From 8bb071ae465988881aa47fd05c8d710a51a175c7 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Wed, 15 Jul 2026 21:37:45 +1000 Subject: [PATCH] Add auth and state access for terraform-rancher (#86) ## Why The new `terraform-rancher` repo (manages Rancher's Authentik OIDC auth via the rancher2 provider) needs Vault auth + Consul state, mirroring the terraform-authentik runner (#78/#81/#82). ## Change - `AppRole/terraform_rancher` + k8s auth role `woodpecker_terraform_rancher` (SA terraform-rancher in the woodpecker ns). - Consul secret-backend role + ACL policy (`resources/secret_backend/consul_root/au/syd1/terraform-rancher.hcl`) granting write to the `infra/terraform/rancher/` state prefix. - Vault policies: read the Rancher admin API token (`kv/service/terraform/rancher`) and the keycloakoidc client secret (`kv/kubernetes/namespace/cattle-system/default/oauth-credentials`), plus the consul_root state creds. Scoped the OAuth read to the `cattle-system` path specifically (rather than the `+` wildcard the authentik policy uses) since the Rancher runner only needs its own app's secret. ## Validation pre-commit (terragrunt-hcl-fmt + yamllint) passed. CI plan will confirm. Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/86 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- .../approle/terraform_rancher.yaml | 9 +++++++++ .../au/syd1/woodpecker_terraform_rancher.yaml | 7 +++++++ .../consul_root/au/syd1/terraform-rancher.yaml | 5 +++++ .../au/syd1/creds/terraform-rancher.yaml | 11 +++++++++++ policies/kv/service/terraform/rancher.yaml | 18 ++++++++++++++++++ .../consul_root/au/syd1/terraform-rancher.hcl | 7 +++++++ 6 files changed, 57 insertions(+) create mode 100644 config/auth_approle_role/approle/terraform_rancher.yaml create mode 100644 config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_rancher.yaml create mode 100644 config/consul_secret_backend_role/consul_root/au/syd1/terraform-rancher.yaml create mode 100644 policies/consul_root/au/syd1/creds/terraform-rancher.yaml create mode 100644 policies/kv/service/terraform/rancher.yaml create mode 100644 resources/secret_backend/consul_root/au/syd1/terraform-rancher.hcl diff --git a/config/auth_approle_role/approle/terraform_rancher.yaml b/config/auth_approle_role/approle/terraform_rancher.yaml new file mode 100644 index 0000000..cec109a --- /dev/null +++ b/config/auth_approle_role/approle/terraform_rancher.yaml @@ -0,0 +1,9 @@ +token_ttl: 120 +token_max_ttl: 120 +bind_secret_id: false +token_bound_cidrs: + - "10.10.12.200/32" + - "198.18.25.102/32" + - "198.18.26.91/32" + - "198.18.27.40/32" +use_deterministic_role_id: true diff --git a/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_rancher.yaml b/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_rancher.yaml new file mode 100644 index 0000000..c01a017 --- /dev/null +++ b/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_rancher.yaml @@ -0,0 +1,7 @@ +bound_service_account_names: + - terraform-rancher +bound_service_account_namespaces: + - woodpecker +token_ttl: 600 +token_max_ttl: 600 +audience: https://kubernetes.default.svc.cluster.local diff --git a/config/consul_secret_backend_role/consul_root/au/syd1/terraform-rancher.yaml b/config/consul_secret_backend_role/consul_root/au/syd1/terraform-rancher.yaml new file mode 100644 index 0000000..1749b55 --- /dev/null +++ b/config/consul_secret_backend_role/consul_root/au/syd1/terraform-rancher.yaml @@ -0,0 +1,5 @@ +consul_roles: + - terraform-rancher +ttl: 120 +max_ttl: 300 +datacenters: [] diff --git a/policies/consul_root/au/syd1/creds/terraform-rancher.yaml b/policies/consul_root/au/syd1/creds/terraform-rancher.yaml new file mode 100644 index 0000000..96f6544 --- /dev/null +++ b/policies/consul_root/au/syd1/creds/terraform-rancher.yaml @@ -0,0 +1,11 @@ +--- +rules: + - path: "consul_root/au/syd1/creds/terraform-rancher" + capabilities: + - read + +auth: + approle: + - terraform_rancher + k8s/au/syd1: + - woodpecker_terraform_rancher diff --git a/policies/kv/service/terraform/rancher.yaml b/policies/kv/service/terraform/rancher.yaml new file mode 100644 index 0000000..30352ab --- /dev/null +++ b/policies/kv/service/terraform/rancher.yaml @@ -0,0 +1,18 @@ +# Allow the Terraform Rancher runner to read: +# - its own Rancher admin API token (rancher2 provider auth), and +# - the OAuth2/OIDC client secret backing the Rancher keycloakoidc AuthConfig +# (same secret Authentik sets on the provider). +--- +rules: + - path: "kv/data/service/terraform/rancher" + capabilities: + - read + - path: "kv/data/kubernetes/namespace/cattle-system/default/oauth-credentials" + capabilities: + - read + +auth: + approle: + - terraform_rancher + k8s/au/syd1: + - woodpecker_terraform_rancher diff --git a/resources/secret_backend/consul_root/au/syd1/terraform-rancher.hcl b/resources/secret_backend/consul_root/au/syd1/terraform-rancher.hcl new file mode 100644 index 0000000..5b9bdbb --- /dev/null +++ b/resources/secret_backend/consul_root/au/syd1/terraform-rancher.hcl @@ -0,0 +1,7 @@ +key_prefix "infra/terraform/rancher/" { + policy = "write" +} + +session_prefix "" { + policy = "write" +}