unkinben
90a01563dc
Manages Rancher's Keycloak(OIDC) auth provider via the rancher2 provider, pointed at Authentik. Mirrors the terraform-authentik layout (terragrunt + Vault-sourced secrets + Woodpecker plan/apply/pre-commit pipelines). - modules/rancher: rancher2_auth_config_keycloak_oidc, client_secret read from Vault (kv/kubernetes/namespace/cattle-system/default/oauth-credentials); access_mode unrestricted to avoid admin lockout on enable. - config/keycloakoidc.yaml: issuer/auth_endpoint at identity.unkin.net, client_id rancher, /verify-auth redirect, openid/profile/email scopes. - environments/rancher.k8s.syd1.au.unkin.net: consul state at infra/terraform/rancher/, rancher2 provider api_url from the env name. - rancher2 admin token read from kv/service/terraform/rancher (Makefile); to migrate to a dedicated Vault Rancher secrets engine (90-day token cap). Validated with `tofu validate` (config valid against the rancher2 provider). A live `plan` needs the Rancher admin API token seeded in Vault first.
23 lines
1.0 KiB
Terraform
23 lines
1.0 KiB
Terraform
# Read the OAuth client secret from Vault so nothing sensitive is committed.
|
|
data "vault_kv_secret_v2" "keycloakoidc" {
|
|
count = var.keycloakoidc != null && var.keycloakoidc.client_secret_vault != null ? 1 : 0
|
|
mount = var.keycloakoidc.client_secret_vault.mount
|
|
name = var.keycloakoidc.client_secret_vault.path
|
|
}
|
|
|
|
# Rancher's Keycloak(OIDC) auth provider, pointed at Authentik. access_mode
|
|
# "unrestricted" means any authenticated Authentik user can log in; Rancher
|
|
# roles are granted to users/groups separately (avoids admin lockout on enable).
|
|
resource "rancher2_auth_config_keycloak_oidc" "this" {
|
|
count = var.keycloakoidc != null ? 1 : 0
|
|
|
|
rancher_url = var.keycloakoidc.rancher_url
|
|
client_id = var.keycloakoidc.client_id
|
|
client_secret = data.vault_kv_secret_v2.keycloakoidc[0].data["client_secret"]
|
|
issuer = var.keycloakoidc.issuer
|
|
auth_endpoint = var.keycloakoidc.auth_endpoint
|
|
scopes = var.keycloakoidc.scopes
|
|
access_mode = var.keycloakoidc.access_mode
|
|
enabled = var.keycloakoidc.enabled
|
|
}
|