unkinben
f2f41fc1c0
rancher2_global_role_binding.name must be a lowercase RFC 1123 label, but the akP-* group keys are mixed-case, so apply failed with InvalidFormat 422. Lowercase the name; keep the group principal id in original case to match the Authentik group.
41 lines
1.8 KiB
Terraform
41 lines
1.8 KiB
Terraform
# Read the OAuth client secret from Vault so nothing sensitive is committed.
|
|
data "vault_kv_secret_v2" "keycloakoidc" {
|
|
count = var.keycloakoidc != null && var.keycloakoidc.client_secret_vault != null ? 1 : 0
|
|
mount = var.keycloakoidc.client_secret_vault.mount
|
|
name = var.keycloakoidc.client_secret_vault.path
|
|
}
|
|
|
|
# Rancher's Keycloak(OIDC) auth provider, pointed at Authentik. access_mode
|
|
# "unrestricted" means any authenticated Authentik user can log in; Rancher
|
|
# roles are granted to users/groups separately (avoids admin lockout on enable).
|
|
resource "rancher2_auth_config_keycloak_oidc" "this" {
|
|
count = var.keycloakoidc != null ? 1 : 0
|
|
|
|
rancher_url = var.keycloakoidc.rancher_url
|
|
client_id = var.keycloakoidc.client_id
|
|
client_secret = data.vault_kv_secret_v2.keycloakoidc[0].data["client_secret"]
|
|
issuer = var.keycloakoidc.issuer
|
|
auth_endpoint = var.keycloakoidc.auth_endpoint
|
|
scopes = var.keycloakoidc.scopes
|
|
groups_field = var.keycloakoidc.groups_field
|
|
access_mode = var.keycloakoidc.access_mode
|
|
enabled = var.keycloakoidc.enabled
|
|
}
|
|
|
|
# Grant Rancher global roles to Authentik permission groups. The keycloak_oidc
|
|
# group principal id is keycloakoidc_group://<group name>. Members of a role
|
|
# group (e.g. akR-global-admin) inherit the permission group, so they receive
|
|
# the bound global role.
|
|
resource "rancher2_global_role_binding" "group" {
|
|
for_each = var.global_role_bindings
|
|
|
|
# Binding name must be an RFC 1123 label (lowercase); the group name may be
|
|
# mixed-case (akP-*), so lowercase it here. The principal id keeps the original
|
|
# case to match the group.
|
|
name = "akgroup-${lower(each.key)}"
|
|
global_role_id = each.value.global_role_id
|
|
group_principal_id = "keycloakoidc_group://${each.key}"
|
|
|
|
depends_on = [rancher2_auth_config_keycloak_oidc.this]
|
|
}
|