PolicyRulesWithSubjects.resourceRules.apiGroups

`apiGroups` is a list of matching API groups and may not be empty. "*" matches all API groups and, if present, must be the only entry. Required.