unkin/terraform-rancher

Fork 0

Files

T

unkinben 90a01563dc

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

Scaffold terraform-rancher: Authentik OIDC auth config

Manages Rancher's Keycloak(OIDC) auth provider via the rancher2 provider,
pointed at Authentik. Mirrors the terraform-authentik layout (terragrunt +
Vault-sourced secrets + Woodpecker plan/apply/pre-commit pipelines).

- modules/rancher: rancher2_auth_config_keycloak_oidc, client_secret read from
  Vault (kv/kubernetes/namespace/cattle-system/default/oauth-credentials);
  access_mode unrestricted to avoid admin lockout on enable.
- config/keycloakoidc.yaml: issuer/auth_endpoint at identity.unkin.net,
  client_id rancher, /verify-auth redirect, openid/profile/email scopes.
- environments/rancher.k8s.syd1.au.unkin.net: consul state at
  infra/terraform/rancher/, rancher2 provider api_url from the env name.
- rancher2 admin token read from kv/service/terraform/rancher (Makefile);
  to migrate to a dedicated Vault Rancher secrets engine (90-day token cap).

Validated with `tofu validate` (config valid against the rancher2 provider).
A live `plan` needs the Rancher admin API token seeded in Vault first.

2026-07-16 22:21:00 +10:00

1.4 KiB

Raw Blame History

terraform-rancher

Terraform configuration for managing Rancher (rancher.k8s.syd1.au.unkin.net) authentication via the rancher2 provider. Mirrors the terraform-authentik pattern.

Managed Resources

Keycloak(OIDC) auth config — Authentik OIDC login for Rancher.

Configuration

config/keycloakoidc.yaml defines the auth provider. The OAuth client secret is read from Vault (kv-v2) — the same secret Authentik sets on its rancher provider — and is never committed.

access_mode: unrestricted lets any authenticated Authentik user log in; Rancher roles are granted to users/groups separately. This avoids locking the admin out when the provider is first enabled.

Usage

make plan    # init + plan
make apply   # init + plan + apply
make format  # fmt tofu + terragrunt hcl

Authentication

The rancher2 provider needs a Rancher admin API token, read from Vault at kv/service/terraform/rancher (field token).

Note: Rancher API tokens have a 90-day maximum lifetime, so the static token must be rotated. This is intended to move to a dedicated Vault Rancher secrets engine that mints short-lived tokens on demand; when that lands, update the Makefile vault_env helper to vault read from that engine.

Set VAULT_ROLEID for local AppRole auth, or VAULT_AUTH_METHOD=kubernetes for CI (Woodpecker).