unkin-agent
6db8100aba
Retire the static 90-day admin token in kv/service/terraform/rancher; the vault rancher engine and the read grant on rancher/creds/ci are live. - Makefile: vault_env reads TF_VAR_rancher_token from rancher/creds/ci - README: document the ephemeral 1h credential model
38 lines
1.2 KiB
Markdown
38 lines
1.2 KiB
Markdown
# terraform-rancher
|
|
|
|
Terraform configuration for managing Rancher (rancher.k8s.syd1.au.unkin.net)
|
|
authentication via the [rancher2](https://registry.terraform.io/providers/rancher/rancher2)
|
|
provider. Mirrors the `terraform-authentik` pattern.
|
|
|
|
## Managed Resources
|
|
|
|
- **Keycloak(OIDC) auth config** — Authentik OIDC login for Rancher.
|
|
|
|
## Configuration
|
|
|
|
`config/keycloakoidc.yaml` defines the auth provider. The OAuth client secret is
|
|
read from Vault (kv-v2) — the same secret Authentik sets on its `rancher`
|
|
provider — and is never committed.
|
|
|
|
`access_mode: unrestricted` lets any authenticated Authentik user log in; Rancher
|
|
roles are granted to users/groups separately. This avoids locking the admin out
|
|
when the provider is first enabled.
|
|
|
|
## Usage
|
|
|
|
```sh
|
|
make plan # init + plan
|
|
make apply # init + plan + apply
|
|
make format # fmt tofu + terragrunt hcl
|
|
```
|
|
|
|
### Authentication
|
|
|
|
The rancher2 provider needs a Rancher API token, minted on demand by the Vault
|
|
Rancher secrets engine at `rancher/creds/ci`. The token is ephemeral (1h lease)
|
|
and Vault revokes it in Rancher when the lease expires, so nothing needs
|
|
rotating.
|
|
|
|
Set `VAULT_ROLEID` for local AppRole auth, or `VAULT_AUTH_METHOD=kubernetes`
|
|
for CI (Woodpecker).
|