From this post in docker forum
https://forums.docker.com/t/enable-rbac-authorization-k8s-io-for-kube-apiserver/45793
it seems that so far (may 2018) that it's not possible to use K8S'RBAC in Docker 2.0 EE UCP.
Some of you found the same limitation? Was able to enable it?
I have found a link describing this limitation:
Docker EE has its own RBAC system, so it’s not possible to create ClusterRole objects, ClusterRoleBinding objects, or any other object that is created by using the /apis/rbac.authorization.k8s.io endpoints.