unkinben
90a01563dc
Manages Rancher's Keycloak(OIDC) auth provider via the rancher2 provider, pointed at Authentik. Mirrors the terraform-authentik layout (terragrunt + Vault-sourced secrets + Woodpecker plan/apply/pre-commit pipelines). - modules/rancher: rancher2_auth_config_keycloak_oidc, client_secret read from Vault (kv/kubernetes/namespace/cattle-system/default/oauth-credentials); access_mode unrestricted to avoid admin lockout on enable. - config/keycloakoidc.yaml: issuer/auth_endpoint at identity.unkin.net, client_id rancher, /verify-auth redirect, openid/profile/email scopes. - environments/rancher.k8s.syd1.au.unkin.net: consul state at infra/terraform/rancher/, rancher2 provider api_url from the env name. - rancher2 admin token read from kv/service/terraform/rancher (Makefile); to migrate to a dedicated Vault Rancher secrets engine (90-day token cap). Validated with `tofu validate` (config valid against the rancher2 provider). A live `plan` needs the Rancher admin API token seeded in Vault first.
20 lines
798 B
Terraform
20 lines
798 B
Terraform
variable "keycloakoidc" {
|
|
description = "Rancher Keycloak(OIDC) auth provider config, or null to leave unmanaged."
|
|
type = object({
|
|
rancher_url = string # Rancher redirect URL, must end with /verify-auth
|
|
client_id = string
|
|
issuer = string # OIDC issuer (Authentik application URL)
|
|
auth_endpoint = string # OIDC authorization endpoint
|
|
scopes = optional(string, "openid profile email")
|
|
access_mode = optional(string, "unrestricted")
|
|
enabled = optional(bool, true)
|
|
# client_secret is never committed. Point at a Vault kv-v2 secret whose
|
|
# `client_secret` key holds the value (seeded out of band); TF reads it.
|
|
client_secret_vault = optional(object({
|
|
mount = string
|
|
path = string
|
|
}), null)
|
|
})
|
|
default = null
|
|
}
|