Give the puppetserver compilers the Vault cert helpers (#482)

profiles::pki::vault and profiles::ssh::sign shell out to
/usr/local/bin/certmanager and /usr/local/bin/sshsignhost from generate()
during catalog compilation. Neither binary exists in the compiler image, so
every node using them fails to compile.

- install certmanager v0.2.0 and sshsignhost v0.1.0 onto the shared bin volume with sha256 verification
- wrap both at /usr/local/bin from a pre-default entrypoint hook, failing startup loudly if either is missing
- mount read-only Vault configs for both: kubernetes auth on k8s/au/syd1, internal CA verified rather than skipped

Reviewed-on: #482
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/puppet/deployment_puppetserver-compiler.yaml

@@ -105,6 +105,17 @@ spec:
         - mountPath: /docker-custom-entrypoint.d/pre-default/10-auth-conf.sh
           name: compiler-auth-conf-seed
           subPath: 10-auth-conf.sh
+        - mountPath: /docker-custom-entrypoint.d/pre-default/20-vault-helpers.sh
+          name: compiler-vault-helpers-seed
+          subPath: 20-vault-helpers.sh
+        - mountPath: /opt/certmanager/config.yaml
+          name: certmanager-config
+          subPath: certmanager.yaml
+          readOnly: true
+        - mountPath: /opt/sshsignhost/config.yaml
+          name: sshsignhost-config
+          subPath: sshsignhost.yaml
+          readOnly: true
       initContainers:
       - name: copy-configmaps
         image: busybox:1.35
@@ -202,7 +213,38 @@ spec:
           echo "$EXPECTED  encapic" | sha256sum -c -
           install -m 0755 encapic /opt/bin/encapic
 
+          # Puppet shells out to these two from generate() during catalog
+          # compilation: profiles::pki::vault runs certmanager and
+          # profiles::ssh::sign runs sshsignhost.
+          install_release() {
+            name=$1
+            version=$2
+            asset="$name-linux-amd64"
+            base="https://git.unkin.net/unkin/$name/releases/download/$version"
+            curl -fsSL -o "$name" "$base/$asset"
+            curl -fsSL -o "$name.checksums" "$base/checksums.txt"
+            # checksums.txt covers every release asset; pick the line for the
+            # one we downloaded and verify it under our local filename.
+            expected=$(awk -v a="$asset" '$NF == a || $NF == "*"a {print $1}' "$name.checksums")
+            if [ -z "$expected" ]; then
+              echo "no checksum for $asset in $version checksums.txt" >&2
+              exit 1
+            fi
+            echo "$expected  $name" | sha256sum -c -
+            install -m 0755 "$name" "/opt/bin/$name"
+          }
+
+          install_release certmanager v0.2.0
+          install_release sshsignhost v0.1.0
+
           echo "Shared binaries setup completed"
+        resources:
+          limits:
+            cpu: 300m
+            memory: 256Mi
+          requests:
+            cpu: 100m
+            memory: 64Mi
         volumeMounts:
         - mountPath: /opt/bin/
           name: puppet-shared-bins
@@ -247,5 +289,15 @@ spec:
         configMap:
           name: compiler-auth-conf-seed
           defaultMode: 0755
+      - name: compiler-vault-helpers-seed
+        configMap:
+          name: compiler-vault-helpers-seed
+          defaultMode: 0755
+      - name: certmanager-config
+        configMap:
+          name: certmanager-config
+      - name: sshsignhost-config
+        configMap:
+          name: sshsignhost-config
   strategy:
     type: RollingUpdate