Wire Rancher to Authentik ak_groups + akP-rancher global roles

Consume the two-tier Authentik RBAC (terraform-authentik): read the hierarchical
`ak_groups` claim and grant Rancher global roles to the akP-rancher permission
groups. Members of akR-global-admin/akR-standard-user inherit these.

- keycloakoidc: scopes += ak_groups; groups_field = ak_groups
- global_role_bindings: akP-rancher-admin -> admin, akP-rancher-user -> user
  (group principal keycloakoidc_group://<name>)

config/config.hcl

@@ -8,5 +8,10 @@ locals {
 
   config = {
     keycloakoidc = try(local.all_configs["keycloakoidc.yaml"], null)
+    global_role_bindings = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "global_role_bindings/")
+    }
   }
 }

config/global_role_bindings/akP-rancher-admin.yaml

@@ -0,0 +1,3 @@
+# akP-rancher-admin -> Rancher global admin. Granted to akR-global-admin members
+# (inherited) and direct members.
+global_role_id: admin

config/global_role_bindings/akP-rancher-user.yaml

@@ -0,0 +1,3 @@
+# akP-rancher-user -> standard Rancher user global role. Granted to
+# akR-standard-user members (inherited) and direct members.
+global_role_id: user

config/keycloakoidc.yaml

@@ -6,7 +6,10 @@ rancher_url: https://rancher.k8s.syd1.au.unkin.net/verify-auth
 client_id: rancher
 issuer: https://identity.unkin.net/application/o/rancher/
 auth_endpoint: https://identity.unkin.net/application/o/authorize/
-scopes: openid profile email
+# ak_groups = hierarchical group claim from terraform-authentik (permission
+# groups inherited via role groups). groups_field points Rancher at that claim.
+scopes: openid profile email ak_groups
+groups_field: ak_groups
 access_mode: unrestricted
 enabled: true
 client_secret_vault:

environments/rancher.k8s.syd1.au.unkin.net/terragrunt.hcl

@@ -17,5 +17,6 @@ terraform {
 }
 
 inputs = {
-  keycloakoidc = local.config.keycloakoidc
+  keycloakoidc         = local.config.keycloakoidc
+  global_role_bindings = local.config.global_role_bindings
 }

modules/rancher/main.tf

@@ -17,6 +17,21 @@ resource "rancher2_auth_config_keycloak_oidc" "this" {
   issuer        = var.keycloakoidc.issuer
   auth_endpoint = var.keycloakoidc.auth_endpoint
   scopes        = var.keycloakoidc.scopes
+  groups_field  = var.keycloakoidc.groups_field
   access_mode   = var.keycloakoidc.access_mode
   enabled       = var.keycloakoidc.enabled
 }
+
+# Grant Rancher global roles to Authentik permission groups. The keycloak_oidc
+# group principal id is keycloakoidc_group://<group name>. Members of a role
+# group (e.g. akR-global-admin) inherit the permission group, so they receive
+# the bound global role.
+resource "rancher2_global_role_binding" "group" {
+  for_each = var.global_role_bindings
+
+  name               = "akgroup-${each.key}"
+  global_role_id     = each.value.global_role_id
+  group_principal_id = "keycloakoidc_group://${each.key}"
+
+  depends_on = [rancher2_auth_config_keycloak_oidc.this]
+}

modules/rancher/variables.tf

@@ -6,8 +6,10 @@ variable "keycloakoidc" {
     issuer        = string # OIDC issuer (Authentik application URL)
     auth_endpoint = string # OIDC authorization endpoint
     scopes        = optional(string, "openid profile email")
-    access_mode   = optional(string, "unrestricted")
+    # OIDC claim to read group names from (default Rancher uses "groups").
-    enabled       = optional(bool, true)
+    groups_field = optional(string, "groups")
+    access_mode  = optional(string, "unrestricted")
+    enabled      = optional(bool, true)
     # client_secret is never committed. Point at a Vault kv-v2 secret whose
     # `client_secret` key holds the value (seeded out of band); TF reads it.
     client_secret_vault = optional(object({
@@ -17,3 +19,13 @@ variable "keycloakoidc" {
   })
   default = null
 }
+
+# Global role bindings mapping an Authentik group (permission group) to a Rancher
+# global role. The group name is the map key; the OIDC group principal id is
+# derived as keycloakoidc_group://<name>.
+variable "global_role_bindings" {
+  type = map(object({
+    global_role_id = string # e.g. "admin", "user"
+  }))
+  default = {}
+}