{"record":{"id":"26c67ba0e62e6e58","repo":"quarkusio/quarkus","slug":"no-subjects-have-been-set-in-the-clusterrolebindin","errorCode":null,"errorMessage":"No subjects have been set in the ClusterRoleBinding resource!","messagePattern":"No subjects have been set in the ClusterRoleBinding resource!","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/BaseKubeProcessor.java","lineNumber":489,"sourceCode":"        }\n\n        // Add cluster role bindings from extensions\n        Targetable.filteredByTarget(clusterRoleBindingsFromExtensions, target)\n                .map(rb -> new AddClusterRoleBindingResourceDecorator(name,\n                        Strings.isNotNullOrEmpty(rb.getName()) ? rb.getName() : name + \"-\" + rb.getRoleRef().getName(),\n                        rb.getLabels(),\n                        rb.getRoleRef(),\n                        rb.getSubjects()))\n                .forEach(context::add);\n\n        // Add cluster role bindings from configuration\n        for (Map.Entry<String, RbacConfig.ClusterRoleBindingConfig> rb : config.rbac().clusterRoleBindings().entrySet()) {\n            String rbName = rb.getValue().name().orElse(rb.getKey());\n            RbacConfig.ClusterRoleBindingConfig clusterRoleBinding = rb.getValue();\n\n            List<Subject> subjects = new ArrayList<>();\n            if (clusterRoleBinding.subjects().isEmpty()) {\n                throw new IllegalStateException(\"No subjects have been set in the ClusterRoleBinding resource!\");\n            }\n\n            for (Map.Entry<String, RbacConfig.SubjectConfig> s : clusterRoleBinding.subjects().entrySet()) {\n                String subjectName = s.getValue().name().orElse(s.getKey());\n                RbacConfig.SubjectConfig subject = s.getValue();\n                subjects.add(new Subject(subject.apiGroup().orElse(null),\n                        subject.kind(),\n                        subjectName,\n                        subject.namespace().orElse(null)));\n            }\n\n            context.add(new AddClusterRoleBindingResourceDecorator(name,\n                    rbName,\n                    clusterRoleBinding.labels(),\n                    new RoleRef(clusterRoleBinding.roleName(), true),\n                    subjects.toArray(new Subject[0])));\n        }\n","sourceCodeStart":471,"sourceCodeEnd":507,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/BaseKubeProcessor.java#L471-L507","documentation":"When processing quarkus.kubernetes.rbac.cluster-role-bindings config, BaseKubeProcessor requires at least one subject: a ClusterRoleBinding that binds a role to nobody is meaningless and invalid. If clusterRoleBinding.subjects() is empty it throws IllegalStateException before iterating subjects.","triggerScenarios":"Declaring quarkus.kubernetes.rbac.cluster-role-bindings.<name> without any quarkus.kubernetes.rbac.cluster-role-bindings.<name>.subjects.<subject>.* entries (empty subjects map).","commonSituations":"Creating a cluster-role-binding key in config as a placeholder and forgetting to add subjects; subjects removed during cleanup; indentation/typos so the subject entries don't parse under the binding key.","solutions":["Add at least one subject: quarkus.kubernetes.rbac.cluster-role-bindings.<name>.subjects.<subject>.kind=ServiceAccount (plus name/api-groups as needed)","Check subject entries are spelled and nested under the correct binding key","Remove the cluster-role-binding entry if it's not actually used","Validate the generated application.properties structure against the RbacConfig mapping"],"exampleFix":"# before\nquarkus.kubernetes.rbac.cluster-role-bindings.my-crb.role-name=cluster-admin\n# after\nquarkus.kubernetes.rbac.cluster-role-bindings.my-crb.role-name=cluster-admin\nquarkus.kubernetes.rbac.cluster-role-bindings.my-crb.subjects.my-sa.kind=ServiceAccount","handlingStrategy":"validation","validationCode":"clusterRoleBindings.forEach((k, v) -> { if (v.subjects.isEmpty()) fail(\"cluster-role-bindings.\" + k + \" needs at least one subject\"); });","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Add at least one .subjects.<id>.kind entry per cluster-role-binding","Verify nesting/typos of subject keys","Remove unused cluster-role-binding entries"],"tags":["kubernetes","rbac","clusterrolebinding","config"],"backgroundTag":"missing-rbac-subjects","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}