No Clusterrolebinding for Restricted PSP

Rancher 2.x
1

Brand new on-prem cluster with PSP’s enabled. The cluster was created from a template with the following relevant parameters set.
Pod Security Policy Support = true
Default Pod Security Policy = restricted

I’m expecting to see a clusterrolebinding similar to the below created. To try and trigger the creation of this clusterrolebinding, I have created a project with restricted PSPs, and added a namespace to the project as well.

I do have a clusterrole that allows the restricted PSP to be used, however no clusterrolebinding. When should this clusterrolebinding be created?

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: restricted-role-bind
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: restricted-clusterrole
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:serviceaccounts