From f2f41fc1c051a6aeb1dbcbcab482ecb785b3803d Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sat, 18 Jul 2026 22:55:38 +1000
Subject: [PATCH] Fix global role binding name to be RFC 1123 compliant

rancher2_global_role_binding.name must be a lowercase RFC 1123 label, but the
akP-* group keys are mixed-case, so apply failed with InvalidFormat 422.
Lowercase the name; keep the group principal id in original case to match the
Authentik group.
---
 modules/rancher/main.tf | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/modules/rancher/main.tf b/modules/rancher/main.tf
index d28e8ac..77a74d7 100644
--- a/modules/rancher/main.tf
+++ b/modules/rancher/main.tf
@@ -29,7 +29,10 @@ resource "rancher2_auth_config_keycloak_oidc" "this" {
 resource "rancher2_global_role_binding" "group" {
   for_each = var.global_role_bindings
 
-  name               = "akgroup-${each.key}"
+  # Binding name must be an RFC 1123 label (lowercase); the group name may be
+  # mixed-case (akP-*), so lowercase it here. The principal id keeps the original
+  # case to match the group.
+  name               = "akgroup-${lower(each.key)}"
   global_role_id     = each.value.global_role_id
   group_principal_id = "keycloakoidc_group://${each.key}"