apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: homelab-admin-oidc
spec:
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: cluster-admin
  subjects:
    # OIDC group for Authentik homelab-admins members
    # When rock logs in via OIDC, k8s sees:
    # - User: oidc:rock@example.com
    # - Groups: oidc:homelab-admins (from Authentik group claim)
    - kind: Group
      name: oidc:homelab-admins