diff --git a/lib/services/role.go b/lib/services/role.go
index <HASH>..<HASH> 100644
--- a/lib/services/role.go
+++ b/lib/services/role.go
@@ -2204,6 +2204,13 @@ const RoleSpecV3SchemaDefinitions = `
 			  "^[a-zA-Z/.0-9_*-]+$": {"anyOf": [{"type": "string"}, {"type": "array", "items": {"type": "string"}}]}
 			}
 		  },
+		  "kubernetes_labels": {
+			"type": "object",
+			"additionalProperties": false,
+			"patternProperties": {
+			  "^[a-zA-Z/.0-9_*-]+$": {"anyOf": [{"type": "string"}, {"type": "array", "items": {"type": "string"}}]}
+			}
+		  },
 		  "db_names": {
 			"type": "array",
 			"items": {"type": "string"}
kube: add kubernetes_labels to role JSON schema

The schema entry for `kubernetes_labels` was missing, causing them to be
stripped on `tctl create role.yaml`.