unkin-agent
8ec8bbda8e
The Authentik API token used by estate automation was created by hand in the UI and pasted into Vault, so it was undocumented, unauditable and impossible to rotate reproducibly. Model it as config instead. Add a service_accounts config kind, discovered from config/service_accounts/ like the other kinds. Each entry creates a service_account user, an RBAC role carrying its global permissions, its API tokens, and (optionally) a kv-v2 write publishing each token key. Add sa-agent-api granting view_outpost, view_token and view_token_key, with a non-expiring api token agent-api-token published to kv/service/authentik/agent-api-token.
1.2 KiB
1.2 KiB
terraform-authentik
Terraform configuration for managing the Authentik identity provider at identity.unkin.net.
Managed Resources
- Groups — roles and group hierarchy (users are invited manually)
- SAML providers — SAML application integrations
- OAuth2/OIDC providers — OAuth2 and OpenID Connect integrations
- LDAP providers — LDAP provider and outpost configuration
- Applications — application definitions linked to providers
- Service accounts — machine identities with RBAC roles and API tokens (keys published to Vault kv)
Configuration
Resources are defined as YAML files under config/:
config/
├── groups/ # Group definitions
├── providers_saml/ # SAML provider definitions
├── providers_oauth2/ # OAuth2/OIDC provider definitions
├── providers_ldap/ # LDAP provider definitions
└── service_accounts/ # Automation service accounts + API tokens
Usage
make plan # init + plan
make apply # init + plan + apply
make format # format all .tf and .hcl files
Authentication
Set VAULT_ROLEID for local AppRole auth, or VAULT_AUTH_METHOD=kubernetes for CI.