuzz.Continue) {

 			c.FuzzNoCustom(j)

 			for i := range j.Subjects {

@@ -21,6 +21,11 @@ func addDefaultingFuncs(scheme *runtime.Scheme) {

 			if kapi.Semantic.Equalities.DeepEqual(oldAllowAllPolicyRule, *obj) && obj.APIGroups == nil {

 				obj.APIGroups = []string{internal.APIGroupAll}

 			}

+

+			// if no groups are found, then we assume ""

+			if len(obj.Resources) > 0 && len(obj.APIGroups) == 0 {

+				obj.APIGroups = []string{""}

+			}

 		},

 	)

 	if err != nil {

@@ -70,11 +70,6 @@ func (a DefaultAuthorizationAttributes) RuleMatches(rule authorizationapi.Policy

 }

 func (a DefaultAuthorizationAttributes) apiGroupMatches(allowedGroups []string) bool {

-	// if no APIGroups are specified, then the default APIGroup of "" is assumed.

-	if len(allowedGroups) == 0 && len(a.GetAPIGroup()) == 0 {

-		return true

-	}

-

 	// allowedGroups is expected to be small, so I don't feel bad about this.

 	for _, allowedGroup := range allowedGroups {

 		if allowedGroup == authorizationapi.APIGroupAll {

@@ -15,6 +15,8 @@ import (

 	testpolicyregistry "github.com/openshift/origin/pkg/authorization/registry/test"

 	"github.com/openshift/origin/pkg/authorization/rulevalidation"

 	"github.com/openshift/origin/pkg/cmd/server/bootstrappolicy"

+

+	_ "github.com/openshift/origin/pkg/api/install"

 )

 type authorizeTest struct {

@@ -646,6 +648,7 @@ func newAdzePolicies() []authorizationapi.Policy {

 					},

 					Rules: append(make([]authorizationapi.PolicyRule, 0),

 						authorizationapi.PolicyRule{

+							APIGroups: []string{""},

 							Verbs:     sets.NewString("watch", "list", "get"),

 							Resources: sets.NewString("buildConfigs"),

 						}),

@@ -539,11 +539,13 @@ func newInvalidExtensionPolicies() []authorizationapi.Policy {

 					},

 					Rules: []authorizationapi.PolicyRule{

 						{

+							APIGroups:             []string{""},

 							Verbs:                 sets.NewString("watch", "list", "get"),

 							Resources:             sets.NewString("buildConfigs"),

 							AttributeRestrictions: &authorizationapi.Role{},

 						},

 						{

+							APIGroups: []string{""},

 							Verbs:     sets.NewString("update"),

 							Resources: sets.NewString("buildConfigs"),

 						},

@@ -13,6 +13,7 @@ import (

 	authorizationapi "github.com/openshift/origin/pkg/authorization/api"

 	"github.com/openshift/origin/pkg/authorization/rulevalidation"

 	oauthapi "github.com/openshift/origin/pkg/oauth/api"

+	projectapi "github.com/openshift/origin/pkg/project/api"

 	userapi "github.com/openshift/origin/pkg/user/api"

 )

@@ -124,11 +125,11 @@ func (userEvaluator) ResolveRules(scope, namespace string, clusterPolicyGetter r

 		}, nil

 	case UserIndicator + UserAccessCheck:

 		return []authorizationapi.PolicyRule{

-			{Verbs: sets.NewString("create"), Resources: sets.NewString("subjectaccessreviews", "localsubjectaccessreviews"), AttributeRestrictions: &authorizationapi.IsPersonalSubjectAccessReview{}},

+			{Verbs: sets.NewString("create"), APIGroups: []string{authorizationapi.GroupName}, Resources: sets.NewString("subjectaccessreviews", "localsubjectaccessreviews"), AttributeRestrictions: &authorizationapi.IsPersonalSubjectAccessReview{}},

 		}, nil

 	case UserIndicator + UserListProject:

 		return []authorizationapi.PolicyRule{

-			{Verbs: sets.NewString("list"), Resources: sets.NewString("projects")},

+			{Verbs: sets.NewString("list"), APIGroups: []string{projectapi.GroupName}, Resources: sets.NewString("projects")},

 		}, nil

 	default:

 		return nil, fmt.Errorf("unrecognized scope: %v", scope)

@@ -11,8 +11,10 @@ import (

 	"github.com/openshift/origin/pkg/api"

 	authorizationapi "github.com/openshift/origin/pkg/authorization/api"

+	authorizationapiv1 "github.com/openshift/origin/pkg/authorization/api/v1"

 	imageapi "github.com/openshift/origin/pkg/image/api"

 	projectapi "github.com/openshift/origin/pkg/project/api"

+	routeapi "github.com/openshift/origin/pkg/route/api"

 )

 func GetBootstrapOpenshiftRoles(openshiftNamespace string) []authorizationapi.Role {

@@ -226,16 +228,19 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {

 					Resources: sets.NewString("daemonsets"),

 				},

 				{

+					APIGroups: []string{api.GroupName},

 					Verbs:     sets.NewString("get", "list", "watch"),

 					Resources: sets.NewString(authorizationapi.PolicyOwnerGroupName, authorizationapi.KubeAllGroupName, authorizationapi.OpenshiftStatusGroupName, authorizationapi.KubeStatusGroupName),

 				},

 				{

-					Verbs: sets.NewString("get", "update"),

+					APIGroups: []string{imageapi.GroupName},

+					Verbs:     sets.NewString("get", "update"),

 					// this is used by verifyImageStreamAccess in pkg/dockerregistry/server/auth.go

 					Resources: sets.NewString("imagestreams/layers"),

 				},

 				// an admin can run routers that write back conditions to the route

 				{

+					APIGroups: []string{routeapi.GroupName},

 					Verbs:     sets.NewString("update"),

 					Resources: sets.NewString("routes/status"),

 				},

@@ -292,11 +297,13 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {

 					Resources: sets.NewString("daemonsets"),

 				},

 				{

+					APIGroups: []string{api.GroupName},

 					Verbs:     sets.NewString("get", "list", "watch"),

 					Resources: sets.NewString(authorizationapi.KubeAllGroupName, authorizationapi.OpenshiftStatusGroupName, authorizationapi.KubeStatusGroupName, "projects"),

 				},

 				{

-					Verbs: sets.NewString("get", "update"),

+					APIGroups: []string{imageapi.GroupName},

+					Verbs:     sets.NewString("get", "update"),

 					// this is used by verifyImageStreamAccess in pkg/dockerregistry/server/auth.go

 					Resources: sets.NewString("imagestreams/layers"),

 				},

@@ -308,6 +315,7 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {

 			},

 			Rules: []authorizationapi.PolicyRule{

 				{

+					APIGroups: []string{api.GroupName},

 					Verbs:     sets.NewString("get", "list", "watch"),

 					Resources: sets.NewString(authorizationapi.OpenshiftExposedGroupName, authorizationapi.KubeAllGroupName, authorizationapi.OpenshiftStatusGroupName, authorizationapi.KubeStatusGroupName, "projects"),

 				},

@@ -861,7 +869,27 @@ func GetBootstrapClusterRoles() []authorizationapi.ClusterRole {

 		}

 	}

-	return roles

+	// TODO roundtrip roles to pick up defaulting for API groups.  Without this, the covers check in reconcile-cluster-roles will fail.

+	// we can remove this again once everything gets group qualified and we have unit tests enforcing that.  other pulls are in

+	// progress to do that.

+	versionedRoles := []authorizationapiv1.ClusterRole{}

+	for i := range roles {

+		newRole := &authorizationapiv1.ClusterRole{}

+		if err := kapi.Scheme.Convert(&roles[i], newRole); err != nil {

+			panic(err)

+		}

+		versionedRoles = append(versionedRoles, *newRole)

+	}

+	roundtrippedRoles := []authorizationapi.ClusterRole{}

+	for i := range versionedRoles {

+		newRole := &authorizationapi.ClusterRole{}

+		if err := kapi.Scheme.Convert(&versionedRoles[i], newRole); err != nil {

+			panic(err)

+		}

+		roundtrippedRoles = append(roundtrippedRoles, *newRole)

+	}

+

+	return roundtrippedRoles

 }

 func GetBootstrapOpenshiftRoleBindings(openshiftNamespace string) []authorizationapi.RoleBinding {

@@ -13,6 +13,8 @@ import (

 	"k8s.io/kubernetes/pkg/util/diff"

 	"github.com/openshift/origin/pkg/api/v1"

+	authorizationapi "github.com/openshift/origin/pkg/authorization/api"

+	"github.com/openshift/origin/pkg/authorization/rulevalidation"

 	"github.com/openshift/origin/pkg/cmd/server/bootstrappolicy"

 	// install all APIs

@@ -91,3 +93,51 @@ func testObjects(t *testing.T, list *api.List, fixtureFilename string) {

 		}

 	}

 }

+

+// Some roles should always cover others

+func TestCovers(t *testing.T) {

+	allRoles := bootstrappolicy.GetBootstrapClusterRoles()

+	var admin *authorizationapi.ClusterRole

+	var editor *authorizationapi.ClusterRole

+	var viewer *authorizationapi.ClusterRole

+	var registryAdmin *authorizationapi.ClusterRole

+	var registryEditor *authorizationapi.ClusterRole

+	var registryViewer *authorizationapi.ClusterRole

+

+	for i := range allRoles {

+		role := allRoles[i]

+		switch role.Name {

+		case bootstrappolicy.AdminRoleName:

+			admin = &role

+		case bootstrappolicy.EditRoleName:

+			editor = &role

+		case bootstrappolicy.ViewRoleName:

+			viewer = &role

+		case bootstrappolicy.RegistryAdminRoleName:

+			registryAdmin = &role

+		case bootstrappolicy.RegistryEditorRoleName:

+			registryEditor = &role

+		case bootstrappolicy.RegistryViewerRoleName:

+			registryViewer = &role

+		}

+	}

+

+	if covers, _ := rulevalidation.Covers(admin.Rules, editor.Rules); !covers {

+		t.Errorf("failed to cover")

+	}

+	if covers, _ := rulevalidation.Covers(admin.Rules, editor.Rules); !covers {

+		t.Errorf("failed to cover")

+	}

+	if covers, _ := rulevalidation.Covers(admin.Rules, viewer.Rules); !covers {

+		t.Errorf("failed to cover")

+	}

+	if covers, _ := rulevalidation.Covers(admin.Rules, registryAdmin.Rules); !covers {

+		t.Errorf("failed to cover")

+	}

+	if covers, _ := rulevalidation.Covers(registryAdmin.Rules, registryEditor.Rules); !covers {

+		t.Errorf("failed to cover")

+	}

+	if covers, _ := rulevalidation.Covers(registryAdmin.Rules, registryViewer.Rules); !covers {

+		t.Errorf("failed to cover")

+	}

+}

@@ -41,7 +41,8 @@ items:

     creationTimestamp: null

     name: cluster-reader

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - bindings

@@ -147,20 +148,23 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - resourceaccessreviews

     - subjectaccessreviews

     verbs:

     - create

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - nodes/metrics

     verbs:

     - get

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - nodes/stats

@@ -363,7 +367,8 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - bindings

@@ -397,14 +402,16 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - imagestreams/layers

     verbs:

     - get

     - update

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - routes/status

@@ -540,7 +547,8 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - bindings

@@ -573,7 +581,8 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - imagestreams/layers

@@ -586,7 +595,8 @@ items:

     creationTimestamp: null

     name: view

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - bindings

@@ -676,7 +686,8 @@ items:

     creationTimestamp: null

     name: basic-user

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resourceNames:

     - "~"

@@ -684,27 +695,31 @@ items:

     - users

     verbs:

     - get

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - projectrequests

     verbs:

     - list

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - clusterroles

     verbs:

     - get

     - list

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - projects

     verbs:

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions:

       apiVersion: v1

       kind: IsPersonalSubjectAccessReview

@@ -713,7 +728,8 @@ items:

     - subjectaccessreviews

     verbs:

     - create

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - selfsubjectrulesreviews

@@ -725,7 +741,8 @@ items:

     creationTimestamp: null

     name: self-provisioner

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - projectrequests

@@ -783,7 +800,8 @@ items:

     creationTimestamp: null

     name: system:image-puller

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - imagestreams/layers

@@ -795,7 +813,8 @@ items:

     creationTimestamp: null

     name: system:image-pusher

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - imagestreams/layers

@@ -808,14 +827,16 @@ items:

     creationTimestamp: null

     name: system:image-builder

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - imagestreams/layers

     verbs:

     - get

     - update

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - builds/details

@@ -827,13 +848,15 @@ items:

     creationTimestamp: null

     name: system:image-pruner

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - images

     verbs:

     - delete

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - buildconfigs

@@ -846,7 +869,8 @@ items:

     verbs:

     - get

     - list

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - imagestreams/status

@@ -858,21 +882,24 @@ items:

     creationTimestamp: null

     name: system:deployer

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - replicationcontrollers

     verbs:

     - get

     - list

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - replicationcontrollers

     verbs:

     - get

     - update

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - pods

@@ -881,13 +908,15 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - pods/log

     verbs:

     - get

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - imagestreamtags

@@ -912,7 +941,8 @@ items:

     creationTimestamp: null

     name: system:oauth-token-deleter

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - oauthaccesstokens

@@ -925,7 +955,8 @@ items:

     creationTimestamp: null

     name: system:router

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - endpoints

@@ -933,7 +964,8 @@ items:

     verbs:

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - routes/status

@@ -945,14 +977,16 @@ items:

     creationTimestamp: null

     name: system:registry

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - images

     verbs:

     - delete

     - get

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - imagestreamimages

@@ -961,19 +995,22 @@ items:

     - imagestreamtags

     verbs:

     - get

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - imagestreams

     verbs:

     - update

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - imagestreammappings

     verbs:

     - create

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - resourcequotas

@@ -985,7 +1022,8 @@ items:

     creationTimestamp: null

     name: system:node-proxier

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - endpoints

@@ -999,7 +1037,8 @@ items:

     creationTimestamp: null

     name: system:node-admin

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - nodes

@@ -1007,13 +1046,15 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - nodes

     verbs:

     - proxy

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - nodes/log

@@ -1028,7 +1069,8 @@ items:

     creationTimestamp: null

     name: system:node-reader

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - nodes

@@ -1036,13 +1078,15 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - nodes/metrics

     verbs:

     - get

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - nodes/stats

@@ -1055,14 +1099,16 @@ items:

     creationTimestamp: null

     name: system:node

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - localsubjectaccessreviews

     - subjectaccessreviews

     verbs:

     - create

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - services

@@ -1070,7 +1116,8 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - nodes

@@ -1079,13 +1126,15 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - nodes/status

     verbs:

     - update

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - events

@@ -1093,7 +1142,8 @@ items:

     - create

     - patch

     - update

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - pods

@@ -1101,7 +1151,8 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - pods

@@ -1109,27 +1160,31 @@ items:

     - create

     - delete

     - get

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - pods/status

     verbs:

     - update

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - configmaps

     - secrets

     verbs:

     - get

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - persistentvolumeclaims

     - persistentvolumes

     verbs:

     - get

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - endpoints

@@ -1141,7 +1196,8 @@ items:

     creationTimestamp: null

     name: system:sdn-reader

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - hostsubnets

@@ -1149,7 +1205,8 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - netnamespaces

@@ -1157,7 +1214,8 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - nodes

@@ -1165,13 +1223,15 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - clusternetworks

     verbs:

     - get

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - namespaces

@@ -1185,7 +1245,8 @@ items:

     creationTimestamp: null

     name: system:sdn-manager

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - hostsubnets

@@ -1195,7 +1256,8 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - netnamespaces

@@ -1205,7 +1267,8 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - nodes

@@ -1213,7 +1276,8 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - clusternetworks

@@ -1226,7 +1290,8 @@ items:

     creationTimestamp: null

     name: system:webhook

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - buildconfigs/webhooks

@@ -1430,7 +1495,8 @@ items:

     creationTimestamp: null

     name: system:build-controller

   rules:

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - builds

@@ -1438,13 +1504,15 @@ items:

     - get

     - list

     - watch

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - builds

     verbs:

     - update

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - builds/custom

@@ -1453,13 +1521,15 @@ items:

     - builds/source

     verbs:

     - create

-  - apiGroups: null

+  - apiGroups:

+    - ""

     attributeRestrictions: null

     resources:

     - imagestreams

     verbs:

     - get

-  - apiGroups: null