Scaffold terraform-rancher: Authentik OIDC auth config #1

2026-07-15T21:57:52+10:00

unkinben commented

2026-07-15 21:57:52 +10:00

Why

Manages Rancher's Keycloak(OIDC) auth provider declaratively via the rancher2 provider, pointed at Authentik — so Rancher access uses Authentik identity/groups. Chosen over a raw AuthConfig CR because the provider handles the verify/enable flow properly (no ArgoCD drift, no admin lockout). Mirrors the terraform-authentik layout.

modules/rancher: rancher2_auth_config_keycloak_oidc — client_secret read from Vault (kv/kubernetes/namespace/cattle-system/default/oauth-credentials, the same secret Authentik sets on its rancher provider). access_mode = unrestricted so enabling can't lock the admin out; roles assigned to users/groups separately.
config/keycloakoidc.yaml: issuer/auth_endpoint at identity.unkin.net, client_id: rancher, /verify-auth redirect, openid/profile/email scopes.
environments/rancher.k8s.syd1.au.unkin.net: Consul state at infra/terraform/rancher/, rancher2 api_url derived from the env name.
Woodpecker plan/apply/pre-commit (SA terraform-rancher); Vault-sourced admin token.

Validation

tofu validate passes — config is valid against the rancher2 provider (resource type + all fields confirmed; pinned rancher2 v14.1.1).

Blocked on

A live plan needs a Rancher admin API token seeded in Vault at kv/service/terraform/rancher (field token). Until then CI plan will be red. Rancher API tokens have a 90-day max — to move to a dedicated Vault Rancher secrets engine (noted in the Makefile/README).

Depends on: terraform-authentik#6 (provider), terraform-vault#86 (runner auth+state — merged), argocd-apps#257 (woodpecker SA).

## Why Manages Rancher's Keycloak(OIDC) auth provider declaratively via the rancher2 provider, pointed at Authentik — so Rancher access uses Authentik identity/groups. Chosen over a raw AuthConfig CR because the provider handles the verify/enable flow properly (no ArgoCD drift, no admin lockout). Mirrors the terraform-authentik layout. ## Contents - `modules/rancher`: `rancher2_auth_config_keycloak_oidc` — client_secret read from Vault (`kv/kubernetes/namespace/cattle-system/default/oauth-credentials`, the same secret Authentik sets on its `rancher` provider). `access_mode = unrestricted` so enabling can't lock the admin out; roles assigned to users/groups separately. - `config/keycloakoidc.yaml`: issuer/auth_endpoint at `identity.unkin.net`, `client_id: rancher`, `/verify-auth` redirect, openid/profile/email scopes. - `environments/rancher.k8s.syd1.au.unkin.net`: Consul state at `infra/terraform/rancher/`, rancher2 `api_url` derived from the env name. - Woodpecker plan/apply/pre-commit (SA `terraform-rancher`); Vault-sourced admin token. ## Validation `tofu validate` passes — config is valid against the rancher2 provider (resource type + all fields confirmed; pinned rancher2 v14.1.1). ## Blocked on A **live `plan` needs a Rancher admin API token** seeded in Vault at `kv/service/terraform/rancher` (field `token`). Until then CI `plan` will be red. Rancher API tokens have a 90-day max — to move to a dedicated Vault Rancher secrets engine (noted in the Makefile/README). Depends on: terraform-authentik#6 (provider), terraform-vault#86 (runner auth+state — merged), argocd-apps#257 (woodpecker SA).

unkinben force-pushed benvin/scaffold from 153bbf7d74 to 5fd2fb3b8f

2026-07-16 22:20:29 +10:00

Compare

unkinben added 1 commit 2026-07-16 22:21:04 +10:00

Scaffold terraform-rancher: Authentik OIDC auth config

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

90a01563dc

Manages Rancher's Keycloak(OIDC) auth provider via the rancher2 provider,
pointed at Authentik. Mirrors the terraform-authentik layout (terragrunt +
Vault-sourced secrets + Woodpecker plan/apply/pre-commit pipelines).

- modules/rancher: rancher2_auth_config_keycloak_oidc, client_secret read from
  Vault (kv/kubernetes/namespace/cattle-system/default/oauth-credentials);
  access_mode unrestricted to avoid admin lockout on enable.
- config/keycloakoidc.yaml: issuer/auth_endpoint at identity.unkin.net,
  client_id rancher, /verify-auth redirect, openid/profile/email scopes.
- environments/rancher.k8s.syd1.au.unkin.net: consul state at
  infra/terraform/rancher/, rancher2 provider api_url from the env name.
- rancher2 admin token read from kv/service/terraform/rancher (Makefile);
  to migrate to a dedicated Vault Rancher secrets engine (90-day token cap).

Validated with `tofu validate` (config valid against the rancher2 provider).
A live `plan` needs the Rancher admin API token seeded in Vault first.

unkinben force-pushed benvin/scaffold from 5fd2fb3b8f to 90a01563dc

2026-07-16 22:21:04 +10:00

Compare

benvin merged commit 5b6a0527ee into main

2026-07-16 22:26:14 +10:00

benvin deleted branch benvin/scaffold

2026-07-16 22:26:14 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-rancher#1