Ooops i thought role was i a diff namespace. By the way, i dont think apiGroup on the role ref is required.