I have a problem with Kubernetes API and CRD, while creating a deployment with a single nginx pod, i would like to access using port 80 from a remote server, and locally as well. After seeing the pod in a pending state and running the kubectl get pods and then after around 40 seconds on average, the pod disappears, and then a different nginx pod name is starting up, this seems to be in a loop.

The error is <br> * W1214 23:27:19.542477 1 requestheader_controller.go:193] Unable to get configmap/extension-apiserver-authentication in kube-system. Usually fixed by 'kubectl create rolebinding -n kube-system ROLEBINDING_NAME --role=extension-apiserver-authentication-reader --serviceaccount=YOUR_NS:YOUR_SA'

I was following this article about service accounts and roles, <br> https://thorsten-hans.com/custom-resource-definitions-with-rbac-for-serviceaccounts#create-the-clusterrolebinding <br>

1. I am not even sure i have created this correctly?
2. Do i even need to create the ServiceAccount_v1.yaml, PolicyRule_v1.yaml and ClusterRoleBinding.yaml files to resolve my error above.

All of my .yaml files for this are below,

CustomResourceDefinition_v1.yaml

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  # name must match the spec fields below, and be in the form: <plural>.<group>
  name: webservers.stable.example.com
spec:
  # group name to use for REST API: /apis/<group>/<version>
  group: stable.example.com
  names:
    # kind is normally the CamelCased singular type. Your resource manifests use this.
    kind: WebServer
    # plural name to be used in the URL: /apis/<group>/<version>/<plural>
    plural: webservers
    # shortNames allow shorter string to match your resource on the CLI
    shortNames:
    - ws
    # singular name to be used as an alias on the CLI and for display
    singular: webserver
  # either Namespaced or Cluster
  scope: Cluster
  # list of versions supported by this CustomResourceDefinition
  versions:
  - name: v1
    schema:
      openAPIV3Schema:
        type: object
        properties:
            spec:
              type: object
              properties:
                cronSpec:
                  type: string
                image:
                  type: string
                replicas:
                  type: integer      
    # Each version can be enabled/disabled by Served flag.
    served: true
    # One and only one version must be marked as the storage version.
    storage: true

Deployments_v1_apps.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  # Unique key of the Deployment instance
  name: nginx-deployment
spec:
  # 1 Pods should exist at all times.
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  strategy:
    rollingUpdate:
      maxSurge: 100
      maxUnavailable: 0
    type: RollingUpdate
  template:
    metadata:
      labels:
        # Apply this label to pods and default
        # the Deployment label selector to this value
        app: nginx
    spec:
      containers:
      # Run this image
      - image: nginx:1.14
        name: nginx
        ports:
        - containerPort: 80
      hostname: nginx
      nodeName: webserver01
      securityContext:
        runAsNonRoot: True
#status:
  #availableReplicas: 1

Ingress_v1_networking.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
spec:
  rules:
  - http:
      paths:
      - path: /
        pathType: Exact
        backend:
          resource:
            kind: nginx-service
            name: nginx-deployment
      #service:
      #  name: nginx
      #  port: 80
            #serviceName: nginx
            #servicePort: 80

Service_v1_core.yaml

apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  selector:
    app: nginx
  ports:
    - port: 80
      protocol: TCP
      targetPort: 80

ServiceAccount_v1.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
    name: user
    namespace: example

PolicyRule_v1.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
    name: "example.com:webservers:reader"
rules:
    - apiGroups: ["example.com"]
      resources: ["ResourceAll"]
      verbs: ["VerbAll"]

ClusterRoleBinding_v1.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
    name: "example.com:webservers:cdreader-read"
roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: "example.com:webservers:reader"
subjects:
    - kind: ServiceAccount
      name: user
      namespace: example