Ben Vincent
c69b27826d
Terraform provider (plugin-framework) for the vault-plugin-secrets-rancher secrets engine, modeled on terraform-provider-litellmvaultsecret. Resources: - rancher_secret_backend: mount the engine + write config (rancher_url, ca_cert, tls_skip_verify, request_timeout_seconds). - rancher_secret_backend_service_account: seed an auto-rotated Rancher token (write-only token; token_ttl / rotation_period; computed token_name, last_rotated). - rancher_secret_backend_role: minting role (service_account, cluster_name, ttl, max_ttl, description). Source address git.unkin.net/unkin/ranchervaultsecret, resources prefixed rancher_. Ports the litellm Woodpecker terraform-registry release + nfpm-less zip packaging, examples, and a provider e2e (Vault + mock Rancher from the sibling plugin repo). Unit tests cover the coercion/import-ID helpers.
27 lines
812 B
Terraform
27 lines
812 B
Terraform
# Seed a Rancher token the engine will auto-rotate. Rancher caps token TTLs
|
|
# (commonly 90d); the engine rotates at rotation_period (default 45d) by minting
|
|
# a fresh token with the current one, so the credential never lapses.
|
|
resource "rancher_secret_backend_service_account" "admin" {
|
|
backend = rancher_secret_backend.rancher.path
|
|
name = "admin"
|
|
|
|
# The initial token. Write-only: the engine rotates it from here on.
|
|
token = var.rancher_seed_token
|
|
|
|
# metadata.name of the seed token, so the first rotation can delete it.
|
|
token_name = var.rancher_seed_token_name
|
|
|
|
token_ttl = 90 * 24 * 3600 # 90d
|
|
rotation_period = 45 * 24 * 3600 # 45d
|
|
}
|
|
|
|
variable "rancher_seed_token" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
variable "rancher_seed_token_name" {
|
|
type = string
|
|
default = ""
|
|
}
|