unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Grant terraform-rancher read on rancher/creds/ci #143

Merged
benvin merged 1 commits from benvin/rancher-creds-ci-policy into master 2026-08-30 09:42:00 +10:00
Conversation 0 Commits 1 Files Changed 1
+20
unkin-agent commented 2026-08-30 00:48:16 +10:00
Member
Copy Link
Copy Source

Why

terraform-rancher authenticates the rancher2 provider with a static 90-day admin API token stored in kv/service/terraform/rancher — the repo carries its own Makefile TODO to retire it. The Rancher secrets engine is already mounted at rancher/ with a ci role (seeded admin service account, ttl 1h / max 8h), but no policy grants read on rancher/creds/*, so nothing can use it yet.

What

Adds policies/rancher/creds/ci.yaml: read on rancher/creds/ci, bound to the same runner identities as the existing kv policy — approle terraform_rancher and k8s/au/syd1 role woodpecker_terraform_rancher.

Minted tokens are lease-bound and deleted from Rancher on revoke. They inherit the seeded admin service account's RBAC, so this is the same privilege as the static token it replaces, just short-lived.

Follow-up

A terraform-rancher Makefile PR swapping vault kv get kv/service/terraform/rancher for vault read -field=token rancher/creds/ci must merge only after this one applies.

## Why `terraform-rancher` authenticates the rancher2 provider with a static 90-day admin API token stored in `kv/service/terraform/rancher` — the repo carries its own Makefile TODO to retire it. The Rancher secrets engine is already mounted at `rancher/` with a `ci` role (seeded `admin` service account, ttl 1h / max 8h), but no policy grants read on `rancher/creds/*`, so nothing can use it yet. ## What Adds `policies/rancher/creds/ci.yaml`: `read` on `rancher/creds/ci`, bound to the same runner identities as the existing kv policy — approle `terraform_rancher` and k8s/au/syd1 role `woodpecker_terraform_rancher`. Minted tokens are lease-bound and deleted from Rancher on revoke. They inherit the seeded admin service account's RBAC, so this is the same privilege as the static token it replaces, just short-lived. ## Follow-up A terraform-rancher Makefile PR swapping `vault kv get kv/service/terraform/rancher` for `vault read -field=token rancher/creds/ci` must merge **only after** this one applies.
unkin-agent added 1 commit 2026-08-30 00:48:16 +10:00
Grant the terraform-rancher runner read on rancher/creds/ci
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
e7de5afb0d 
Adds policies/rancher/creds/ci.yaml so the terraform-rancher approle and its
woodpecker k8s role can read the ci role's ephemeral Rancher token, replacing
the static 90-day admin token in kv/service/terraform/rancher.
benvin merged commit bcbf121818 into master 2026-08-30 09:42:00 +10:00
benvin deleted branch benvin/rancher-creds-ci-policy 2026-08-30 09:42:01 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#143
Delete Branch "benvin/rancher-creds-ci-policy"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?