Ben Vincent
c69b27826d
Terraform provider (plugin-framework) for the vault-plugin-secrets-rancher secrets engine, modeled on terraform-provider-litellmvaultsecret. Resources: - rancher_secret_backend: mount the engine + write config (rancher_url, ca_cert, tls_skip_verify, request_timeout_seconds). - rancher_secret_backend_service_account: seed an auto-rotated Rancher token (write-only token; token_ttl / rotation_period; computed token_name, last_rotated). - rancher_secret_backend_role: minting role (service_account, cluster_name, ttl, max_ttl, description). Source address git.unkin.net/unkin/ranchervaultsecret, resources prefixed rancher_. Ports the litellm Woodpecker terraform-registry release + nfpm-less zip packaging, examples, and a provider e2e (Vault + mock Rancher from the sibling plugin repo). Unit tests cover the coercion/import-ID helpers.
41 lines
992 B
Terraform
41 lines
992 B
Terraform
terraform {
|
|
required_providers {
|
|
rancher = {
|
|
source = "git.unkin.net/unkin/ranchervaultsecret"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "rancher" {
|
|
address = "http://127.0.0.1:8200"
|
|
token = "root"
|
|
}
|
|
|
|
resource "rancher_secret_backend" "rancher" {
|
|
path = "rancher"
|
|
description = "Rancher token engine (e2e)"
|
|
# Reachable from inside the vault container, where the plugin runs.
|
|
rancher_url = "http://rancher:8443"
|
|
tls_skip_verify = true
|
|
}
|
|
|
|
resource "rancher_secret_backend_service_account" "admin" {
|
|
backend = rancher_secret_backend.rancher.path
|
|
name = "admin"
|
|
|
|
token = "seed-token"
|
|
token_name = "seed"
|
|
|
|
token_ttl = 90 * 24 * 3600
|
|
rotation_period = 45 * 24 * 3600
|
|
}
|
|
|
|
resource "rancher_secret_backend_role" "ci" {
|
|
backend = rancher_secret_backend.rancher.path
|
|
name = "ci"
|
|
service_account = rancher_secret_backend_service_account.admin.name
|
|
cluster_name = "c-m-abc123"
|
|
ttl = 3600
|
|
max_ttl = 86400
|
|
}
|