Ben Vincent
c69b27826d
Terraform provider (plugin-framework) for the vault-plugin-secrets-rancher secrets engine, modeled on terraform-provider-litellmvaultsecret. Resources: - rancher_secret_backend: mount the engine + write config (rancher_url, ca_cert, tls_skip_verify, request_timeout_seconds). - rancher_secret_backend_service_account: seed an auto-rotated Rancher token (write-only token; token_ttl / rotation_period; computed token_name, last_rotated). - rancher_secret_backend_role: minting role (service_account, cluster_name, ttl, max_ttl, description). Source address git.unkin.net/unkin/ranchervaultsecret, resources prefixed rancher_. Ports the litellm Woodpecker terraform-registry release + nfpm-less zip packaging, examples, and a provider e2e (Vault + mock Rancher from the sibling plugin repo). Unit tests cover the coercion/import-ID helpers.
2.3 KiB
2.3 KiB
terraform-provider-ranchervaultsecret
Terraform provider for the vault-plugin-secrets-rancher secrets engine. It manages the engine's configuration on HashiCorp Vault or OpenBao — mounting it, seeding auto-rotated service-account tokens, and defining token-minting roles.
The provider's source address is git.unkin.net/unkin/ranchervaultsecret; its
resources are prefixed rancher_ (declare it under the local name rancher in
required_providers).
Resources
| Resource | Manages |
|---|---|
rancher_secret_backend |
Mounts the engine and writes config (Rancher URL, CA, TLS). |
rancher_secret_backend_service_account |
A seeded, auto-rotated Rancher token (token, token_ttl, rotation_period). |
rancher_secret_backend_role |
A minting role (service_account, cluster_name, ttl, max_ttl, description). |
Example
provider "rancher" {} # address/token from VAULT_ADDR / VAULT_TOKEN
resource "rancher_secret_backend" "rancher" {
path = "rancher"
rancher_url = "https://rancher.example.com"
ca_cert = file("rancher-ca.pem")
}
resource "rancher_secret_backend_service_account" "admin" {
backend = rancher_secret_backend.rancher.path
name = "admin"
token = var.rancher_seed_token
token_ttl = 90 * 24 * 3600
rotation_period = 45 * 24 * 3600
}
resource "rancher_secret_backend_role" "ci" {
backend = rancher_secret_backend.rancher.path
name = "ci"
service_account = rancher_secret_backend_service_account.admin.name
cluster_name = "c-m-abc123"
ttl = 3600
max_ttl = 28800
}
Then mint a token: vault read rancher/creds/ci.
Development
make build # build the provider binary
make install # install into ~/.terraform.d/plugins for local dev_overrides
make test # unit tests
make e2e # apply real terraform against Vault + the plugin + mock Rancher
make package # zip for the artifactapi terraform registry
Releases are tag-driven (make patch|minor|major): a Woodpecker pipeline zips
the provider and uploads it to the internal artifactapi terraform registry,
installable via source = "git.unkin.net/unkin/ranchervaultsecret".