quarkusio/quarkus · error · IllegalStateException

No subjects have been set in the ClusterRoleBinding resource

Error message

No subjects have been set in the ClusterRoleBinding resource!

What it means

When processing quarkus.kubernetes.rbac.cluster-role-bindings config, BaseKubeProcessor requires at least one subject: a ClusterRoleBinding that binds a role to nobody is meaningless and invalid. If clusterRoleBinding.subjects() is empty it throws IllegalStateException before iterating subjects.

Source

Thrown at extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/BaseKubeProcessor.java:489

        }

        // Add cluster role bindings from extensions
        Targetable.filteredByTarget(clusterRoleBindingsFromExtensions, target)
                .map(rb -> new AddClusterRoleBindingResourceDecorator(name,
                        Strings.isNotNullOrEmpty(rb.getName()) ? rb.getName() : name + "-" + rb.getRoleRef().getName(),
                        rb.getLabels(),
                        rb.getRoleRef(),
                        rb.getSubjects()))
                .forEach(context::add);

        // Add cluster role bindings from configuration
        for (Map.Entry<String, RbacConfig.ClusterRoleBindingConfig> rb : config.rbac().clusterRoleBindings().entrySet()) {
            String rbName = rb.getValue().name().orElse(rb.getKey());
            RbacConfig.ClusterRoleBindingConfig clusterRoleBinding = rb.getValue();

            List<Subject> subjects = new ArrayList<>();
            if (clusterRoleBinding.subjects().isEmpty()) {
                throw new IllegalStateException("No subjects have been set in the ClusterRoleBinding resource!");
            }

            for (Map.Entry<String, RbacConfig.SubjectConfig> s : clusterRoleBinding.subjects().entrySet()) {
                String subjectName = s.getValue().name().orElse(s.getKey());
                RbacConfig.SubjectConfig subject = s.getValue();
                subjects.add(new Subject(subject.apiGroup().orElse(null),
                        subject.kind(),
                        subjectName,
                        subject.namespace().orElse(null)));
            }

            context.add(new AddClusterRoleBindingResourceDecorator(name,
                    rbName,
                    clusterRoleBinding.labels(),
                    new RoleRef(clusterRoleBinding.roleName(), true),
                    subjects.toArray(new Subject[0])));
        }

View on GitHub (pinned to e1c734241f)

Solutions

1. Add at least one subject: quarkus.kubernetes.rbac.cluster-role-bindings.<name>.subjects.<subject>.kind=ServiceAccount (plus name/api-groups as needed)
2. Check subject entries are spelled and nested under the correct binding key
3. Remove the cluster-role-binding entry if it's not actually used
4. Validate the generated application.properties structure against the RbacConfig mapping

Example fix

# before
quarkus.kubernetes.rbac.cluster-role-bindings.my-crb.role-name=cluster-admin
# after
quarkus.kubernetes.rbac.cluster-role-bindings.my-crb.role-name=cluster-admin
quarkus.kubernetes.rbac.cluster-role-bindings.my-crb.subjects.my-sa.kind=ServiceAccount

clusterRoleBindings.forEach((k, v) -> { if (v.subjects.isEmpty()) fail("cluster-role-bindings." + k + " needs at least one subject"); });

When it happens

Trigger: Declaring quarkus.kubernetes.rbac.cluster-role-bindings.<name> without any quarkus.kubernetes.rbac.cluster-role-bindings.<name>.subjects.<subject>.* entries (empty subjects map).

Common situations: Creating a cluster-role-binding key in config as a placeholder and forgetting to add subjects; subjects removed during cleanup; indentation/typos so the subject entries don't parse under the binding key.

Related errors

• No role has been set in the RoleBinding resource!
• '%s' env var can't simultaneously take its value from '%s' c
• '%s' env var can't simultaneously have a '%s' value & take i
• When generating a CronJob resource, you need to specify a sc
• No effective service account found for application

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/26c67ba0e62e6e58. Report an issue: GitHub.