---
# Kubernetes RBAC for Keycloak-federated (OIDC) users. The k3s API server is configured
# (infra/ansible roles/k3s_server) with:
#   oidc-issuer-url=https://keycloak.home.keithjackson.dev/realms/homelab
#   oidc-client-id=kubernetes   oidc-username-claim=email   oidc-username-prefix=oidc:
#   oidc-groups-claim=groups    oidc-groups-prefix=oidc:
# so a Keycloak group `platform-admins` appears to RBAC as the group `oidc:platform-admins`, and a
# user with email you@example.com as `oidc:you@example.com`. These bindings map the Keycloak group
# claim to cluster roles. Group-based (not user-based) so access follows Keycloak group membership
# with no per-user k8s change. Applied by platform-config (dependsOn platform).
#
# BREAK-GLASS: the cert-based admin in the bootstrap kubeconfig is unaffected by any of this and
# keeps full access even if Keycloak/OIDC is down — do not remove it.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: oidc-platform-admins
  labels:
    app.kubernetes.io/part-of: keycloak
    homelab.keithjackson.dev/oidc-rbac: "true"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: "oidc:platform-admins"
---
# Read-only tier: the Keycloak `viewers` group gets the built-in `view` ClusterRole (read most
# resources cluster-wide, excluding Secrets and RBAC escalation paths).
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: oidc-viewers
  labels:
    app.kubernetes.io/part-of: keycloak
    homelab.keithjackson.dev/oidc-rbac: "true"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: view
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: "oidc:viewers"