unkinben
80fa1b2844
Consume the two-tier Authentik RBAC (terraform-authentik): read the hierarchical `ak_groups` claim and grant Rancher global roles to the akP-rancher permission groups. Members of akR-global-admin/akR-standard-user inherit these. - keycloakoidc: scopes += ak_groups; groups_field = ak_groups - global_role_bindings: akP-rancher-admin -> admin, akP-rancher-user -> user (group principal keycloakoidc_group://<name>)
38 lines
1.6 KiB
Terraform
38 lines
1.6 KiB
Terraform
# Read the OAuth client secret from Vault so nothing sensitive is committed.
|
|
data "vault_kv_secret_v2" "keycloakoidc" {
|
|
count = var.keycloakoidc != null && var.keycloakoidc.client_secret_vault != null ? 1 : 0
|
|
mount = var.keycloakoidc.client_secret_vault.mount
|
|
name = var.keycloakoidc.client_secret_vault.path
|
|
}
|
|
|
|
# Rancher's Keycloak(OIDC) auth provider, pointed at Authentik. access_mode
|
|
# "unrestricted" means any authenticated Authentik user can log in; Rancher
|
|
# roles are granted to users/groups separately (avoids admin lockout on enable).
|
|
resource "rancher2_auth_config_keycloak_oidc" "this" {
|
|
count = var.keycloakoidc != null ? 1 : 0
|
|
|
|
rancher_url = var.keycloakoidc.rancher_url
|
|
client_id = var.keycloakoidc.client_id
|
|
client_secret = data.vault_kv_secret_v2.keycloakoidc[0].data["client_secret"]
|
|
issuer = var.keycloakoidc.issuer
|
|
auth_endpoint = var.keycloakoidc.auth_endpoint
|
|
scopes = var.keycloakoidc.scopes
|
|
groups_field = var.keycloakoidc.groups_field
|
|
access_mode = var.keycloakoidc.access_mode
|
|
enabled = var.keycloakoidc.enabled
|
|
}
|
|
|
|
# Grant Rancher global roles to Authentik permission groups. The keycloak_oidc
|
|
# group principal id is keycloakoidc_group://<group name>. Members of a role
|
|
# group (e.g. akR-global-admin) inherit the permission group, so they receive
|
|
# the bound global role.
|
|
resource "rancher2_global_role_binding" "group" {
|
|
for_each = var.global_role_bindings
|
|
|
|
name = "akgroup-${each.key}"
|
|
global_role_id = each.value.global_role_id
|
|
group_principal_id = "keycloakoidc_group://${each.key}"
|
|
|
|
depends_on = [rancher2_auth_config_keycloak_oidc.this]
|
|
}
|