unkinben
90a01563dc
Manages Rancher's Keycloak(OIDC) auth provider via the rancher2 provider, pointed at Authentik. Mirrors the terraform-authentik layout (terragrunt + Vault-sourced secrets + Woodpecker plan/apply/pre-commit pipelines). - modules/rancher: rancher2_auth_config_keycloak_oidc, client_secret read from Vault (kv/kubernetes/namespace/cattle-system/default/oauth-credentials); access_mode unrestricted to avoid admin lockout on enable. - config/keycloakoidc.yaml: issuer/auth_endpoint at identity.unkin.net, client_id rancher, /verify-auth redirect, openid/profile/email scopes. - environments/rancher.k8s.syd1.au.unkin.net: consul state at infra/terraform/rancher/, rancher2 provider api_url from the env name. - rancher2 admin token read from kv/service/terraform/rancher (Makefile); to migrate to a dedicated Vault Rancher secrets engine (90-day token cap). Validated with `tofu validate` (config valid against the rancher2 provider). A live `plan` needs the Rancher admin API token seeded in Vault first.
43 lines
1.7 KiB
Makefile
43 lines
1.7 KiB
Makefile
.PHONY: init plan apply format
|
|
|
|
VAULT_AUTH_METHOD ?= approle
|
|
VAULT_K8S_ROLE ?= woodpecker_terraform_rancher
|
|
VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
|
|
VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token
|
|
# kv-v2 location of the Rancher admin API token used by the rancher2 provider.
|
|
# TODO: migrate to the dedicated Vault Rancher secrets engine once it exists
|
|
# (swap the `vault kv get` below for `vault read -field=token rancher/creds/<role>`).
|
|
# Until then note Rancher API tokens have a 90-day max lifetime and must be rotated.
|
|
RANCHER_TOKEN_KV_MOUNT ?= kv
|
|
RANCHER_TOKEN_KV_PATH ?= service/terraform/rancher
|
|
RANCHER_TOKEN_KV_FIELD ?= token
|
|
|
|
define vault_env
|
|
@export VAULT_ADDR="https://vault.service.consul:8200" && \
|
|
if [ "$(VAULT_AUTH_METHOD)" = "kubernetes" ]; then \
|
|
export VAULT_TOKEN=$$(vault write -field=token $(VAULT_K8S_MOUNT)/login role=$(VAULT_K8S_ROLE) jwt=$$(cat $(VAULT_K8S_JWT_PATH))); \
|
|
else \
|
|
export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
|
|
fi && \
|
|
export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-rancher) && \
|
|
export TF_VAR_rancher_token=$$(vault kv get -mount=$(RANCHER_TOKEN_KV_MOUNT) -field=$(RANCHER_TOKEN_KV_FIELD) $(RANCHER_TOKEN_KV_PATH))
|
|
endef
|
|
|
|
init:
|
|
@$(call vault_env) && \
|
|
terragrunt run --all --non-interactive init -- -upgrade
|
|
|
|
plan: init
|
|
@$(call vault_env) && \
|
|
terragrunt run --all --parallelism 4 --non-interactive plan
|
|
|
|
apply: init
|
|
@$(call vault_env) && \
|
|
terragrunt run --all --parallelism 2 --non-interactive apply
|
|
|
|
format:
|
|
@echo "Formatting OpenTofu files..."
|
|
@tofu fmt -recursive .
|
|
@echo "Formatting Terragrunt files..."
|
|
@terragrunt hcl fmt
|