unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Give the puppetserver compilers the Vault cert helpers #482

Merged
benvin merged 1 commits from benvin/puppetserver-cert-helpers into main 2026-09-24 21:15:11 +10:00
Conversation 1 Commits 1 Files Changed 5
+119
unkin-agent commented 2026-09-22 22:41:25 +10:00
Member
Copy Link
Copy Source

profiles::pki::vault and profiles::ssh::sign shell out to
/usr/local/bin/certmanager and /usr/local/bin/sshsignhost from generate()
during catalog compilation. Neither binary exists in the compiler image, so
every node using them fails to compile.

  • install certmanager v0.2.0 and sshsignhost v0.1.0 onto the shared bin volume with sha256 verification
  • wrap both at /usr/local/bin from a pre-default entrypoint hook, failing startup loudly if either is missing
  • mount read-only Vault configs for both: kubernetes auth on k8s/au/syd1, internal CA verified rather than skipped
profiles::pki::vault and profiles::ssh::sign shell out to /usr/local/bin/certmanager and /usr/local/bin/sshsignhost from generate() during catalog compilation. Neither binary exists in the compiler image, so every node using them fails to compile. - install certmanager v0.2.0 and sshsignhost v0.1.0 onto the shared bin volume with sha256 verification - wrap both at /usr/local/bin from a pre-default entrypoint hook, failing startup loudly if either is missing - mount read-only Vault configs for both: kubernetes auth on k8s/au/syd1, internal CA verified rather than skipped
unkin-agent added 1 commit 2026-09-22 22:41:25 +10:00
Give the puppetserver compilers the Vault cert helpers
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
3e33d963a1 
Install certmanager and sshsignhost on the shared bin volume, expose them
at the /usr/local/bin paths Puppet shells out to, and ship their Vault
configs so generate() succeeds during catalog compilation.
unkin-agent commented 2026-09-22 22:54:41 +10:00
Author
Member
Copy Link
Copy Source
  • nit: apps/base/puppet/deployment_puppetserver-compiler.yaml:217-223 — the resources: block on setup-shared-bins is unrelated to the stated why, and it only half-fixes the file: copy-configmaps above still has neither resources nor a securityContext, and setup-shared-bins still has no securityContext while both other containers drop: [all] → either finish both init containers or split the hygiene into its own PR.
- nit: `apps/base/puppet/deployment_puppetserver-compiler.yaml:217-223` — the `resources:` block on `setup-shared-bins` is unrelated to the stated why, and it only half-fixes the file: `copy-configmaps` above still has neither `resources` nor a `securityContext`, and `setup-shared-bins` still has no `securityContext` while both other containers `drop: [all]` → either finish both init containers or split the hygiene into its own PR.
benvin merged commit fe51aa07be into main 2026-09-24 21:15:11 +10:00
benvin deleted branch benvin/puppetserver-cert-helpers 2026-09-24 21:15:11 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#482
Delete Branch "benvin/puppetserver-cert-helpers"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?