From 7ac37c7ab5018e22b7eb6811df64b2ae6f416dba Mon Sep 17 00:00:00 2001 From: rock Date: Sat, 5 Sep 2026 15:04:00 -0700 Subject: [PATCH] fix: remove spec wrapper from ClusterRoleBinding - ClusterRoleBinding doesn't use spec: wrapper (unlike Deployment/StatefulSet) - roleRef and subjects go at top level with metadata - Fixes: 'strict decoding error: unknown field "spec"' --- k8s/infra/rbac/admin-oidc-binding.yaml | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/k8s/infra/rbac/admin-oidc-binding.yaml b/k8s/infra/rbac/admin-oidc-binding.yaml index 63b0de2..b29c9a1 100644 --- a/k8s/infra/rbac/admin-oidc-binding.yaml +++ b/k8s/infra/rbac/admin-oidc-binding.yaml @@ -2,15 +2,14 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: homelab-admin-oidc -spec: - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cluster-admin - subjects: - # OIDC group for Authentik homelab-admins members - # When rock logs in via OIDC, k8s sees: - # - User: oidc:rock@example.com - # - Groups: oidc:homelab-admins (from Authentik group claim) - - kind: Group - name: oidc:homelab-admins +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: + # OIDC group for Authentik homelab-admins members + # When rock logs in via OIDC, k8s sees: + # - User: oidc:rock@example.com + # - Groups: oidc:homelab-admins (from Authentik group claim) + - kind: Group + name: oidc:homelab-admins