unkinben
dbd1f6db8a
Rancher's server-side OIDC discovery call to the Authentik issuer (https://identity.unkin.net) fails with x509 "certificate signed by unknown authority" because Rancher does not trust the internal unkin.net PKI. The keycloak_oidc auth config never set a CA certificate. - Read the internal PKI ca_chain (intermediate + root) from Vault via a vault_generic_secret data source (pki_int/cert/ca_chain). - Set certificate on rancher2_auth_config_keycloak_oidc, defaulting to the Vault-sourced chain so trust cannot go stale on rotation; add an optional keycloakoidc.certificate override for an explicit value. Issuer, client, scopes and role bindings are unchanged. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
35 lines
1.4 KiB
Terraform
35 lines
1.4 KiB
Terraform
variable "keycloakoidc" {
|
|
description = "Rancher Keycloak(OIDC) auth provider config, or null to leave unmanaged."
|
|
type = object({
|
|
rancher_url = string # Rancher redirect URL, must end with /verify-auth
|
|
client_id = string
|
|
issuer = string # OIDC issuer (Authentik application URL)
|
|
auth_endpoint = string # OIDC authorization endpoint
|
|
scopes = optional(string, "openid profile email")
|
|
# OIDC claim to read group names from (default Rancher uses "groups").
|
|
groups_field = optional(string, "groups")
|
|
access_mode = optional(string, "unrestricted")
|
|
enabled = optional(bool, true)
|
|
# PEM CA cert Rancher trusts for the IdP's TLS on OIDC discovery. Leave null
|
|
# to default to the internal PKI ca_chain read from Vault.
|
|
certificate = optional(string, null)
|
|
# client_secret is never committed. Point at a Vault kv-v2 secret whose
|
|
# `client_secret` key holds the value (seeded out of band); TF reads it.
|
|
client_secret_vault = optional(object({
|
|
mount = string
|
|
path = string
|
|
}), null)
|
|
})
|
|
default = null
|
|
}
|
|
|
|
# Global role bindings mapping an Authentik group (permission group) to a Rancher
|
|
# global role. The group name is the map key; the OIDC group principal id is
|
|
# derived as keycloakoidc_group://<name>.
|
|
variable "global_role_bindings" {
|
|
type = map(object({
|
|
global_role_id = string # e.g. "admin", "user"
|
|
}))
|
|
default = {}
|
|
}
|