From ed551f682611afeb030ae57a9f650f68af8f6413 Mon Sep 17 00:00:00 2001
From: pranshul gupta <pranshulg01@gmail.com>
Date: Wed, 18 Feb 2026 13:41:39 +0530
Subject: [PATCH 1/3] KAL:enforce optionalorrequired on rbac API group

# Conflicts:
#	hack/golangci-hints.yaml
#	hack/golangci.yaml
#	hack/kube-api-linter/exceptions.yaml
---
 hack/golangci-hints.yaml                             | 2 +-
 hack/golangci.yaml                                   | 2 +-
 hack/kube-api-linter/exceptions.yaml                 | 2 +-
 staging/src/k8s.io/api/rbac/v1/generated.proto       | 3 +++
 staging/src/k8s.io/api/rbac/v1/types.go              | 3 +++
 staging/src/k8s.io/api/rbac/v1alpha1/generated.proto | 3 +++
 staging/src/k8s.io/api/rbac/v1alpha1/types.go        | 3 +++
 staging/src/k8s.io/api/rbac/v1beta1/generated.proto  | 3 +++
 staging/src/k8s.io/api/rbac/v1beta1/types.go         | 3 +++
 9 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/hack/golangci-hints.yaml b/hack/golangci-hints.yaml
index 0798ad1eb98..ce57dc3bbd8 100644
--- a/hack/golangci-hints.yaml
+++ b/hack/golangci-hints.yaml
@@ -215,7 +215,7 @@ linters:
       # OptionalOrRequired is being enabled over time. For now, each API group should be added to this list until we comb through each group and fix the missing tags.
       # The nonpointerstructs linter is included here as well as these two should be enabled hand-in-hand on each API group.
       - text: "must be marked as optional or required|is a non-pointer struct with no required fields."
-        path: "staging/src/k8s.io/api/(admission|apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|rbac|resource|storage)"
+        path: "staging/src/k8s.io/api/(admission|apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|resource|storage)"
       
       # OptionalOrRequired - Existing fields that are marked as both optional and required (based on standard optional vs kubebuilder:validation:Required) and should not be fixed.
       - text: "field (PortStatus|IngressPortStatus)\\.Error must not be marked as both optional and required"
diff --git a/hack/golangci.yaml b/hack/golangci.yaml
index 93e0dabb604..0575ac5d07b 100644
--- a/hack/golangci.yaml
+++ b/hack/golangci.yaml
@@ -230,7 +230,7 @@ linters:
       # OptionalOrRequired is being enabled over time. For now, each API group should be added to this list until we comb through each group and fix the missing tags.
       # The nonpointerstructs linter is included here as well as these two should be enabled hand-in-hand on each API group.
       - text: "must be marked as optional or required|is a non-pointer struct with no required fields."
-        path: "staging/src/k8s.io/api/(admission|apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|rbac|resource|storage)"
+        path: "staging/src/k8s.io/api/(admission|apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|resource|storage)"
       
       # OptionalOrRequired - Existing fields that are marked as both optional and required (based on standard optional vs kubebuilder:validation:Required) and should not be fixed.
       - text: "field (PortStatus|IngressPortStatus)\\.Error must not be marked as both optional and required"
diff --git a/hack/kube-api-linter/exceptions.yaml b/hack/kube-api-linter/exceptions.yaml
index b0b363f441f..9b26b4abf20 100644
--- a/hack/kube-api-linter/exceptions.yaml
+++ b/hack/kube-api-linter/exceptions.yaml
@@ -91,7 +91,7 @@
 # OptionalOrRequired is being enabled over time. For now, each API group should be added to this list until we comb through each group and fix the missing tags.
 # The nonpointerstructs linter is included here as well as these two should be enabled hand-in-hand on each API group.
 - text: "must be marked as optional or required|is a non-pointer struct with no required fields."
-  path: "staging/src/k8s.io/api/(admission|apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|rbac|resource|storage)"
+  path: "staging/src/k8s.io/api/(admission|apidiscovery|apps|authorization|autoscaling|batch|certificates|core|discovery|events|extensions|flowcontrol|networking|resource|storage)"
 
 # OptionalOrRequired - Existing fields that are marked as both optional and required (based on standard optional vs kubebuilder:validation:Required) and should not be fixed.
 - text: "field (PortStatus|IngressPortStatus)\\.Error must not be marked as both optional and required"
diff --git a/staging/src/k8s.io/api/rbac/v1/generated.proto b/staging/src/k8s.io/api/rbac/v1/generated.proto
index 8e09133cc79..a612cd5cc84 100644
--- a/staging/src/k8s.io/api/rbac/v1/generated.proto
+++ b/staging/src/k8s.io/api/rbac/v1/generated.proto
@@ -183,9 +183,11 @@ message RoleList {
 // +structType=atomic
 message RoleRef {
   // APIGroup is the group for the resource being referenced
+  // +required
   optional string apiGroup = 1;
 
   // Kind is the type of resource being referenced
+  // +required
   optional string kind = 2;
 
   // Name is the name of resource being referenced
@@ -200,6 +202,7 @@ message RoleRef {
 message Subject {
   // Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
   // If the Authorizer does not recognized the kind value, the Authorizer should report an error.
+  // +required
   optional string kind = 1;
 
   // APIGroup holds the API group of the referenced subject.
diff --git a/staging/src/k8s.io/api/rbac/v1/types.go b/staging/src/k8s.io/api/rbac/v1/types.go
index df3793e30d5..a980bb8be5e 100644
--- a/staging/src/k8s.io/api/rbac/v1/types.go
+++ b/staging/src/k8s.io/api/rbac/v1/types.go
@@ -81,6 +81,7 @@ type PolicyRule struct {
 type Subject struct {
 	// Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
 	// If the Authorizer does not recognized the kind value, the Authorizer should report an error.
+	// +required
 	Kind string `json:"kind" protobuf:"bytes,1,opt,name=kind"`
 	// APIGroup holds the API group of the referenced subject.
 	// Defaults to "" for ServiceAccount subjects.
@@ -101,8 +102,10 @@ type Subject struct {
 // +structType=atomic
 type RoleRef struct {
 	// APIGroup is the group for the resource being referenced
+	// +required
 	APIGroup string `json:"apiGroup" protobuf:"bytes,1,opt,name=apiGroup"`
 	// Kind is the type of resource being referenced
+	// +required
 	Kind string `json:"kind" protobuf:"bytes,2,opt,name=kind"`
 	// Name is the name of resource being referenced
 	// +required
diff --git a/staging/src/k8s.io/api/rbac/v1alpha1/generated.proto b/staging/src/k8s.io/api/rbac/v1alpha1/generated.proto
index 6f38ee1004b..82ed64df507 100644
--- a/staging/src/k8s.io/api/rbac/v1alpha1/generated.proto
+++ b/staging/src/k8s.io/api/rbac/v1alpha1/generated.proto
@@ -188,9 +188,11 @@ message RoleList {
 // RoleRef contains information that points to the role being used
 message RoleRef {
   // APIGroup is the group for the resource being referenced
+  // +required
   optional string apiGroup = 1;
 
   // Kind is the type of resource being referenced
+  // +required
   optional string kind = 2;
 
   // Name is the name of resource being referenced
@@ -204,6 +206,7 @@ message RoleRef {
 message Subject {
   // Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
   // If the Authorizer does not recognized the kind value, the Authorizer should report an error.
+  // +required
   optional string kind = 1;
 
   // APIVersion holds the API group and version of the referenced subject.
diff --git a/staging/src/k8s.io/api/rbac/v1alpha1/types.go b/staging/src/k8s.io/api/rbac/v1alpha1/types.go
index 6e28ee8301c..8075513cb50 100644
--- a/staging/src/k8s.io/api/rbac/v1alpha1/types.go
+++ b/staging/src/k8s.io/api/rbac/v1alpha1/types.go
@@ -80,6 +80,7 @@ type PolicyRule struct {
 type Subject struct {
 	// Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
 	// If the Authorizer does not recognized the kind value, the Authorizer should report an error.
+	// +required
 	Kind string `json:"kind" protobuf:"bytes,1,opt,name=kind"`
 	// APIVersion holds the API group and version of the referenced subject.
 	// Defaults to "v1" for ServiceAccount subjects.
@@ -100,8 +101,10 @@ type Subject struct {
 // RoleRef contains information that points to the role being used
 type RoleRef struct {
 	// APIGroup is the group for the resource being referenced
+	// +required
 	APIGroup string `json:"apiGroup" protobuf:"bytes,1,opt,name=apiGroup"`
 	// Kind is the type of resource being referenced
+	// +required
 	Kind string `json:"kind" protobuf:"bytes,2,opt,name=kind"`
 	// Name is the name of resource being referenced
 	// +required
diff --git a/staging/src/k8s.io/api/rbac/v1beta1/generated.proto b/staging/src/k8s.io/api/rbac/v1beta1/generated.proto
index 003036c58ec..7858ee3016e 100644
--- a/staging/src/k8s.io/api/rbac/v1beta1/generated.proto
+++ b/staging/src/k8s.io/api/rbac/v1beta1/generated.proto
@@ -189,9 +189,11 @@ message RoleList {
 // RoleRef contains information that points to the role being used
 message RoleRef {
   // APIGroup is the group for the resource being referenced
+  // +required
   optional string apiGroup = 1;
 
   // Kind is the type of resource being referenced
+  // +required
   optional string kind = 2;
 
   // Name is the name of resource being referenced
@@ -205,6 +207,7 @@ message RoleRef {
 message Subject {
   // Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
   // If the Authorizer does not recognized the kind value, the Authorizer should report an error.
+  // +required
   optional string kind = 1;
 
   // APIGroup holds the API group of the referenced subject.
diff --git a/staging/src/k8s.io/api/rbac/v1beta1/types.go b/staging/src/k8s.io/api/rbac/v1beta1/types.go
index 95030c15c38..4263b54902d 100644
--- a/staging/src/k8s.io/api/rbac/v1beta1/types.go
+++ b/staging/src/k8s.io/api/rbac/v1beta1/types.go
@@ -81,6 +81,7 @@ type PolicyRule struct {
 type Subject struct {
 	// Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
 	// If the Authorizer does not recognized the kind value, the Authorizer should report an error.
+	// +required
 	Kind string `json:"kind" protobuf:"bytes,1,opt,name=kind"`
 	// APIGroup holds the API group of the referenced subject.
 	// Defaults to "" for ServiceAccount subjects.
@@ -100,8 +101,10 @@ type Subject struct {
 // RoleRef contains information that points to the role being used
 type RoleRef struct {
 	// APIGroup is the group for the resource being referenced
+	// +required
 	APIGroup string `json:"apiGroup" protobuf:"bytes,1,opt,name=apiGroup"`
 	// Kind is the type of resource being referenced
+	// +required
 	Kind string `json:"kind" protobuf:"bytes,2,opt,name=kind"`
 	// Name is the name of resource being referenced
 	// +required

From eb3252e0e0f2e28460dd03be3de589d460716be1 Mon Sep 17 00:00:00 2001
From: pranshul gupta <pranshulg01@gmail.com>
Date: Fri, 13 Feb 2026 17:04:17 +0530
Subject: [PATCH 2/3] Update the APIGroup field to be optional

---
 pkg/generated/openapi/zz_generated.openapi.go        | 6 +++---
 staging/src/k8s.io/api/rbac/v1/generated.proto       | 2 +-
 staging/src/k8s.io/api/rbac/v1/types.go              | 2 +-
 staging/src/k8s.io/api/rbac/v1alpha1/generated.proto | 2 +-
 staging/src/k8s.io/api/rbac/v1alpha1/types.go        | 2 +-
 staging/src/k8s.io/api/rbac/v1beta1/generated.proto  | 2 +-
 staging/src/k8s.io/api/rbac/v1beta1/types.go         | 2 +-
 7 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkg/generated/openapi/zz_generated.openapi.go b/pkg/generated/openapi/zz_generated.openapi.go
index 75f140e2282..d0b935bcaf2 100644
--- a/pkg/generated/openapi/zz_generated.openapi.go
+++ b/pkg/generated/openapi/zz_generated.openapi.go
@@ -44879,7 +44879,7 @@ func schema_k8sio_api_rbac_v1_RoleRef(ref common.ReferenceCallback) common.OpenA
 						},
 					},
 				},
-				Required: []string{"apiGroup", "kind", "name"},
+				Required: []string{"kind", "name"},
 			},
 			VendorExtensible: spec.VendorExtensible{
 				Extensions: spec.Extensions{
@@ -45565,7 +45565,7 @@ func schema_k8sio_api_rbac_v1alpha1_RoleRef(ref common.ReferenceCallback) common
 						},
 					},
 				},
-				Required: []string{"apiGroup", "kind", "name"},
+				Required: []string{"kind", "name"},
 			},
 		},
 	}
@@ -46241,7 +46241,7 @@ func schema_k8sio_api_rbac_v1beta1_RoleRef(ref common.ReferenceCallback) common.
 						},
 					},
 				},
-				Required: []string{"apiGroup", "kind", "name"},
+				Required: []string{"kind", "name"},
 			},
 		},
 	}
diff --git a/staging/src/k8s.io/api/rbac/v1/generated.proto b/staging/src/k8s.io/api/rbac/v1/generated.proto
index a612cd5cc84..1b4c57be17e 100644
--- a/staging/src/k8s.io/api/rbac/v1/generated.proto
+++ b/staging/src/k8s.io/api/rbac/v1/generated.proto
@@ -183,7 +183,7 @@ message RoleList {
 // +structType=atomic
 message RoleRef {
   // APIGroup is the group for the resource being referenced
-  // +required
+  // +optional
   optional string apiGroup = 1;
 
   // Kind is the type of resource being referenced
diff --git a/staging/src/k8s.io/api/rbac/v1/types.go b/staging/src/k8s.io/api/rbac/v1/types.go
index a980bb8be5e..abb9476752e 100644
--- a/staging/src/k8s.io/api/rbac/v1/types.go
+++ b/staging/src/k8s.io/api/rbac/v1/types.go
@@ -102,7 +102,7 @@ type Subject struct {
 // +structType=atomic
 type RoleRef struct {
 	// APIGroup is the group for the resource being referenced
-	// +required
+	// +optional
 	APIGroup string `json:"apiGroup" protobuf:"bytes,1,opt,name=apiGroup"`
 	// Kind is the type of resource being referenced
 	// +required
diff --git a/staging/src/k8s.io/api/rbac/v1alpha1/generated.proto b/staging/src/k8s.io/api/rbac/v1alpha1/generated.proto
index 82ed64df507..6510f0da676 100644
--- a/staging/src/k8s.io/api/rbac/v1alpha1/generated.proto
+++ b/staging/src/k8s.io/api/rbac/v1alpha1/generated.proto
@@ -188,7 +188,7 @@ message RoleList {
 // RoleRef contains information that points to the role being used
 message RoleRef {
   // APIGroup is the group for the resource being referenced
-  // +required
+  // +optional
   optional string apiGroup = 1;
 
   // Kind is the type of resource being referenced
diff --git a/staging/src/k8s.io/api/rbac/v1alpha1/types.go b/staging/src/k8s.io/api/rbac/v1alpha1/types.go
index 8075513cb50..a0e87661398 100644
--- a/staging/src/k8s.io/api/rbac/v1alpha1/types.go
+++ b/staging/src/k8s.io/api/rbac/v1alpha1/types.go
@@ -101,7 +101,7 @@ type Subject struct {
 // RoleRef contains information that points to the role being used
 type RoleRef struct {
 	// APIGroup is the group for the resource being referenced
-	// +required
+	// +optional
 	APIGroup string `json:"apiGroup" protobuf:"bytes,1,opt,name=apiGroup"`
 	// Kind is the type of resource being referenced
 	// +required
diff --git a/staging/src/k8s.io/api/rbac/v1beta1/generated.proto b/staging/src/k8s.io/api/rbac/v1beta1/generated.proto
index 7858ee3016e..0590d2854bb 100644
--- a/staging/src/k8s.io/api/rbac/v1beta1/generated.proto
+++ b/staging/src/k8s.io/api/rbac/v1beta1/generated.proto
@@ -189,7 +189,7 @@ message RoleList {
 // RoleRef contains information that points to the role being used
 message RoleRef {
   // APIGroup is the group for the resource being referenced
-  // +required
+  // +optional
   optional string apiGroup = 1;
 
   // Kind is the type of resource being referenced
diff --git a/staging/src/k8s.io/api/rbac/v1beta1/types.go b/staging/src/k8s.io/api/rbac/v1beta1/types.go
index 4263b54902d..c2b468e0135 100644
--- a/staging/src/k8s.io/api/rbac/v1beta1/types.go
+++ b/staging/src/k8s.io/api/rbac/v1beta1/types.go
@@ -101,7 +101,7 @@ type Subject struct {
 // RoleRef contains information that points to the role being used
 type RoleRef struct {
 	// APIGroup is the group for the resource being referenced
-	// +required
+	// +optional
 	APIGroup string `json:"apiGroup" protobuf:"bytes,1,opt,name=apiGroup"`
 	// Kind is the type of resource being referenced
 	// +required

From a3928d5370f95ab6ac1dfad478b013dbc14e3a53 Mon Sep 17 00:00:00 2001
From: pranshul gupta <pranshulg01@gmail.com>
Date: Fri, 13 Feb 2026 17:56:41 +0530
Subject: [PATCH 3/3] run hack/update-openapi-spec.sh

---
 api/openapi-spec/swagger.json                                    | 1 -
 .../v3/apis__rbac.authorization.k8s.io__v1_openapi.json          | 1 -
 2 files changed, 2 deletions(-)

diff --git a/api/openapi-spec/swagger.json b/api/openapi-spec/swagger.json
index b48e61e49ab..1bd757ba114 100644
--- a/api/openapi-spec/swagger.json
+++ b/api/openapi-spec/swagger.json
@@ -15279,7 +15279,6 @@
         }
       },
       "required": [
-        "apiGroup",
         "kind",
         "name"
       ],
diff --git a/api/openapi-spec/v3/apis__rbac.authorization.k8s.io__v1_openapi.json b/api/openapi-spec/v3/apis__rbac.authorization.k8s.io__v1_openapi.json
index ebba19eefbc..3bcdaf60521 100644
--- a/api/openapi-spec/v3/apis__rbac.authorization.k8s.io__v1_openapi.json
+++ b/api/openapi-spec/v3/apis__rbac.authorization.k8s.io__v1_openapi.json
@@ -478,7 +478,6 @@
           }
         },
         "required": [
-          "apiGroup",
           "kind",
           "name"
         ],