After creating a new GKE cluster, creating a cluster role failed with the following error:

Error from server (Forbidden): error when creating "./role.yaml":
clusterroles.rbac.authorization.k8s.io "secret-reader" is forbidden: 
attempt to grant extra privileges: [PolicyRule{Resources:["secrets"], 
APIGroups:[""], Verbs:["get"]} PolicyRule{Resources:["secrets"], 
APIGroups:[""], Verbs:["watch"]} PolicyRule{Resources:["secrets"], 
APIGroups:[""], Verbs:["list"]}] user=&{XXX@gmail.com  
[system:authenticated] map[authenticator:[GKE]]} ownerrules= . 
[PolicyRule{Resources:["selfsubjectaccessreviews" 
"selfsubjectrulesreviews"], APIGroups:["authorization.k8s.io"], Verbs: 
["create"]} PolicyRule{NonResourceURLs:["/api" "/api/*" "/apis" 
"/apis/*" "/healthz" "/swagger-2.0.0.pb-v1" "/swagger.json" 
"/swaggerapi" "/swaggerapi/*" "/version"], Verbs:["get"]}] 
ruleResolutionErrors=[]

My account has the following permissions in IAM:

Kubernetes Engine Admin

Kubernetes Engine Cluster Admin

Owner

This is my role.yaml (from the Kubernetes docs):

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]

According to the RBAC docs of GCloud, I need to

create a RoleBinding that gives your Google identity a cluster-admin role before attempting to create additional Role or ClusterRole permissions.

So I tried this:

export GCP_USER=$(gcloud config get-value account | head -n 1)
kubectl create clusterrolebinding cluster-admin-binding
--clusterrole=cluster-admin --user=$GCP_USER

which succeeded, but I still get the same error when creating the cluster role.

Any ideas what I might be doing wrong?