unkin/terraform-rancher
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: mint rancher token from the vault rancher engine #9

Merged
benvin merged 1 commits from benvin/ephemeral-runner-creds into main 2026-08-30 14:27:33 +10:00
Conversation 0 Commits 1 Files Changed 2
+8 -15
unkin-agent commented 2026-08-30 14:12:44 +10:00
Member
Copy Link
Copy Source

Why

The rancher2 provider has been authenticating with a static Rancher admin API token in kv/service/terraform/rancher. Rancher API tokens cap at 90 days, so that secret needs manual rotation — the repo's own TODO. The Vault Rancher secrets engine is now deployed and the read grant on rancher/creds/ci is merged and applied (terraform-vault #143) for both the terraform_rancher AppRole and the woodpecker_terraform_rancher k8s role, so the TODO can be closed.

How

  • Makefile: vault_env now sets TF_VAR_rancher_token from vault read -field=token rancher/creds/ci instead of vault kv get; dropped the migration TODO and the KV mount/path/field vars.
  • README.md: credential model section rewritten for the ephemeral engine creds.

Tokens are now minted per run with a 1h lease and revoked in Rancher on expiry — nothing to rotate.

CI's plan job is the real validation here: it exercises the new vault read end-to-end via the k8s role.

Once this merges, the old KV secret kv/service/terraform/rancher is unused and can be deleted.

## Why The rancher2 provider has been authenticating with a static Rancher admin API token in `kv/service/terraform/rancher`. Rancher API tokens cap at 90 days, so that secret needs manual rotation — the repo's own TODO. The Vault Rancher secrets engine is now deployed and the read grant on `rancher/creds/ci` is merged and applied (terraform-vault #143) for both the `terraform_rancher` AppRole and the `woodpecker_terraform_rancher` k8s role, so the TODO can be closed. ## How - `Makefile`: `vault_env` now sets `TF_VAR_rancher_token` from `vault read -field=token rancher/creds/ci` instead of `vault kv get`; dropped the migration TODO and the KV mount/path/field vars. - `README.md`: credential model section rewritten for the ephemeral engine creds. Tokens are now minted per run with a 1h lease and revoked in Rancher on expiry — nothing to rotate. CI's plan job is the real validation here: it exercises the new `vault read` end-to-end via the k8s role. Once this merges, the old KV secret `kv/service/terraform/rancher` is unused and can be deleted.
unkin-agent added 1 commit 2026-08-30 14:12:44 +10:00
ci: mint rancher token from the vault rancher engine
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
6db8100aba 
Retire the static 90-day admin token in kv/service/terraform/rancher; the
vault rancher engine and the read grant on rancher/creds/ci are live.

- Makefile: vault_env reads TF_VAR_rancher_token from rancher/creds/ci
- README: document the ephemeral 1h credential model
benvin merged commit 2aa5cea027 into main 2026-08-30 14:27:33 +10:00
benvin deleted branch benvin/ephemeral-runner-creds 2026-08-30 14:27:34 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-rancher#9
Delete Branch "benvin/ephemeral-runner-creds"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?