unkin-agent
c7ef079c88
Extend the yaml-discovery config to four more rancher2 kinds so Rancher objects beyond the OIDC auth provider stop being unmanaged clickops. - Discover config/users, config/roles, config/tokens and config/settings in config/config.hcl and pass them through terragrunt.hcl - Add rancher2_user (password from Vault kv-v2) plus per-user rancher2_global_role_binding on "<username>/<role>" keys - Add rancher2_global_role with dynamic rules blocks - Add rancher2_token, documenting that the provider has no user selector - Add rancher2_setting and seed config/settings/server-url.yaml - Document every yaml schema in the README
94 lines
3.5 KiB
Terraform
94 lines
3.5 KiB
Terraform
variable "keycloakoidc" {
|
|
description = "Rancher Keycloak(OIDC) auth provider config, or null to leave unmanaged."
|
|
type = object({
|
|
rancher_url = string # Rancher redirect URL, must end with /verify-auth
|
|
client_id = string
|
|
issuer = string # OIDC issuer (Authentik application URL)
|
|
auth_endpoint = string # OIDC authorization endpoint
|
|
scopes = optional(string, "openid profile email")
|
|
# OIDC claim to read group names from (default Rancher uses "groups").
|
|
groups_field = optional(string, "groups")
|
|
access_mode = optional(string, "unrestricted")
|
|
enabled = optional(bool, true)
|
|
# PEM CA cert Rancher trusts for the IdP's TLS on OIDC discovery. Leave null
|
|
# to default to the internal PKI ca_chain read from Vault.
|
|
certificate = optional(string, null)
|
|
# client_secret is never committed. Point at a Vault kv-v2 secret whose
|
|
# `client_secret` key holds the value (seeded out of band); TF reads it.
|
|
client_secret_vault = optional(object({
|
|
mount = string
|
|
path = string
|
|
}), null)
|
|
})
|
|
default = null
|
|
}
|
|
|
|
# Global role bindings mapping an Authentik group (permission group) to a Rancher
|
|
# global role. The group name is the map key; the OIDC group principal id is
|
|
# derived as keycloakoidc_group://<name>.
|
|
variable "global_role_bindings" {
|
|
type = map(object({
|
|
global_role_id = string # e.g. "admin", "user"
|
|
}))
|
|
default = {}
|
|
}
|
|
|
|
# Rancher-local users (config/users/<username>.yaml). Map key is the username.
|
|
# rancher2_user requires a password, so every entry must point at a Vault kv-v2
|
|
# secret holding one; the value is read at plan time, so the secret must exist
|
|
# before a user yaml is added.
|
|
variable "users" {
|
|
type = map(object({
|
|
name = optional(string, null) # display name, defaults to the username
|
|
enabled = optional(bool, true)
|
|
must_change_password = optional(bool, false)
|
|
password_vault = object({
|
|
mount = string
|
|
path = string
|
|
key = optional(string, "password")
|
|
})
|
|
# Global roles granted to this user, e.g. ["user", "admin"].
|
|
global_role_bindings = optional(list(string), [])
|
|
}))
|
|
default = {}
|
|
}
|
|
|
|
# Custom Rancher global roles (config/roles/<name>.yaml). Map key is the role
|
|
# name, which is also the id other configs bind to via global_role_id.
|
|
variable "global_roles" {
|
|
type = map(object({
|
|
description = optional(string, null)
|
|
new_user_default = optional(bool, false)
|
|
inherited_cluster_roles = optional(list(string), [])
|
|
rules = optional(list(object({
|
|
api_groups = optional(list(string), [])
|
|
resources = optional(list(string), [])
|
|
verbs = optional(list(string), [])
|
|
non_resource_urls = optional(list(string), [])
|
|
resource_names = optional(list(string), [])
|
|
})), [])
|
|
}))
|
|
default = {}
|
|
}
|
|
|
|
# API tokens (config/tokens/<name>.yaml). Map key names the Terraform resource
|
|
# only. rancher2_token has no user selector (user_id is computed at 14.1.1), so
|
|
# every token here is minted for the identity the provider authenticates as.
|
|
variable "tokens" {
|
|
type = map(object({
|
|
description = optional(string, null) # defaults to the map key
|
|
ttl = optional(number, null) # seconds; 0/null = provider default
|
|
renew = optional(bool, null)
|
|
cluster_id = optional(string, null) # scope to one cluster, null = global
|
|
}))
|
|
default = {}
|
|
}
|
|
|
|
# Rancher settings (config/settings/<name>.yaml). Map key is the setting name.
|
|
variable "settings" {
|
|
type = map(object({
|
|
value = string
|
|
}))
|
|
default = {}
|
|
}
|