unkin-agent
b225ef6344
Human access to OpenBao is LDAP-only today, so operators carry a second set of credentials outside Authentik and group membership is maintained twice. This makes Authentik SSO the offered default on the UI login page and gives `bao login -method=oidc` a working CLI path, while approle and kubernetes (CI and agents) plus the break-glass root path are untouched. Add three modules mirroring the auth_ldap_* structure: auth_oidc_backend mounts a vault_jwt_auth_backend of type oidc, auth_oidc_role creates the default login role, and auth_oidc_group creates an external vault_identity_group plus its group alias so IdP groups map onto policies. Mount the backend at the literal path "oidc". The Authentik provider registers strict redirect URIs containing /ui/vault/auth/oidc/oidc/callback, so the path is load-bearing and must not be renamed. Read client_id and client_secret from kv/service/authentik/oidc-vault, which terraform-authentik generates and writes; nothing is seeded by hand. Match groups on the ak_groups claim rather than groups, because Authentik's default profile mapping only emits direct memberships and the estate nests akP-* permission groups under akR-* roles. Bind akP-vault-admin to global-root, the same policy the LDAP vault_admin group already carries. Only akP-* permission groups are named in config or policy; akR-* roles stay grouping-only. Grant the deployer auth/oidc/* and identity group management, both of which it currently lacks. AppRole capabilities are fixed at login, so these land in an apply before the resources that need them.
111 lines
4.4 KiB
HCL
111 lines
4.4 KiB
HCL
include "root" {
|
|
path = find_in_parent_folders("root.hcl")
|
|
expose = true
|
|
}
|
|
|
|
include "config" {
|
|
path = "${get_repo_root()}/config/config.hcl"
|
|
expose = true
|
|
}
|
|
|
|
include "policies" {
|
|
path = "${get_repo_root()}/policies/policies.hcl"
|
|
expose = true
|
|
}
|
|
|
|
include "resources" {
|
|
path = "${get_repo_root()}/resources/resources.hcl"
|
|
expose = true
|
|
}
|
|
|
|
locals {
|
|
# Extract country and region from path
|
|
path_parts = split("/", dirname(get_terragrunt_dir()))
|
|
country = basename(dirname(get_terragrunt_dir())) # "au"
|
|
region = basename(get_terragrunt_dir()) # "syd1"
|
|
|
|
# Include configuration from config.hcl
|
|
config = include.config.locals.config
|
|
|
|
# Include policies from policies.hcl
|
|
policies = include.policies.locals
|
|
|
|
# Include resources from resources.hcl
|
|
resources = include.resources.locals
|
|
|
|
# Create sanitized backend name mapping for Consul providers
|
|
# Provider aliases can't contain slashes, so replace them with underscores
|
|
consul_backend_aliases = {
|
|
for backend_name, _ in local.config.consul_secret_backend :
|
|
backend_name => replace(backend_name, "/", "_")
|
|
}
|
|
|
|
# Same sanitized alias mapping for the NetBox providers.
|
|
netbox_backend_aliases = {
|
|
for backend_name, _ in local.config.netbox_secret_backend :
|
|
backend_name => replace(backend_name, "/", "_")
|
|
}
|
|
}
|
|
|
|
terraform {
|
|
source = "../../../modules/vault_cluster"
|
|
}
|
|
|
|
inputs = {
|
|
country = local.country
|
|
region = local.region
|
|
|
|
# Pass configuration maps to vault_cluster module
|
|
auth_approle_backend = local.config.auth_approle_backend
|
|
auth_approle_role = local.config.auth_approle_role
|
|
auth_ldap_backend = local.config.auth_ldap_backend
|
|
auth_ldap_group = local.config.auth_ldap_group
|
|
auth_oidc_backend = local.config.auth_oidc_backend
|
|
auth_oidc_role = local.config.auth_oidc_role
|
|
auth_oidc_group = local.config.auth_oidc_group
|
|
auth_kubernetes_backend = local.config.auth_kubernetes_backend
|
|
auth_kubernetes_role = local.config.auth_kubernetes_role
|
|
kv_secret_backend = local.config.kv_secret_backend
|
|
transit_secret_backend = local.config.transit_secret_backend
|
|
transit_secret_backend_key = local.config.transit_secret_backend_key
|
|
ssh_secret_backend = local.config.ssh_secret_backend
|
|
ssh_secret_backend_role = local.config.ssh_secret_backend_role
|
|
pki_secret_backend = local.config.pki_secret_backend
|
|
pki_secret_backend_role = local.config.pki_secret_backend_role
|
|
consul_secret_backend = local.config.consul_secret_backend
|
|
consul_secret_backend_role = local.config.consul_secret_backend_role
|
|
kubernetes_secret_backend = local.config.kubernetes_secret_backend
|
|
kubernetes_secret_backend_role = local.config.kubernetes_secret_backend_role
|
|
pki_mount_only = local.config.pki_mount_only
|
|
litellm_secret_backend = local.config.litellm_secret_backend
|
|
litellm_secret_backend_role = local.config.litellm_secret_backend_role
|
|
arrstack_secret_backend = local.config.arrstack_secret_backend
|
|
arrstack_secret_backend_role = local.config.arrstack_secret_backend_role
|
|
plugins = local.config.plugins
|
|
gpg_secret_backend = local.config.gpg_secret_backend
|
|
gpg_key = local.config.gpg_key
|
|
|
|
rancher_secret_backend = local.config.rancher_secret_backend
|
|
rancher_secret_backend_service_account = local.config.rancher_secret_backend_service_account
|
|
rancher_secret_backend_role = local.config.rancher_secret_backend_role
|
|
|
|
gitea_secret_backend = local.config.gitea_secret_backend
|
|
gitea_secret_backend_role = local.config.gitea_secret_backend_role
|
|
|
|
netbox_secret_backend = local.config.netbox_secret_backend
|
|
netbox_secret_backend_role = local.config.netbox_secret_backend_role
|
|
|
|
ghp_secret_backend = local.config.ghp_secret_backend
|
|
ghp_secret_backend_role = local.config.ghp_secret_backend_role
|
|
|
|
# Pass policy maps to vault_cluster module
|
|
policy_auth_map = local.policies.policy_auth_map
|
|
policy_rules_map = local.policies.policy_rules_map
|
|
|
|
# Pass sanitized consul backend aliases for provider configuration
|
|
consul_backend_aliases = local.consul_backend_aliases
|
|
|
|
# Pass sanitized netbox backend aliases for provider configuration
|
|
netbox_backend_aliases = local.netbox_backend_aliases
|
|
}
|