mhm, any chance there is a bug? I dont see anything wrong with this definition:

RoleBinding(
    "orleans-rbac-rb",
    metadata={
        "name": "orleans-rbac",
        "namespace": "default"
    },
    role_ref={
        "apiGroup": "<http://rbac.authorization.k8s.io|rbac.authorization.k8s.io>",
        "kind": "ClusterRole",
        "name": "orleans-rbac"
    },
    subjects=[
        {
            "kind": "ServiceAccount",
            "name": "orleans-rbac",
            "namespace": "default"
        }
    ]
)

this binds to a clusterrole, but thats intentional. it should be the reason to fail anyway. no way pulumi can know I have or not have that role, nor should it care