terraform-vault/config/auth_approle_role/approle/terraform_rancher.yaml at e90070b9a02e84a5d480ad99caf292e531ea7bd3 - terraform-vault - Gitea

unkin/terraform-vault

Files

T

unkinben 8bb071ae46

ci/woodpecker/push/apply Pipeline was successful

Details

Add auth and state access for terraform-rancher (#86 )

## Why

The new `terraform-rancher` repo (manages Rancher's Authentik OIDC auth via the rancher2 provider) needs Vault auth + Consul state, mirroring the terraform-authentik runner (#78/#81/#82).

## Change

- `AppRole/terraform_rancher` + k8s auth role `woodpecker_terraform_rancher` (SA terraform-rancher in the woodpecker ns).
- Consul secret-backend role + ACL policy (`resources/secret_backend/consul_root/au/syd1/terraform-rancher.hcl`) granting write to the `infra/terraform/rancher/` state prefix.
- Vault policies: read the Rancher admin API token (`kv/service/terraform/rancher`) and the keycloakoidc client secret (`kv/kubernetes/namespace/cattle-system/default/oauth-credentials`), plus the consul_root state creds.

Scoped the OAuth read to the `cattle-system` path specifically (rather than the `+` wildcard the authentik policy uses) since the Rancher runner only needs its own app's secret.

## Validation

pre-commit (terragrunt-hcl-fmt + yamllint) passed. CI plan will confirm.

Reviewed-on: #86
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

2026-07-15 21:37:45 +10:00

10 lines

196 B

YAML

Raw Blame History

 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
   - "10.10.12.200/32"
   - "198.18.25.102/32"
   - "198.18.26.91/32"
   - "198.18.27.40/32"
 use_deterministic_role_id: true