From bcbf12181835b88e709371d4ae467a4580828ca8 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 30 Aug 2026 09:42:00 +1000 Subject: [PATCH] Grant terraform-rancher read on rancher/creds/ci (#143) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why `terraform-rancher` authenticates the rancher2 provider with a static 90-day admin API token stored in `kv/service/terraform/rancher` — the repo carries its own Makefile TODO to retire it. The Rancher secrets engine is already mounted at `rancher/` with a `ci` role (seeded `admin` service account, ttl 1h / max 8h), but no policy grants read on `rancher/creds/*`, so nothing can use it yet. ## What Adds `policies/rancher/creds/ci.yaml`: `read` on `rancher/creds/ci`, bound to the same runner identities as the existing kv policy — approle `terraform_rancher` and k8s/au/syd1 role `woodpecker_terraform_rancher`. Minted tokens are lease-bound and deleted from Rancher on revoke. They inherit the seeded admin service account's RBAC, so this is the same privilege as the static token it replaces, just short-lived. ## Follow-up A terraform-rancher Makefile PR swapping `vault kv get kv/service/terraform/rancher` for `vault read -field=token rancher/creds/ci` must merge **only after** this one applies. Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/143 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- policies/rancher/creds/ci.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 policies/rancher/creds/ci.yaml diff --git a/policies/rancher/creds/ci.yaml b/policies/rancher/creds/ci.yaml new file mode 100644 index 0000000..af066a9 --- /dev/null +++ b/policies/rancher/creds/ci.yaml @@ -0,0 +1,20 @@ +# Allow the terraform-rancher runner to mint an ephemeral Rancher API token +# from the "ci" role, so its Makefile can swap +# vault kv get kv/service/terraform/rancher +# for +# vault read -field=token rancher/creds/ci +# and retire the static 90-day admin token. The minted token is lease-bound +# (ttl 1h, max 8h) and deleted from Rancher on revoke; it inherits the seeded +# admin service account's RBAC, so this is the same privilege as the static +# token it replaces, just short-lived. +--- +rules: + - path: "rancher/creds/ci" + capabilities: + - read + +auth: + approle: + - terraform_rancher + k8s/au/syd1: + - woodpecker_terraform_rancher