Deliver the cert helpers to the puppet compiler pods

certmanager and sshsignhost are invoked server-side by generate() during catalog compilation but only exist on the legacy VM masters, so compiles on the k8s compilers fail with "No such file or directory".

- Stage a self-contained EL9 python runtime on the shared bins volume
- Render both helpers from their puppet-prod ERB templates on the code volume rather than copying the scripts here
- Mount a name-dispatching launcher at /usr/local/bin/{certmanager,sshsignhost}
- Mount kubernetes-auth configs at /opt/{certmanager,sshsignhost}/config.yaml

Needs terraform-vault #152 applied and the puppet-prod kubernetes-auth PR merged.

apps/base/artifactapi/oauth2-proxy-configmap.yaml

@@ -39,3 +39,8 @@ data:
   OAUTH2_PROXY_REVERSE_PROXY: "true"
   OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
   OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
+  # Back-channel discovery/token calls resolve the issuer inside the cluster,
+  # where it is served under the internal unkin.net CA rather than the publicly
+  # trusted cert the browser sees. Trust the bundle the combine-certs init
+  # container assembles, as every other oauth2-proxy in the estate does.
+  OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"

apps/base/artifactapi/oauth2-proxy-deployment.yaml

@@ -6,7 +6,7 @@ metadata:
   namespace: artifactapi
   annotations:
     configmap.reloader.stakater.com/auto: "true"
-    secret.reloader.stakater.com/reload: "oauth-credentials"
+    secret.reloader.stakater.com/reload: "oauth-credentials,vault-ca-cert"
 spec:
   replicas: 2
   selector:
@@ -30,6 +30,36 @@ spec:
         fsGroup: 65532
         seccompProfile:
           type: RuntimeDefault
+      initContainers:
+        # The Authentik issuer is served behind the internal unkin.net CA;
+        # combine the system roots with it so oauth2-proxy's OIDC HTTP client
+        # trusts the discovery endpoint.
+        - name: combine-certs
+          image: docker.io/library/alpine:3
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /custom-ca
+              readOnly: true
+            - name: combined-certs
+              mountPath: /combined-certs
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 50m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 64Mi
       containers:
         - name: oauth2-proxy
           image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
@@ -83,6 +113,10 @@ spec:
             capabilities:
               drop:
                 - ALL
+          volumeMounts:
+            - name: combined-certs
+              mountPath: /etc/ssl/combined
+              readOnly: true
           resources:
             requests:
               cpu: 50m
@@ -90,4 +124,13 @@ spec:
             limits:
               cpu: 500m
               memory: 256Mi
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: combined-certs
+          emptyDir: {}
       restartPolicy: Always

apps/base/pdbmux/deployment.yaml

@@ -25,7 +25,7 @@ spec:
         - name: pdbmux
           # Image is published by the pdbmux repo's .woodpecker/docker.yaml on
           # a v* tag. It only exists after that tag is cut (see PR merge gates).
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux:v0.2.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux:v0.4.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

apps/base/puppet/deployment_puppetserver-compiler.yaml

@@ -99,6 +99,24 @@ spec:
         - mountPath: /docker-custom-entrypoint.d/post-startup/additional-ruby-gems.sh
           name: additional-ruby-gems
           subPath: additional-ruby-gems.sh
+        - mountPath: /usr/local/bin/certmanager
+          name: cert-helpers
+          subPath: vault-helper
+        - mountPath: /usr/local/bin/sshsignhost
+          name: cert-helpers
+          subPath: vault-helper
+        - mountPath: /opt/certmanager/config.yaml
+          name: cert-helpers
+          subPath: certmanager-config.yaml
+        - mountPath: /opt/sshsignhost/config.yaml
+          name: cert-helpers
+          subPath: sshsignhost-config.yaml
+        - mountPath: /configmaps/auth.conf
+          name: compiler-auth-conf
+          subPath: auth.conf
+        - mountPath: /docker-custom-entrypoint.d/pre-default/10-auth-conf.sh
+          name: compiler-auth-conf-seed
+          subPath: 10-auth-conf.sh
       initContainers:
       - name: copy-configmaps
         image: busybox:1.35
@@ -200,6 +218,63 @@ spec:
         volumeMounts:
         - mountPath: /opt/bin/
           name: puppet-shared-bins
+
+      - name: setup-cert-helpers
+        image: git.unkin.net/unkin/almalinux9-base:20260606
+        command:
+        - sh
+        - -c
+        args:
+        - |
+          set -e
+          CH=/opt/bin/certhelpers
+          PYROOT=$CH/py-el9-1
+          TPL=/etc/puppetlabs/code/environments/develop/site/profiles/templates/helpers
+          mkdir -p "$CH"
+
+          # The helpers are python3 (requests, pyyaml) and openvoxserver ships
+          # no python, so stage a self-contained EL9 tree once per volume.
+          if [ ! -f "$PYROOT/.ready" ]; then
+            echo "Staging python runtime for the cert helpers..."
+            TMP=$CH/.py-el9-1.$$
+            rm -rf "$TMP"
+            dnf -y --installroot="$TMP" --releasever=9 --nodocs \
+              --setopt=install_weak_deps=0 --disablerepo=unkin install \
+              python3 python3-requests python3-pyyaml python3-six
+            rm -rf "$TMP/var/cache" "$TMP/var/lib/dnf" "$TMP/var/lib/rpm" \
+              "$TMP/usr/share/locale"
+            # Both hardcode EL absolute paths that only exist inside the tree.
+            SP=$TMP/usr/lib/python3.9/site-packages
+            ln -sfn ../../six.py "$SP/urllib3/packages/six.py"
+            sed -i "s|'/etc/pki/tls/certs/ca-bundle.crt'|'$PYROOT/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem'|" \
+              "$SP/requests/certs.py"
+            touch "$TMP/.ready"
+            mv -T "$TMP" "$PYROOT" || rm -rf "$TMP"
+          fi
+
+          # Render from the puppet-prod ERB templates on the code volume so this
+          # repo never carries a second copy of the scripts.
+          for n in certmanager sshsignhost; do
+            sed -e "s|<%= @venv_path %>|$PYROOT/usr|g" \
+                -e "s|<%= @config_path %>|/opt/$n/config.yaml|g" \
+                "$TPL/$n.erb" > "$CH/.$n.$$"
+            chmod 0755 "$CH/.$n.$$"
+            mv "$CH/.$n.$$" "$CH/$n"
+          done
+          echo "Cert helpers setup completed"
+        resources:
+          limits:
+            cpu: 1
+            memory: 1Gi
+          requests:
+            cpu: 200m
+            memory: 256Mi
+        volumeMounts:
+        - mountPath: /opt/bin/
+          name: puppet-shared-bins
+        - mountPath: /etc/puppetlabs/code/
+          name: puppet-code-volume
+          readOnly: true
       securityContext:
         fsGroup: 999
         seccompProfile:
@@ -234,5 +309,25 @@ spec:
         configMap:
           name: additional-ruby-gems
           defaultMode: 0755
+      - name: cert-helpers
+        configMap:
+          name: cert-helpers
+          items:
+          - key: vault-helper
+            path: vault-helper
+            mode: 0755
+          - key: certmanager-config.yaml
+            path: certmanager-config.yaml
+            mode: 0444
+          - key: sshsignhost-config.yaml
+            path: sshsignhost-config.yaml
+            mode: 0444
+      - name: compiler-auth-conf
+        configMap:
+          name: compiler-auth.conf
+      - name: compiler-auth-conf-seed
+        configMap:
+          name: compiler-auth-conf-seed
+          defaultMode: 0755
   strategy:
     type: RollingUpdate

apps/base/puppet/kustomization.yaml

@@ -54,8 +54,25 @@ configMapGenerator:
       - resources/compiler/puppetdb.conf
     options:
       disableNameSuffixHash: true
+  - name: compiler-auth.conf
+    files:
+      - resources/compiler/auth.conf
+    options:
+      disableNameSuffixHash: true
+  - name: compiler-auth-conf-seed
+    files:
+      - resources/compiler/10-auth-conf.sh
+    options:
+      disableNameSuffixHash: true
   - name: additional-ruby-gems
     files:
       - resources/additional-ruby-gems.sh
     options:
       disableNameSuffixHash: true
+  - name: cert-helpers
+    files:
+      - resources/cert-helpers/vault-helper
+      - resources/cert-helpers/certmanager-config.yaml
+      - resources/cert-helpers/sshsignhost-config.yaml
+    options:
+      disableNameSuffixHash: true

apps/base/puppet/resources/cert-helpers/certmanager-config.yaml

@@ -0,0 +1,12 @@
+---
+# profiles::helpers::certmanager::vault_config, with kubernetes auth: the
+# certmanager approle is CIDR-bound to the legacy VM masters.
+vault:
+  addr: 'https://vault.service.consul:8200'
+  auth_method: 'kubernetes'
+  k8s_mount: 'k8s/au/syd1'
+  k8s_role: 'puppet_certmanager'
+  jwt_path: '/var/run/secrets/kubernetes.io/serviceaccount/token'
+  mount_point: 'pki_int'
+  role_name: 'servers_default'
+output_path: '/tmp/certmanager'

apps/base/puppet/resources/cert-helpers/sshsignhost-config.yaml

@@ -0,0 +1,11 @@
+---
+# profiles::helpers::sshsignhost::vault_config, with kubernetes auth.
+vault:
+  addr: 'https://vault.service.consul:8200'
+  auth_method: 'kubernetes'
+  k8s_mount: 'k8s/au/syd1'
+  k8s_role: 'puppet_sshsigner'
+  jwt_path: '/var/run/secrets/kubernetes.io/serviceaccount/token'
+  mount_point: 'ssh-host-signer'
+  role_name: 'hostrole'
+output_path: '/tmp/sshsignhost'

apps/base/puppet/resources/cert-helpers/vault-helper

@@ -0,0 +1,11 @@
+#!/bin/sh
+# Runs the certmanager/sshsignhost helper matching the name it is invoked as.
+# The openvoxserver image has no python, so the EL9 tree staged on the shared
+# bins volume is started through its own dynamic loader.
+set -eu
+
+PYROOT=/opt/bin/certhelpers/py-el9-1
+
+exec "${PYROOT}/lib64/ld-linux-x86-64.so.2" \
+  --library-path "${PYROOT}/lib64:${PYROOT}/usr/lib64" \
+  "${PYROOT}/usr/bin/python3.9" "/opt/bin/certhelpers/${0##*/}" "$@"

apps/base/puppet/resources/compiler/10-auth-conf.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+set -euo pipefail
+
+SRC=/configmaps/auth.conf
+DST=/etc/puppetlabs/puppetserver/conf.d/auth.conf
+
+# Copied rather than mounted: the entrypoint chowns conf.d and rewrites auth.conf,
+# both of which fail on a read-only configmap mount and abort container startup.
+if [ ! -s "$SRC" ]; then
+  echo "FATAL: $SRC missing or empty; refusing to start on the image default auth.conf" >&2
+  exit 1
+fi
+
+cp "$SRC" "$DST"

apps/base/puppet/resources/compiler/auth.conf

@@ -0,0 +1,320 @@
+# Copied into conf.d at startup by 10-auth-conf.sh; the entrypoint then appends the
+# admin API cache rule and re-renders the result, so the running file is not byte-identical.
+authorization: {
+    version: 1
+    rules: [
+        {
+            # Allow nodes to retrieve their own catalog
+            match-request: {
+                path: "^/puppet/v3/catalog/([^/]+)$"
+                type: regex
+                method: [get, post]
+            }
+            allow: "$1"
+            sort-order: 500
+            name: "puppetlabs v3 catalog from agents"
+        },
+        {
+            # Allow catalog-diff to retrieve catalogs on behalf of others.
+            # sort-order 400 must stay lower than the puppetlabs deny that follows: rules
+            # sort by [sort-order, name] and the first match wins.
+            match-request: {
+                path: "^/puppet/v4/catalog/?$"
+                type: regex
+                method: post
+            }
+            allow: "catalog-diff.main.unkin.net"
+            sort-order: 400
+            name: "unkin v4 catalog for catalog-diff"
+        },
+        {
+            # Allow services to retrieve catalogs on behalf of others
+            match-request: {
+                path: "^/puppet/v4/catalog/?$"
+                type: regex
+                method: post
+            }
+            deny: "*"
+            sort-order: 500
+            name: "puppetlabs v4 catalog for services"
+        },
+        {
+            # Allow nodes to retrieve the certificate they requested earlier
+            match-request: {
+                path: "/puppet-ca/v1/certificate/"
+                type: path
+                method: get
+            }
+            allow-unauthenticated: true
+            sort-order: 500
+            name: "puppetlabs certificate"
+        },
+        {
+            # Allow all nodes to access the certificate revocation list
+            match-request: {
+                path: "/puppet-ca/v1/certificate_revocation_list/ca"
+                type: path
+                method: get
+            }
+            allow-unauthenticated: true
+            sort-order: 500
+            name: "puppetlabs crl"
+        },
+        {
+            # Allow nodes to request a new certificate
+            match-request: {
+                path: "/puppet-ca/v1/certificate_request"
+                type: path
+                method: [get, put]
+            }
+            allow-unauthenticated: true
+            sort-order: 500
+            name: "puppetlabs csr"
+        },
+        {
+            # Allow nodes to renew their certificate
+            match-request: {
+                path: "/puppet-ca/v1/certificate_renewal"
+                type: path
+                method: post
+            }
+            # this endpoint should never be unauthenticated, as it requires the cert to be provided.
+            allow: "*"
+            sort-order: 500
+            name: "puppetlabs certificate renewal"
+        },
+        {
+            # Allow the CA CLI to access the certificate_status endpoint
+            match-request: {
+                path: "/puppet-ca/v1/certificate_status"
+                type: path
+                method: [get, put, delete]
+            }
+            allow: {
+               extensions: {
+                   pp_cli_auth: "true"
+               }
+            }
+            sort-order: 500
+            name: "puppetlabs cert status"
+        },
+        {
+            match-request: {
+                path: "^/puppet-ca/v1/certificate_revocation_list$"
+                type: regex
+                method: put
+            }
+            allow: {
+               extensions: {
+                   pp_cli_auth: "true"
+               }
+            }
+            sort-order: 500
+            name: "puppetlabs CRL update"
+        },
+        {
+            # Allow the CA CLI to access the certificate_statuses endpoint
+            match-request: {
+                path: "/puppet-ca/v1/certificate_statuses"
+                type: path
+                method: get
+            }
+            allow: {
+               extensions: {
+                   pp_cli_auth: "true"
+               }
+            }
+            sort-order: 500
+            name: "puppetlabs cert statuses"
+        },
+        {
+            # Allow authenticated access to the CA expirations endpoint
+            match-request: {
+                path: "/puppet-ca/v1/expirations"
+                type: path
+                method: get
+            }
+            allow: "*"
+            sort-order: 500
+            name: "puppetlabs CA cert and CRL expirations"
+        },
+        {
+            # Allow the CA CLI to access the certificate clean endpoint
+            match-request: {
+                path: "/puppet-ca/v1/clean"
+                type: path
+                method: put
+            }
+            allow: {
+               extensions: {
+                   pp_cli_auth: "true"
+               }
+            }
+            sort-order: 500
+            name: "puppetlabs cert clean"
+        },
+        {
+            # Allow the CA CLI to access the certificate sign endpoint
+            match-request: {
+                path: "/puppet-ca/v1/sign"
+                type: path
+                method: post
+            }
+            allow: {
+               extensions: {
+                   pp_cli_auth: "true"
+               }
+            }
+            sort-order: 500
+            name: "puppetlabs cert sign"
+        },
+        {
+            # Allow the CA CLI to access the certificate sign all endpoint
+            match-request: {
+                path: "/puppet-ca/v1/sign/all"
+                type: path
+                method: post
+            }
+            allow: {
+               extensions: {
+                   pp_cli_auth: "true"
+               }
+            }
+            sort-order: 500
+            name: "puppetlabs cert sign all"
+        },
+        {
+            # Allow unauthenticated access to the status service endpoint
+            match-request: {
+                path: "/status/v1/services"
+                type: path
+                method: get
+            }
+            allow-unauthenticated: true
+            sort-order: 500
+            name: "puppetlabs status service - full"
+        },
+        {
+            match-request: {
+                path: "/status/v1/simple"
+                type: path
+                method: get
+            }
+            allow-unauthenticated: true
+            sort-order: 500
+            name: "puppetlabs status service - simple"
+        },
+        {
+            match-request: {
+                path: "/puppet/v3/environments"
+                type: path
+                method: get
+            }
+            allow: "*"
+            sort-order: 500
+            name: "puppetlabs environments"
+        },
+        {
+            # Allow nodes to access all file_bucket_files.  Note that access for
+            # the 'delete' method is forbidden by Puppet regardless of the
+            # configuration of this rule.
+            match-request: {
+                path: "/puppet/v3/file_bucket_file"
+                type: path
+                method: [get, head, post, put]
+            }
+            allow: "*"
+            sort-order: 500
+            name: "puppetlabs file bucket file"
+        },
+        {
+            # Allow nodes to access all file_content.  Note that access for the
+            # 'delete' method is forbidden by Puppet regardless of the
+            # configuration of this rule.
+            match-request: {
+                path: "/puppet/v3/file_content"
+                type: path
+                method: [get, post]
+            }
+            allow: "*"
+            sort-order: 500
+            name: "puppetlabs file content"
+        },
+        {
+            # Allow nodes to access all file_metadata.  Note that access for the
+            # 'delete' method is forbidden by Puppet regardless of the
+            # configuration of this rule.
+            match-request: {
+                path: "/puppet/v3/file_metadata"
+                type: path
+                method: [get, post]
+            }
+            allow: "*"
+            sort-order: 500
+            name: "puppetlabs file metadata"
+        },
+        {
+            # Allow nodes to retrieve only their own node definition
+            match-request: {
+                path: "^/puppet/v3/node/([^/]+)$"
+                type: regex
+                method: get
+            }
+            allow: "$1"
+            sort-order: 500
+            name: "puppetlabs node"
+        },
+        {
+            # Allow nodes to store only their own reports
+            match-request: {
+                path: "^/puppet/v3/report/([^/]+)$"
+                type: regex
+                method: put
+            }
+            allow: "$1"
+            sort-order: 500
+            name: "puppetlabs report"
+        },
+        {
+            # Allow nodes to update their own facts
+            match-request: {
+                path: "^/puppet/v3/facts/([^/]+)$"
+                type: regex
+                method: put
+            }
+            allow: "$1"
+            sort-order: 500
+            name: "puppetlabs facts"
+        },
+        {
+            match-request: {
+                path: "/puppet/v3/static_file_content"
+                type: path
+                method: get
+            }
+            allow: "*"
+            sort-order: 500
+            name: "puppetlabs static file content"
+        },
+        {
+            match-request: {
+                path: "/puppet/v3/tasks"
+                type: path
+            }
+            allow: "*"
+            sort-order: 500
+            name: "puppet tasks information"
+        },
+        {
+            # Deny everything else. This ACL is not strictly
+            # necessary, but illustrates the default policy
+            match-request: {
+                path: "/"
+                type: path
+            }
+            deny: "*"
+            sort-order: 999
+            name: "puppetlabs deny all"
+        }
+    ]
+}

apps/overlays/au-syd1/woodpecker/values.yaml

@@ -4,7 +4,7 @@ agent:
     WOODPECKER_MAX_WORKFLOWS: "8"
     WOODPECKER_BACKEND_K8S_PRIORITY_CLASS: power
     WOODPECKER_BACKEND_K8S_STORAGE_CLASS: cephrbd-fast-delete
-    WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G
+    WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 20Gi
     WOODPECKER_BACKEND_K8S_STORAGE_RWX: false
     # Required from woodpecker 3.16.0 (GHSA-qf34-295c-26v8): step-level
     # serviceAccountName is gated behind this agent flag (default false).