1 changed files with 16 additions and 0 deletions
@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: homelab-admin-oidc
+spec:
+  roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: ClusterRole
+    name: cluster-admin
+  subjects:
+    # OIDC group for Authentik homelab-admins members
+    # When rock logs in via OIDC, k8s sees:
+    # - User: oidc:[email protected]
+    # - Groups: oidc:homelab-admins (from Authentik group claim)
+    - kind: Group
+      name: oidc:homelab-admins