kubernetes.clusterrolebinding.ensure

Create or replace a ClusterRoleBinding (cluster-scoped). role_ref is immutable; existing binding with different role_ref is deleted and recreated.

Create or replace a ClusterRoleBinding (cluster-scoped). role_ref is immutable; an existing binding with a different role_ref is deleted and recreated.

Inputs:

• connection_uuid: Cloud connection UUID (required)
• name: ClusterRoleBinding name (required, cluster-scoped — no namespace)
• role_ref: JSON dict {kind, name, apiGroup} (required). Typically {kind: "ClusterRole", name: "<role>", apiGroup: "rbac.authorization.k8s.io"}.
• subjects: JSON list of {kind, name, namespace?, apiGroup?} (required)

Outputs:

• existed: True if a binding already existed under that name.
• recreated: True if the existing binding was deleted+recreated because its role_ref differed from the requested one.

Plugin required: context.get_plugin("connection").kubernetes_runner_clients(connection_uuid, organization_uuid) must expose rbac_authorization_v1 (RbacAuthorizationV1Api) with read_cluster_role_binding, patch_cluster_role_binding, delete_cluster_role_binding, and create_cluster_role_binding.

Overview

Property	Value
Workflow type	Atomic
Library	App-kubernetes
Version	1.0

Input Schema

Field	Type	Required	Default	Description
connection_uuid	uuid	Yes	—	—
name	string	Yes	—	—
role_ref	json	Yes	—	—
subjects	json	Yes	—	—
organization_uuid	uuid	No	—	—

Output Schema

Field	Type	Required	Default	Description
connection_uuid	uuid	No	—	—
organization_uuid	uuid	No	—	—
name	string	No	—	—
role_ref	json	No	—	—
subjects	json	No	—	—
existed	boolean	No	—	—
recreated	boolean	No	—	—
failure_reason	string	No	—	—
failure_type	string	No	—	—
failed_action	string	No	—	—
failed_at_state	string	No	—	—
failed_step	string	No	—	—
failed_layer	string	No	—	—
error	string	No	—	—
error_type	string	No	—	—

States

State	Initial	Terminal	Success	Auto-advance	Description
pending	Yes	No	—	execute	—
completed	No	Yes	Yes	—	—
failed	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
pending	execute	completed	—
* (any state)	fail	failed	—

API Usage

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "kubernetes.clusterrolebinding.ensure",
  "initial_data": {
    "connection_uuid": "value",
    "name": "value",
    "role_ref": "value",
    "subjects": "value"
  }
}