Mount the rancher secrets engine + seed a service account + roles #93

2026-07-17T23:46:22+10:00

unkinben commented

2026-07-17 23:46:22 +10:00

Why

Deploy the new Rancher token secrets engine into the cluster (the last of the 4 wiring PRs), mirroring the litellm/gpg pattern. Users can then vault read rancher/creds/<role> for short-lived, cluster-scoped Rancher tokens, backed by a seeded admin token the engine auto-rotates before Rancher's 90-day cap.

Changes

Add rancher_secret_backend module — mount + config via the ranchervaultsecret provider (rancher_url https://rancher.k8s.syd1.au.unkin.net).
Add rancher_secret_backend_service_account module — seeds an auto-rotated token (90d TTL / 45d rotation); the seed token is read from KV, not git.
Add rancher_secret_backend_role module + a ci role (1h/8h, cluster+TTL scoped).
Wire config.hcl discovery, module variables, main.tf blocks, terragrunt inputs, and the rancher provider in root.hcl.
Config: config/rancher_secret_backend/rancher.yaml, .../service_account/rancher/admin.yaml, .../role/rancher/ci.yaml.

Prerequisite

Populate kv/service/vault/au/syd1/secret_backend/rancher/service_account/admin with a live Rancher admin token (keys: token, optional token_name) before apply, exactly as litellm's master_key is seeded in KV.

Merge order

Part 4 of 4 (last). Requires: puppet install (#483) → deployer policy (#91) → plugin import (#92) → this. The plan needs the KV seed present, so seed KV first.

## Why Deploy the new Rancher token secrets engine into the cluster (the last of the 4 wiring PRs), mirroring the litellm/gpg pattern. Users can then `vault read rancher/creds/<role>` for short-lived, cluster-scoped Rancher tokens, backed by a seeded admin token the engine auto-rotates before Rancher's 90-day cap. ## Changes - Add `rancher_secret_backend` module — mount + config via the ranchervaultsecret provider (rancher_url `https://rancher.k8s.syd1.au.unkin.net`). - Add `rancher_secret_backend_service_account` module — seeds an auto-rotated token (90d TTL / 45d rotation); the seed token is read from KV, not git. - Add `rancher_secret_backend_role` module + a `ci` role (1h/8h, cluster+TTL scoped). - Wire `config.hcl` discovery, module variables, `main.tf` blocks, terragrunt inputs, and the `rancher` provider in `root.hcl`. - Config: `config/rancher_secret_backend/rancher.yaml`, `.../service_account/rancher/admin.yaml`, `.../role/rancher/ci.yaml`. ## Prerequisite Populate `kv/service/vault/au/syd1/secret_backend/rancher/service_account/admin` with a live Rancher admin token (keys: `token`, optional `token_name`) **before** apply, exactly as litellm's `master_key` is seeded in KV. ## Merge order Part 4 of 4 (last). Requires: puppet install (#483) → deployer policy (#91) → plugin import (#92) → this. The `plan` needs the KV seed present, so seed KV first.

unkinben added 1 commit 2026-07-17 23:46:23 +10:00

Mount the rancher secrets engine + seed a service account + roles

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

f887489193

Deploys the Rancher token secrets engine into the cluster, mirroring the litellm
and gpg wiring. The plugin is registered separately (config/plugins) and the
deployer policy is granted separately; this mounts and configures the engine.

- Add rancher_secret_backend module (mount + config via the ranchervaultsecret
  provider): rancher_url https://rancher.k8s.syd1.au.unkin.net.
- Add rancher_secret_backend_service_account module: seeds an auto-rotated token
  (90d TTL / 45d rotation), reading the seed token from KV at
  secret_backend/rancher/service_account/<name> (keys: token, token_name).
- Add rancher_secret_backend_role module + a 'ci' role (1h/8h scoped creds).
- Wire config.hcl discovery, module variables, main.tf module blocks, the
  terragrunt inputs, and the rancher provider in root.hcl.

Prereq: populate kv/service/vault/au/syd1/secret_backend/rancher/service_account/admin
with a live Rancher admin token before apply.

benvin merged commit 87e3ada14f into master

2026-07-18 16:16:54 +10:00

benvin deleted branch benvin/rancher-secrets-engine

2026-07-18 16:16:55 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-vault#93