unkinben
8bb071ae46
ci/woodpecker/push/apply Pipeline was successful
## Why The new `terraform-rancher` repo (manages Rancher's Authentik OIDC auth via the rancher2 provider) needs Vault auth + Consul state, mirroring the terraform-authentik runner (#78/#81/#82). ## Change - `AppRole/terraform_rancher` + k8s auth role `woodpecker_terraform_rancher` (SA terraform-rancher in the woodpecker ns). - Consul secret-backend role + ACL policy (`resources/secret_backend/consul_root/au/syd1/terraform-rancher.hcl`) granting write to the `infra/terraform/rancher/` state prefix. - Vault policies: read the Rancher admin API token (`kv/service/terraform/rancher`) and the keycloakoidc client secret (`kv/kubernetes/namespace/cattle-system/default/oauth-credentials`), plus the consul_root state creds. Scoped the OAuth read to the `cattle-system` path specifically (rather than the `+` wildcard the authentik policy uses) since the Rancher runner only needs its own app's secret. ## Validation pre-commit (terragrunt-hcl-fmt + yamllint) passed. CI plan will confirm. Reviewed-on: #86 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
19 lines
535 B
YAML
19 lines
535 B
YAML
# Allow the Terraform Rancher runner to read:
|
|
# - its own Rancher admin API token (rancher2 provider auth), and
|
|
# - the OAuth2/OIDC client secret backing the Rancher keycloakoidc AuthConfig
|
|
# (same secret Authentik sets on the provider).
|
|
---
|
|
rules:
|
|
- path: "kv/data/service/terraform/rancher"
|
|
capabilities:
|
|
- read
|
|
- path: "kv/data/kubernetes/namespace/cattle-system/default/oauth-credentials"
|
|
capabilities:
|
|
- read
|
|
|
|
auth:
|
|
approle:
|
|
- terraform_rancher
|
|
k8s/au/syd1:
|
|
- woodpecker_terraform_rancher
|