Merge pull request 'ci: mint rancher token from the vault rancher engine' (#9) from benvin/ephemeral-runner-creds into main

Reviewed-on: #9

Makefile

@@ -4,13 +4,9 @@ VAULT_AUTH_METHOD ?= approle
 VAULT_K8S_ROLE ?= woodpecker_terraform_rancher
 VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
 VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token
-# kv-v2 location of the Rancher admin API token used by the rancher2 provider.
-# TODO: migrate to the dedicated Vault Rancher secrets engine once it exists
-# (swap the `vault kv get` below for `vault read -field=token rancher/creds/<role>`).
-# Until then note Rancher API tokens have a 90-day max lifetime and must be rotated.
-RANCHER_TOKEN_KV_MOUNT ?= kv
-RANCHER_TOKEN_KV_PATH ?= service/terraform/rancher
-RANCHER_TOKEN_KV_FIELD ?= token
+# Vault Rancher engine role minting the token the rancher2 provider uses; the
+# token is ephemeral (1h lease) and Vault revokes it in Rancher on expiry.
+RANCHER_CREDS_PATH ?= rancher/creds/ci
 
 define vault_env
 	@export VAULT_ADDR="https://vault.service.consul:8200" && \
@@ -20,7 +16,7 @@ define vault_env
 		export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
 	fi && \
 	export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-rancher) && \
-	export TF_VAR_rancher_token=$$(vault kv get -mount=$(RANCHER_TOKEN_KV_MOUNT) -field=$(RANCHER_TOKEN_KV_FIELD) $(RANCHER_TOKEN_KV_PATH))
+	export TF_VAR_rancher_token=$$(vault read -field=token $(RANCHER_CREDS_PATH))
 endef
 
 init:

README.md

@@ -107,13 +107,10 @@ make format  # fmt tofu + terragrunt hcl
 
 ### Authentication
 
-The rancher2 provider needs a Rancher admin API token, read from Vault at
-`kv/service/terraform/rancher` (field `token`).
-
-> **Note:** Rancher API tokens have a **90-day maximum** lifetime, so the static
-> token must be rotated. This is intended to move to a dedicated Vault Rancher
-> secrets engine that mints short-lived tokens on demand; when that lands, update
-> the Makefile `vault_env` helper to `vault read` from that engine.
+The rancher2 provider needs a Rancher API token, minted on demand by the Vault
+Rancher secrets engine at `rancher/creds/ci`. The token is ephemeral (1h lease)
+and Vault revokes it in Rancher when the lease expires, so nothing needs
+rotating.
 
 Set `VAULT_ROLEID` for local AppRole auth, or `VAULT_AUTH_METHOD=kubernetes`
 for CI (Woodpecker).