Trust internal CA for Rancher OIDC discovery #4

2026-07-31T20:31:11+10:00

unkinben commented

2026-07-31 20:31:11 +10:00

Rancher OIDC login fails with x509: certificate signed by unknown authority on the server-side discovery call to the Authentik issuer (https://identity.unkin.net), because the keycloak_oidc auth config never set a CA certificate and Rancher does not trust the internal unkin.net PKI.

Change:

Reads the internal PKI ca_chain (intermediate + root) from Vault (pki_int/cert/ca_chain) via a vault_generic_secret data source.
Sets certificate on rancher2_auth_config_keycloak_oidc, defaulting to the Vault-sourced chain (no hardcoding, so trust cannot go stale on rotation); adds an optional keycloakoidc.certificate override.

Issuer, client, scopes and role bindings are unchanged. CI-parity plan: rancher2_auth_config_keycloak_oidc.this[0] updated in-place, only + certificate added, 0 to add, 1 to change, 0 to destroy.

Note: Rancher login also needs the parallel terraform-authentik RS256 provider fix (task 49) merged+applied — this CA fix alone resolves TLS trust but the HS256->RS256 issue remains.

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

Rancher OIDC login fails with `x509: certificate signed by unknown authority` on the server-side discovery call to the Authentik issuer (https://identity.unkin.net), because the keycloak_oidc auth config never set a CA certificate and Rancher does not trust the internal unkin.net PKI. Change: - Reads the internal PKI ca_chain (intermediate + root) from Vault (`pki_int/cert/ca_chain`) via a `vault_generic_secret` data source. - Sets `certificate` on `rancher2_auth_config_keycloak_oidc`, defaulting to the Vault-sourced chain (no hardcoding, so trust cannot go stale on rotation); adds an optional `keycloakoidc.certificate` override. Issuer, client, scopes and role bindings are unchanged. CI-parity plan: `rancher2_auth_config_keycloak_oidc.this[0]` updated in-place, only `+ certificate` added, `0 to add, 1 to change, 0 to destroy`. Note: Rancher login also needs the parallel terraform-authentik RS256 provider fix (task 49) merged+applied — this CA fix alone resolves TLS trust but the HS256->RS256 issue remains. https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

unkinben added 1 commit 2026-07-31 20:31:12 +10:00

Trust internal CA for Rancher OIDC discovery

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

dbd1f6db8a

Rancher's server-side OIDC discovery call to the Authentik issuer
(https://identity.unkin.net) fails with x509 "certificate signed by
unknown authority" because Rancher does not trust the internal unkin.net
PKI. The keycloak_oidc auth config never set a CA certificate.

- Read the internal PKI ca_chain (intermediate + root) from Vault via a
  vault_generic_secret data source (pki_int/cert/ca_chain).
- Set certificate on rancher2_auth_config_keycloak_oidc, defaulting to the
  Vault-sourced chain so trust cannot go stale on rotation; add an optional
  keycloakoidc.certificate override for an explicit value.

Issuer, client, scopes and role bindings are unchanged.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

benvin merged commit 7be6a3e6e4 into main

2026-07-31 21:20:25 +10:00

benvin deleted branch benvin/rancher-oidc-ca

2026-07-31 21:20:26 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-rancher#4