From 6ec61d1c2cb03834044d5b4a252d897bf0500e35 Mon Sep 17 00:00:00 2001 From: rock Date: Sat, 5 Sep 2026 14:30:41 -0700 Subject: [PATCH] feat: add OIDC group binding for cluster-admin access - Binds oidc:homelab-admins group to cluster-admin ClusterRole - Allows OIDC users (via Authentik) to have admin access - Groups claim from Authentik with oidc: prefix per kube-apiserver config - Enables kubectl access via 'kubectl login' + kubelogin --- k8s/infra/rbac/admin-oidc-binding.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 k8s/infra/rbac/admin-oidc-binding.yaml diff --git a/k8s/infra/rbac/admin-oidc-binding.yaml b/k8s/infra/rbac/admin-oidc-binding.yaml new file mode 100644 index 0000000..63b0de2 --- /dev/null +++ b/k8s/infra/rbac/admin-oidc-binding.yaml @@ -0,0 +1,16 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: homelab-admin-oidc +spec: + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin + subjects: + # OIDC group for Authentik homelab-admins members + # When rock logs in via OIDC, k8s sees: + # - User: oidc:rock@example.com + # - Groups: oidc:homelab-admins (from Authentik group claim) + - kind: Group + name: oidc:homelab-admins