Rancher's server-side OIDC discovery call to the Authentik issuer
(https://identity.unkin.net) fails with x509 "certificate signed by
unknown authority" because Rancher does not trust the internal unkin.net
PKI. The keycloak_oidc auth config never set a CA certificate.
- Read the internal PKI ca_chain (intermediate + root) from Vault via a
vault_generic_secret data source (pki_int/cert/ca_chain).
- Set certificate on rancher2_auth_config_keycloak_oidc, defaulting to the
Vault-sourced chain so trust cannot go stale on rotation; add an optional
keycloakoidc.certificate override for an explicit value.
Issuer, client, scopes and role bindings are unchanged.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
unkinben
dbd1f6db8a