What roleBinding do I need to configure AKS integration with Vault?

Vault
1

When integrating AKS with Vault, in the step where we configure Vault (i.e. auth/kubernetes/config), what ClusterRoleBinding should the associated ServiceAccount have?

roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:auth-delegator
?

2

Its in the docs ?

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: role-tokenreview-binding
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
  - kind: ServiceAccount
    name: vault-auth
    namespace: default