Ben Vincent
c69b27826d
Terraform provider (plugin-framework) for the vault-plugin-secrets-rancher secrets engine, modeled on terraform-provider-litellmvaultsecret. Resources: - rancher_secret_backend: mount the engine + write config (rancher_url, ca_cert, tls_skip_verify, request_timeout_seconds). - rancher_secret_backend_service_account: seed an auto-rotated Rancher token (write-only token; token_ttl / rotation_period; computed token_name, last_rotated). - rancher_secret_backend_role: minting role (service_account, cluster_name, ttl, max_ttl, description). Source address git.unkin.net/unkin/ranchervaultsecret, resources prefixed rancher_. Ports the litellm Woodpecker terraform-registry release + nfpm-less zip packaging, examples, and a provider e2e (Vault + mock Rancher from the sibling plugin repo). Unit tests cover the coercion/import-ID helpers.
17 lines
702 B
Terraform
17 lines
702 B
Terraform
# A role that mints short-lived tokens scoped to one downstream cluster. Reading
|
|
# rancher/creds/ci returns a lease-bound token deleted from Rancher on revoke.
|
|
#
|
|
# Note: Rancher tokens inherit the service account user's RBAC; only cluster and
|
|
# TTL are scoped per-token. For least-privilege, point roles at a service account
|
|
# seeded with a purpose-built, limited Rancher user.
|
|
resource "rancher_secret_backend_role" "ci" {
|
|
backend = rancher_secret_backend.rancher.path
|
|
service_account = rancher_secret_backend_service_account.admin.name
|
|
|
|
name = "ci"
|
|
cluster_name = "c-m-abc123"
|
|
description = "CI/CD ephemeral token"
|
|
ttl = 3600 # 1h
|
|
max_ttl = 28800 # 8h
|
|
}
|