Description of problem:
rolebindingrestriction created failed for resource validation failed

Version-Release number of selected component (if applicable):
$ oc get clusterversion
NAME      VERSION                             AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.2.0-0.nightly-2019-07-24-233914   True        False         7h55m   Cluster version is 4.2.0-0.nightly-2019-07-24-233914

How reproducible:
always

Steps to Reproduce:
1. create a rolebinding with a resource file, such as:
$ oc create -f - <<EOF
> apiVersion: authorization.openshift.io/v1
> kind: RoleBindingRestriction
> metadata:
>   name: match-groups
> spec:
>   grouprestriction:
>     groups:
>     - groups-rolebindingrestriction
> EOF

2.
3.

Actual results:
Failed to create such rolebindingrestriction, with validation error:
The RoleBindingRestriction "match-groups" is invalid: []: Invalid value: map[string]interface {}{"apiVersion":"authorization.openshift.io/v1", "kind":"RoleBindingRestriction", "metadata":map[string]interface {}{"creationTimestamp":"2019-07-25T10:03:18Z", "generation":1, "name":"match-groups", "namespace":"openshift-authentication", "uid":"6d10dee8-aec3-11e9-961e-029a6e1b3ab0"}, "spec":map[string]interface {}{"grouprestriction":map[string]interface {}{"groups":[]interface {}{"groups-rolebindingrestriction"}}}}: validation failure list:

scheng: See below logs:
spec.grouprestriction.labels in body is required
spec.serviceaccountrestriction in body is required
spec.userrestriction in body is required

Expected results:
rolebindingrestriction create successfully

Additional info:
In 4.1 with the same resource file, no such issue when create rolebindingrestriction.