unkin/terraform-rancher
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: mint rancher token from the vault rancher engine #9

Merged
benvin merged 1 commits from benvin/ephemeral-runner-creds into main 2026-08-30 14:27:33 +10:00
Conversation 0 Commits 1 Files Changed 2
+8 -15
2 changed files with 8 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+4 -8
View File
@@ -4,13 +4,9 @@ VAULT_AUTH_METHOD ?= approle
VAULT_K8S_ROLE ?= woodpecker_terraform_rancher
VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token
# kv-v2 location of the Rancher admin API token used by the rancher2 provider.
# TODO: migrate to the dedicated Vault Rancher secrets engine once it exists
# (swap the `vault kv get` below for `vault read -field=token rancher/creds/<role>`).
# Until then note Rancher API tokens have a 90-day max lifetime and must be rotated.
RANCHER_TOKEN_KV_MOUNT ?= kv
RANCHER_TOKEN_KV_PATH ?= service/terraform/rancher
RANCHER_TOKEN_KV_FIELD ?= token
# Vault Rancher engine role minting the token the rancher2 provider uses; the
# token is ephemeral (1h lease) and Vault revokes it in Rancher on expiry.
RANCHER_CREDS_PATH ?= rancher/creds/ci
define vault_env
@export VAULT_ADDR="https://vault.service.consul:8200" && \
@@ -20,7 +16,7 @@ define vault_env
export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
fi && \
export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-rancher) && \
export TF_VAR_rancher_token=$$(vault kv get -mount=$(RANCHER_TOKEN_KV_MOUNT) -field=$(RANCHER_TOKEN_KV_FIELD) $(RANCHER_TOKEN_KV_PATH))
export TF_VAR_rancher_token=$$(vault read -field=token $(RANCHER_CREDS_PATH))
endef
init:
README.md
+4 -7
View File
@@ -28,13 +28,10 @@ make format # fmt tofu + terragrunt hcl
### Authentication
The rancher2 provider needs a Rancher admin API token, read from Vault at
`kv/service/terraform/rancher` (field `token`).
> **Note:** Rancher API tokens have a **90-day maximum** lifetime, so the static
> token must be rotated. This is intended to move to a dedicated Vault Rancher
> secrets engine that mints short-lived tokens on demand; when that lands, update
> the Makefile `vault_env` helper to `vault read` from that engine.
The rancher2 provider needs a Rancher API token, minted on demand by the Vault
Rancher secrets engine at `rancher/creds/ci`. The token is ephemeral (1h lease)
and Vault revokes it in Rancher when the lease expires, so nothing needs
rotating.
Set `VAULT_ROLEID` for local AppRole auth, or `VAULT_AUTH_METHOD=kubernetes`
for CI (Woodpecker).