# Rancher Keycloak(OIDC) auth provider backed by Authentik.
# client_secret is read from Vault (the same secret Authentik sets on its
# provider), not committed. access_mode "unrestricted" avoids admin lockout:
# any Authentik user can authenticate; Rancher roles are assigned separately.
rancher_url: https://rancher.k8s.syd1.au.unkin.net/verify-auth
client_id: rancher
issuer: https://identity.unkin.net/application/o/rancher/
auth_endpoint: https://identity.unkin.net/application/o/authorize/
scopes: openid profile email
access_mode: unrestricted
enabled: true
client_secret_vault:
  mount: kv
  path: kubernetes/namespace/cattle-system/default/oauth-credentials