modules/rancher/main.tf

@@ -29,7 +29,10 @@ resource "rancher2_auth_config_keycloak_oidc" "this" {
 resource "rancher2_global_role_binding" "group" {
   for_each = var.global_role_bindings
 
-  name               = "akgroup-${each.key}"
+  # Binding name must be an RFC 1123 label (lowercase); the group name may be
+  # mixed-case (akP-*), so lowercase it here. The principal id keeps the original
+  # case to match the group.
+  name               = "akgroup-${lower(each.key)}"
   global_role_id     = each.value.global_role_id
   group_principal_id = "keycloakoidc_group://${each.key}"