unkinben
dbd1f6db8a
Rancher's server-side OIDC discovery call to the Authentik issuer (https://identity.unkin.net) fails with x509 "certificate signed by unknown authority" because Rancher does not trust the internal unkin.net PKI. The keycloak_oidc auth config never set a CA certificate. - Read the internal PKI ca_chain (intermediate + root) from Vault via a vault_generic_secret data source (pki_int/cert/ca_chain). - Set certificate on rancher2_auth_config_keycloak_oidc, defaulting to the Vault-sourced chain so trust cannot go stale on rotation; add an optional keycloakoidc.certificate override for an explicit value. Issuer, client, scopes and role bindings are unchanged. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
terraform-rancher
Terraform configuration for managing Rancher (rancher.k8s.syd1.au.unkin.net)
authentication via the rancher2
provider. Mirrors the terraform-authentik pattern.
Managed Resources
- Keycloak(OIDC) auth config — Authentik OIDC login for Rancher.
Configuration
config/keycloakoidc.yaml defines the auth provider. The OAuth client secret is
read from Vault (kv-v2) — the same secret Authentik sets on its rancher
provider — and is never committed.
access_mode: unrestricted lets any authenticated Authentik user log in; Rancher
roles are granted to users/groups separately. This avoids locking the admin out
when the provider is first enabled.
Usage
make plan # init + plan
make apply # init + plan + apply
make format # fmt tofu + terragrunt hcl
Authentication
The rancher2 provider needs a Rancher admin API token, read from Vault at
kv/service/terraform/rancher (field token).
Note: Rancher API tokens have a 90-day maximum lifetime, so the static token must be rotated. This is intended to move to a dedicated Vault Rancher secrets engine that mints short-lived tokens on demand; when that lands, update the Makefile
vault_envhelper tovault readfrom that engine.
Set VAULT_ROLEID for local AppRole auth, or VAULT_AUTH_METHOD=kubernetes
for CI (Woodpecker).