Issue #3261006 by yas, Xiaohua Guan: Fix an error to handle an empty apiGroups field in a rule of K8s role