Wire Rancher to Authentik ak_groups + akP-rancher global roles

Consume the two-tier Authentik RBAC (terraform-authentik): read the hierarchical
`ak_groups` claim and grant Rancher global roles to the akP-rancher permission
groups. Members of akR-global-admin/akR-standard-user inherit these.

- keycloakoidc: scopes += ak_groups; groups_field = ak_groups
- global_role_bindings: akP-rancher-admin -> admin, akP-rancher-user -> user
  (group principal keycloakoidc_group://<name>)

modules/rancher/main.tf

@@ -17,6 +17,21 @@ resource "rancher2_auth_config_keycloak_oidc" "this" {
   issuer        = var.keycloakoidc.issuer
   auth_endpoint = var.keycloakoidc.auth_endpoint
   scopes        = var.keycloakoidc.scopes
+  groups_field  = var.keycloakoidc.groups_field
   access_mode   = var.keycloakoidc.access_mode
   enabled       = var.keycloakoidc.enabled
 }
+
+# Grant Rancher global roles to Authentik permission groups. The keycloak_oidc
+# group principal id is keycloakoidc_group://<group name>. Members of a role
+# group (e.g. akR-global-admin) inherit the permission group, so they receive
+# the bound global role.
+resource "rancher2_global_role_binding" "group" {
+  for_each = var.global_role_bindings
+
+  name               = "akgroup-${each.key}"
+  global_role_id     = each.value.global_role_id
+  group_principal_id = "keycloakoidc_group://${each.key}"
+
+  depends_on = [rancher2_auth_config_keycloak_oidc.this]
+}

modules/rancher/variables.tf

@@ -6,8 +6,10 @@ variable "keycloakoidc" {
     issuer        = string # OIDC issuer (Authentik application URL)
     auth_endpoint = string # OIDC authorization endpoint
     scopes        = optional(string, "openid profile email")
-    access_mode   = optional(string, "unrestricted")
-    enabled       = optional(bool, true)
+    # OIDC claim to read group names from (default Rancher uses "groups").
+    groups_field = optional(string, "groups")
+    access_mode  = optional(string, "unrestricted")
+    enabled      = optional(bool, true)
     # client_secret is never committed. Point at a Vault kv-v2 secret whose
     # `client_secret` key holds the value (seeded out of band); TF reads it.
     client_secret_vault = optional(object({
@@ -17,3 +19,13 @@ variable "keycloakoidc" {
   })
   default = null
 }
+
+# Global role bindings mapping an Authentik group (permission group) to a Rancher
+# global role. The group name is the map key; the OIDC group principal id is
+# derived as keycloakoidc_group://<name>.
+variable "global_role_bindings" {
+  type = map(object({
+    global_role_id = string # e.g. "admin", "user"
+  }))
+  default = {}
+}