Mount the rancher secrets engine + seed a service account + roles #93

2026-07-17T23:46:22+10:00

unkinben commented

2026-07-17 23:46:22 +10:00

Why

Deploy the new Rancher token secrets engine into the cluster (the last of the 4 wiring PRs), mirroring the litellm/gpg pattern. Users can then vault read rancher/creds/<role> for short-lived, cluster-scoped Rancher tokens, backed by a seeded admin token the engine auto-rotates before Rancher's 90-day cap.

Changes

Add rancher_secret_backend module — mount + config via the ranchervaultsecret provider (rancher_url https://rancher.k8s.syd1.au.unkin.net).
Add rancher_secret_backend_service_account module — seeds an auto-rotated token (90d TTL / 45d rotation); the seed token is read from KV, not git.
Add rancher_secret_backend_role module + a ci role (1h/8h, cluster+TTL scoped).
Wire config.hcl discovery, module variables, main.tf blocks, terragrunt inputs, and the rancher provider in root.hcl.
Config: config/rancher_secret_backend/rancher.yaml, .../service_account/rancher/admin.yaml, .../role/rancher/ci.yaml.

Prerequisite

Populate kv/service/vault/au/syd1/secret_backend/rancher/service_account/admin with a live Rancher admin token (keys: token, optional token_name) before apply, exactly as litellm's master_key is seeded in KV.

Merge order

Part 4 of 4 (last). Requires: puppet install (#483) → deployer policy (#91) → plugin import (#92) → this. The plan needs the KV seed present, so seed KV first.

## Why Deploy the new Rancher token secrets engine into the cluster (the last of the 4 wiring PRs), mirroring the litellm/gpg pattern. Users can then `vault read rancher/creds/<role>` for short-lived, cluster-scoped Rancher tokens, backed by a seeded admin token the engine auto-rotates before Rancher's 90-day cap. ## Changes - Add `rancher_secret_backend` module — mount + config via the ranchervaultsecret provider (rancher_url `https://rancher.k8s.syd1.au.unkin.net`). - Add `rancher_secret_backend_service_account` module — seeds an auto-rotated token (90d TTL / 45d rotation); the seed token is read from KV, not git. - Add `rancher_secret_backend_role` module + a `ci` role (1h/8h, cluster+TTL scoped). - Wire `config.hcl` discovery, module variables, `main.tf` blocks, terragrunt inputs, and the `rancher` provider in `root.hcl`. - Config: `config/rancher_secret_backend/rancher.yaml`, `.../service_account/rancher/admin.yaml`, `.../role/rancher/ci.yaml`. ## Prerequisite Populate `kv/service/vault/au/syd1/secret_backend/rancher/service_account/admin` with a live Rancher admin token (keys: `token`, optional `token_name`) **before** apply, exactly as litellm's `master_key` is seeded in KV. ## Merge order Part 4 of 4 (last). Requires: puppet install (#483) → deployer policy (#91) → plugin import (#92) → this. The `plan` needs the KV seed present, so seed KV first.

unkinben added 1 commit 2026-07-17 23:46:23 +10:00

Mount the rancher secrets engine + seed a service account + roles

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

f887489193

Deploys the Rancher token secrets engine into the cluster, mirroring the litellm
and gpg wiring. The plugin is registered separately (config/plugins) and the
deployer policy is granted separately; this mounts and configures the engine.

- Add rancher_secret_backend module (mount + config via the ranchervaultsecret
  provider): rancher_url https://rancher.k8s.syd1.au.unkin.net.
- Add rancher_secret_backend_service_account module: seeds an auto-rotated token
  (90d TTL / 45d rotation), reading the seed token from KV at
  secret_backend/rancher/service_account/<name> (keys: token, token_name).
- Add rancher_secret_backend_role module + a 'ci' role (1h/8h scoped creds).
- Wire config.hcl discovery, module variables, main.tf module blocks, the
  terragrunt inputs, and the rancher provider in root.hcl.

Prereq: populate kv/service/vault/au/syd1/secret_backend/rancher/service_account/admin
with a live Rancher admin token before apply.

ci/woodpecker/pr/pre-commit Pipeline was successful

Required

Details

ci/woodpecker/pr/plan Pipeline was successful

Required

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin benvin/rancher-secrets-engine:benvin/rancher-secrets-engine

git checkout benvin/rancher-secrets-engine

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-vault#93