The role and role binding are in a different namespace as the service account.