quarkusio/quarkus · error · IllegalStateException

No role has been set in the RoleBinding resource!

Error message

No role has been set in the RoleBinding resource!

What it means

When processing quarkus.kubernetes.rbac.role-bindings config, BaseKubeProcessor computes roleName from roleBinding.roleName() or a defaultRoleName derived elsewhere (e.g. the linked role config). If both are absent, the RoleBinding would have no role reference, which is invalid, so it throws IllegalStateException.

Source

Thrown at extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/BaseKubeProcessor.java:461

            if (roleBinding.subjects().isEmpty()) {
                requiresServiceAccount = true;
                subjects.add(new Subject(null, SERVICE_ACCOUNT,
                        effectiveServiceAccountName,
                        effectiveServiceAccountNamespace));
            } else {
                for (Map.Entry<String, RbacConfig.SubjectConfig> s : roleBinding.subjects().entrySet()) {
                    String subjectName = s.getValue().name().orElse(s.getKey());
                    RbacConfig.SubjectConfig subject = s.getValue();
                    subjects.add(new Subject(subject.apiGroup().orElse(null),
                            subject.kind(),
                            subjectName,
                            subject.namespace().orElse(null)));
                }
            }

            String roleName = roleBinding.roleName().orElse(defaultRoleName);
            if (roleName == null) {
                throw new IllegalStateException("No role has been set in the RoleBinding resource!");
            }

            boolean clusterWide = roleBinding.clusterWide().orElse(defaultClusterWide);
            context.add(new AddRoleBindingResourceDecorator(name,
                    rbName,
                    null, // todo: should namespace be providable via config?
                    roleBinding.labels(),
                    new RoleRef(roleName, clusterWide),
                    subjects.toArray(new Subject[0])));
        }

        // Add cluster role bindings from extensions
        Targetable.filteredByTarget(clusterRoleBindingsFromExtensions, target)
                .map(rb -> new AddClusterRoleBindingResourceDecorator(name,
                        Strings.isNotNullOrEmpty(rb.getName()) ? rb.getName() : name + "-" + rb.getRoleRef().getName(),
                        rb.getLabels(),
                        rb.getRoleRef(),
                        rb.getSubjects()))

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.kubernetes.rbac.role-bindings.<name>.role-name=my-role
2. Or add a matching entry under quarkus.kubernetes.rbac.roles so defaultRoleName can be derived
3. Check spelling of the role-name property key
4. Ensure the referenced role config wasn't deleted in a refactor

Example fix

# before
quarkus.kubernetes.rbac.role-bindings.my-binding.subjects.viewer.api-groups=""
# after
quarkus.kubernetes.rbac.role-bindings.my-binding.role-name=view
quarkus.kubernetes.rbac.role-bindings.my-binding.subjects.viewer.api-groups=""

// check each role-binding has role-name or a matching role entry
roleBindings.forEach((k, v) -> { if (v.roleName == null && defaultRoleName == null) fail("role-bindings." + k + ".role-name missing"); });

When it happens

Trigger: Declaring an entry under quarkus.kubernetes.rbac.role-bindings.<key> without setting .role-name (or the role-name mapping to another role entry) so that neither the explicit roleName nor defaultRoleName is available.

Common situations: Defining a role-binding but forgetting to set its .role-name; typo in the role-name key; removing a quarkus.kubernetes.rbac.roles entry that previously provided the default role name while keeping the binding.

Related errors

• No subjects have been set in the ClusterRoleBinding resource
• '%s' env var can't simultaneously take its value from '%s' c
• '%s' env var can't simultaneously have a '%s' value & take i
• When generating a CronJob resource, you need to specify a sc
• No effective service account found for application

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/dbf482a530ae9308. Report an issue: GitHub.