kubernetes.rolebinding.ensure

Create or replace a namespaced Kubernetes RoleBinding (role_ref is immutable; existing binding with different role_ref is deleted and recreated)

Creates a namespaced Kubernetes RoleBinding; if the binding already exists and the role_ref matches, only the subjects list is patched. If the existing role_ref differs (immutable field), the binding is deleted and recreated — the output field recreated is set to True in that case.

Inputs:

• connection_uuid: Cloud connection UUID (required)
• namespace: Target namespace (required)
• name: RoleBinding name (required)
• role_ref: Dict with keys kind (Role|ClusterRole), name, and api_group (typically rbac.authorization.k8s.io) — required.
• subjects: List of subject dicts. Each entry must have kind (User|Group|ServiceAccount) and name; namespace and api_group are optional — required.

Outputs:

• existed: True if the binding already existed before this call.
• recreated: True if the binding was deleted and recreated because the existing role_ref did not match the requested one.

Plugin required: context.get_plugin("connection").kubernetes_runner_clients(connection_uuid, organization_uuid) must expose rbac_authorization_v1 (RbacAuthorizationV1Api) with methods read_namespaced_role_binding, patch_namespaced_role_binding, delete_namespaced_role_binding, and create_namespaced_role_binding.

Overview

Property	Value
Workflow type	Atomic
Library	App-kubernetes
Version	1.0

Input Schema

Field	Type	Required	Default	Description
connection_uuid	uuid	Yes	—	—
namespace	string	Yes	—	—
name	string	Yes	—	—
role_ref	json	Yes	—	—
subjects	json	Yes	—	—
organization_uuid	uuid	No	—	—

Output Schema

Field	Type	Required	Default	Description
connection_uuid	uuid	No	—	—
organization_uuid	uuid	No	—	—
namespace	string	No	—	—
name	string	No	—	—
role_ref	json	No	—	—
subjects	json	No	—	—
existed	boolean	No	—	—
recreated	boolean	No	—	—
failure_reason	string	No	—	—
failure_type	string	No	—	—
failed_action	string	No	—	—
failed_at_state	string	No	—	—
failed_step	string	No	—	—
failed_layer	string	No	—	—
error	string	No	—	—
error_type	string	No	—	—

States

State	Initial	Terminal	Success	Auto-advance	Description
pending	Yes	No	—	execute	—
completed	No	Yes	Yes	—	—
failed	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
pending	execute	completed	—
* (any state)	fail	failed	—

API Usage

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "kubernetes.rolebinding.ensure",
  "initial_data": {
    "connection_uuid": "value",
    "namespace": "value",
    "name": "value",
    "role_ref": "value"
  }
}