terraform-vault/policies/consul_root/au/syd1/creds/terraform-rancher.yaml at e90070b9a02e84a5d480ad99caf292e531ea7bd3 - terraform-vault - Gitea

unkin/terraform-vault

Files

T

unkinben 8bb071ae46

ci/woodpecker/push/apply Pipeline was successful

Details

Add auth and state access for terraform-rancher (#86 )

## Why

The new `terraform-rancher` repo (manages Rancher's Authentik OIDC auth via the rancher2 provider) needs Vault auth + Consul state, mirroring the terraform-authentik runner (#78/#81/#82).

## Change

- `AppRole/terraform_rancher` + k8s auth role `woodpecker_terraform_rancher` (SA terraform-rancher in the woodpecker ns).
- Consul secret-backend role + ACL policy (`resources/secret_backend/consul_root/au/syd1/terraform-rancher.hcl`) granting write to the `infra/terraform/rancher/` state prefix.
- Vault policies: read the Rancher admin API token (`kv/service/terraform/rancher`) and the keycloakoidc client secret (`kv/kubernetes/namespace/cattle-system/default/oauth-credentials`), plus the consul_root state creds.

Scoped the OAuth read to the `cattle-system` path specifically (rather than the `+` wildcard the authentik policy uses) since the Rancher runner only needs its own app's secret.

## Validation

pre-commit (terragrunt-hcl-fmt + yamllint) passed. CI plan will confirm.

Reviewed-on: #86
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

2026-07-15 21:37:45 +10:00

12 lines

190 B

YAML

Raw Blame History

 ---
 rules:
   - path: "consul_root/au/syd1/creds/terraform-rancher"
     capabilities:
       - read
 auth:
   approle:
     - terraform_rancher
   k8s/au/syd1:
     - woodpecker_terraform_rancher