unkinben
90a01563dc
Manages Rancher's Keycloak(OIDC) auth provider via the rancher2 provider, pointed at Authentik. Mirrors the terraform-authentik layout (terragrunt + Vault-sourced secrets + Woodpecker plan/apply/pre-commit pipelines). - modules/rancher: rancher2_auth_config_keycloak_oidc, client_secret read from Vault (kv/kubernetes/namespace/cattle-system/default/oauth-credentials); access_mode unrestricted to avoid admin lockout on enable. - config/keycloakoidc.yaml: issuer/auth_endpoint at identity.unkin.net, client_id rancher, /verify-auth redirect, openid/profile/email scopes. - environments/rancher.k8s.syd1.au.unkin.net: consul state at infra/terraform/rancher/, rancher2 provider api_url from the env name. - rancher2 admin token read from kv/service/terraform/rancher (Makefile); to migrate to a dedicated Vault Rancher secrets engine (90-day token cap). Validated with `tofu validate` (config valid against the rancher2 provider). A live `plan` needs the Rancher admin API token seeded in Vault first.
41 lines
1.4 KiB
Markdown
41 lines
1.4 KiB
Markdown
# terraform-rancher
|
|
|
|
Terraform configuration for managing Rancher (rancher.k8s.syd1.au.unkin.net)
|
|
authentication via the [rancher2](https://registry.terraform.io/providers/rancher/rancher2)
|
|
provider. Mirrors the `terraform-authentik` pattern.
|
|
|
|
## Managed Resources
|
|
|
|
- **Keycloak(OIDC) auth config** — Authentik OIDC login for Rancher.
|
|
|
|
## Configuration
|
|
|
|
`config/keycloakoidc.yaml` defines the auth provider. The OAuth client secret is
|
|
read from Vault (kv-v2) — the same secret Authentik sets on its `rancher`
|
|
provider — and is never committed.
|
|
|
|
`access_mode: unrestricted` lets any authenticated Authentik user log in; Rancher
|
|
roles are granted to users/groups separately. This avoids locking the admin out
|
|
when the provider is first enabled.
|
|
|
|
## Usage
|
|
|
|
```sh
|
|
make plan # init + plan
|
|
make apply # init + plan + apply
|
|
make format # fmt tofu + terragrunt hcl
|
|
```
|
|
|
|
### Authentication
|
|
|
|
The rancher2 provider needs a Rancher admin API token, read from Vault at
|
|
`kv/service/terraform/rancher` (field `token`).
|
|
|
|
> **Note:** Rancher API tokens have a **90-day maximum** lifetime, so the static
|
|
> token must be rotated. This is intended to move to a dedicated Vault Rancher
|
|
> secrets engine that mints short-lived tokens on demand; when that lands, update
|
|
> the Makefile `vault_env` helper to `vault read` from that engine.
|
|
|
|
Set `VAULT_ROLEID` for local AppRole auth, or `VAULT_AUTH_METHOD=kubernetes`
|
|
for CI (Woodpecker).
|