{"record":{"id":"dbf482a530ae9308","repo":"quarkusio/quarkus","slug":"no-role-has-been-set-in-the-rolebinding-resource","errorCode":null,"errorMessage":"No role has been set in the RoleBinding resource!","messagePattern":"No role has been set in the RoleBinding resource!","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/BaseKubeProcessor.java","lineNumber":461,"sourceCode":"            if (roleBinding.subjects().isEmpty()) {\n                requiresServiceAccount = true;\n                subjects.add(new Subject(null, SERVICE_ACCOUNT,\n                        effectiveServiceAccountName,\n                        effectiveServiceAccountNamespace));\n            } else {\n                for (Map.Entry<String, RbacConfig.SubjectConfig> s : roleBinding.subjects().entrySet()) {\n                    String subjectName = s.getValue().name().orElse(s.getKey());\n                    RbacConfig.SubjectConfig subject = s.getValue();\n                    subjects.add(new Subject(subject.apiGroup().orElse(null),\n                            subject.kind(),\n                            subjectName,\n                            subject.namespace().orElse(null)));\n                }\n            }\n\n            String roleName = roleBinding.roleName().orElse(defaultRoleName);\n            if (roleName == null) {\n                throw new IllegalStateException(\"No role has been set in the RoleBinding resource!\");\n            }\n\n            boolean clusterWide = roleBinding.clusterWide().orElse(defaultClusterWide);\n            context.add(new AddRoleBindingResourceDecorator(name,\n                    rbName,\n                    null, // todo: should namespace be providable via config?\n                    roleBinding.labels(),\n                    new RoleRef(roleName, clusterWide),\n                    subjects.toArray(new Subject[0])));\n        }\n\n        // Add cluster role bindings from extensions\n        Targetable.filteredByTarget(clusterRoleBindingsFromExtensions, target)\n                .map(rb -> new AddClusterRoleBindingResourceDecorator(name,\n                        Strings.isNotNullOrEmpty(rb.getName()) ? rb.getName() : name + \"-\" + rb.getRoleRef().getName(),\n                        rb.getLabels(),\n                        rb.getRoleRef(),\n                        rb.getSubjects()))","sourceCodeStart":443,"sourceCodeEnd":479,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/BaseKubeProcessor.java#L443-L479","documentation":"When processing quarkus.kubernetes.rbac.role-bindings config, BaseKubeProcessor computes roleName from roleBinding.roleName() or a defaultRoleName derived elsewhere (e.g. the linked role config). If both are absent, the RoleBinding would have no role reference, which is invalid, so it throws IllegalStateException.","triggerScenarios":"Declaring an entry under quarkus.kubernetes.rbac.role-bindings.<key> without setting .role-name (or the role-name mapping to another role entry) so that neither the explicit roleName nor defaultRoleName is available.","commonSituations":"Defining a role-binding but forgetting to set its .role-name; typo in the role-name key; removing a quarkus.kubernetes.rbac.roles entry that previously provided the default role name while keeping the binding.","solutions":["Set quarkus.kubernetes.rbac.role-bindings.<name>.role-name=my-role","Or add a matching entry under quarkus.kubernetes.rbac.roles so defaultRoleName can be derived","Check spelling of the role-name property key","Ensure the referenced role config wasn't deleted in a refactor"],"exampleFix":"# before\nquarkus.kubernetes.rbac.role-bindings.my-binding.subjects.viewer.api-groups=\"\"\n# after\nquarkus.kubernetes.rbac.role-bindings.my-binding.role-name=view\nquarkus.kubernetes.rbac.role-bindings.my-binding.subjects.viewer.api-groups=\"\"","handlingStrategy":"validation","validationCode":"// check each role-binding has role-name or a matching role entry\nroleBindings.forEach((k, v) -> { if (v.roleName == null && defaultRoleName == null) fail(\"role-bindings.\" + k + \".role-name missing\"); });","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set .role-name on each quarkus.kubernetes.rbac.role-bindings entry","Keep the referenced quarkus.kubernetes.rbac.roles entry present","Review RBAC config after refactors/removals"],"tags":["kubernetes","rbac","rolebinding","config"],"backgroundTag":"missing-rbac-role","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}