unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Add auth and state access for terraform-rancher #86

Merged
benvin merged 1 commits from benvin/terraform-rancher into master 2026-07-15 21:37:46 +10:00
Conversation 0 Commits 1 Files Changed 6
+57
unkinben commented 2026-07-15 21:30:15 +10:00
Owner
Copy Link
Copy Source

Why

The new terraform-rancher repo (manages Rancher's Authentik OIDC auth via the rancher2 provider) needs Vault auth + Consul state, mirroring the terraform-authentik runner (#78/#81/#82).

Change

  • AppRole/terraform_rancher + k8s auth role woodpecker_terraform_rancher (SA terraform-rancher in the woodpecker ns).
  • Consul secret-backend role + ACL policy (resources/secret_backend/consul_root/au/syd1/terraform-rancher.hcl) granting write to the infra/terraform/rancher/ state prefix.
  • Vault policies: read the Rancher admin API token (kv/service/terraform/rancher) and the keycloakoidc client secret (kv/kubernetes/namespace/cattle-system/default/oauth-credentials), plus the consul_root state creds.

Scoped the OAuth read to the cattle-system path specifically (rather than the + wildcard the authentik policy uses) since the Rancher runner only needs its own app's secret.

Validation

pre-commit (terragrunt-hcl-fmt + yamllint) passed. CI plan will confirm.

## Why The new `terraform-rancher` repo (manages Rancher's Authentik OIDC auth via the rancher2 provider) needs Vault auth + Consul state, mirroring the terraform-authentik runner (#78/#81/#82). ## Change - `AppRole/terraform_rancher` + k8s auth role `woodpecker_terraform_rancher` (SA terraform-rancher in the woodpecker ns). - Consul secret-backend role + ACL policy (`resources/secret_backend/consul_root/au/syd1/terraform-rancher.hcl`) granting write to the `infra/terraform/rancher/` state prefix. - Vault policies: read the Rancher admin API token (`kv/service/terraform/rancher`) and the keycloakoidc client secret (`kv/kubernetes/namespace/cattle-system/default/oauth-credentials`), plus the consul_root state creds. Scoped the OAuth read to the `cattle-system` path specifically (rather than the `+` wildcard the authentik policy uses) since the Rancher runner only needs its own app's secret. ## Validation pre-commit (terragrunt-hcl-fmt + yamllint) passed. CI plan will confirm.
unkinben added 1 commit 2026-07-15 21:30:15 +10:00
Add auth and state access for terraform-rancher
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
7f4e79a7e2 
Mirrors the terraform-authentik runner setup (#78/#81/#82) for the new
terraform-rancher repo, which manages Rancher's Authentik OIDC auth via the
rancher2 provider.

- AppRole terraform_rancher + k8s auth role woodpecker_terraform_rancher.
- Consul secret backend role + ACL policy granting write to the
  infra/terraform/rancher/ state prefix.
- Vault policies: read the Rancher admin API token
  (kv/service/terraform/rancher) and the keycloakoidc client secret
  (kv/kubernetes/namespace/cattle-system/default/oauth-credentials), plus the
  consul_root state creds.
benvin merged commit 8bb071ae46 into master 2026-07-15 21:37:46 +10:00
benvin deleted branch benvin/terraform-rancher 2026-07-15 21:37:46 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#86
Delete Branch "benvin/terraform-rancher"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?