unkin-agent
6db8100aba
Retire the static 90-day admin token in kv/service/terraform/rancher; the vault rancher engine and the read grant on rancher/creds/ci are live. - Makefile: vault_env reads TF_VAR_rancher_token from rancher/creds/ci - README: document the ephemeral 1h credential model
terraform-rancher
Terraform configuration for managing Rancher (rancher.k8s.syd1.au.unkin.net)
authentication via the rancher2
provider. Mirrors the terraform-authentik pattern.
Managed Resources
- Keycloak(OIDC) auth config — Authentik OIDC login for Rancher.
Configuration
config/keycloakoidc.yaml defines the auth provider. The OAuth client secret is
read from Vault (kv-v2) — the same secret Authentik sets on its rancher
provider — and is never committed.
access_mode: unrestricted lets any authenticated Authentik user log in; Rancher
roles are granted to users/groups separately. This avoids locking the admin out
when the provider is first enabled.
Usage
make plan # init + plan
make apply # init + plan + apply
make format # fmt tofu + terragrunt hcl
Authentication
The rancher2 provider needs a Rancher API token, minted on demand by the Vault
Rancher secrets engine at rancher/creds/ci. The token is ephemeral (1h lease)
and Vault revokes it in Rancher when the lease expires, so nothing needs
rotating.
Set VAULT_ROLEID for local AppRole auth, or VAULT_AUTH_METHOD=kubernetes
for CI (Woodpecker).