unkin/terraform-authentik
4
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Add Rancher OAuth2/OIDC provider #6

Merged
benvin merged 1 commits from benvin/rancher-oidc into main 2026-07-16 22:23:34 +10:00
Conversation 0 Commits 1 Files Changed 1
+18
unkinben commented 2026-07-15 20:59:39 +10:00
Owner
Copy Link
Copy Source

Why

Extends Authentik SSO to Rancher (rancher.k8s.syd1.au.unkin.net) so cluster access uses Authentik identity + groups instead of local Rancher users. Part of the ongoing Authentik onboarding.

Change

  • Add config/providers_oauth2/rancher.yaml: confidential OAuth2 provider + application (slug rancher), openid/email/profile scopes, and the /verify-auth redirect URI (Rancher's OIDC/Keycloak callback).
  • Client secret read from Vault at kv/kubernetes/namespace/cattle-system/default/oauth-credentials (seeded out of band) — matches the grafana/argocd pattern.

Validation

terragrunt run --all plan: 2 to add (provider + application), 0 to change.

Follow-up

Rancher-side enablement (AuthConfig oidc) is a separate step — Rancher needs a one-time verify-auth login to activate the provider. Tracked separately.

## Why Extends Authentik SSO to Rancher (rancher.k8s.syd1.au.unkin.net) so cluster access uses Authentik identity + groups instead of local Rancher users. Part of the ongoing Authentik onboarding. ## Change - Add `config/providers_oauth2/rancher.yaml`: confidential OAuth2 provider + application (slug `rancher`), openid/email/profile scopes, and the `/verify-auth` redirect URI (Rancher's OIDC/Keycloak callback). - Client secret read from Vault at `kv/kubernetes/namespace/cattle-system/default/oauth-credentials` (seeded out of band) — matches the grafana/argocd pattern. ## Validation `terragrunt run --all plan`: 2 to add (provider + application), 0 to change. ## Follow-up Rancher-side enablement (AuthConfig `oidc`) is a separate step — Rancher needs a one-time verify-auth login to activate the provider. Tracked separately.
unkinben added 1 commit 2026-07-15 20:59:39 +10:00
Add Rancher OAuth2/OIDC provider
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
58e17d5ae8 
Extends Authentik SSO to Rancher (rancher.k8s.syd1.au.unkin.net) so cluster
access uses Authentik identity and groups.

- Add config/providers_oauth2/rancher.yaml: confidential OAuth2 provider +
  application (slug rancher), openid/email/profile scopes, /verify-auth
  redirect (Rancher's OIDC callback). client_secret read from Vault at
  kv/kubernetes/namespace/cattle-system/default/oauth-credentials.
benvin merged commit 55ba291531 into main 2026-07-16 22:23:34 +10:00
benvin deleted branch benvin/rancher-oidc 2026-07-16 22:23:35 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#6
Delete Branch "benvin/rancher-oidc"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?