Wire Rancher to Authentik ak_groups + akP-rancher global roles

Consume the two-tier Authentik RBAC (terraform-authentik): read the hierarchical `ak_groups` claim and grant Rancher global roles to the akP-rancher permission groups. Members of akR-global-admin/akR-standard-user inherit these. - keycloakoidc: scopes += ak_groups; groups_field = ak_groups - global_role_bindings: akP-rancher-admin -> admin, akP-rancher-user -> user (group principal keycloakoidc_group://<name>)
2026-07-18 16:25:18 +10:00
parent 5b6a0527ee
commit 80fa1b2844
7 changed files with 46 additions and 4 deletions
@@ -0,0 +1,3 @@
+# akP-rancher-admin -> Rancher global admin. Granted to akR-global-admin members
+# (inherited) and direct members.
+global_role_id: admin
@@ -0,0 +1,3 @@
+# akP-rancher-user -> standard Rancher user global role. Granted to
+# akR-standard-user members (inherited) and direct members.
+global_role_id: user