Install certmanager and sshsignhost from RPM

certmanager and sshsignhost are now Go binaries released as RPMs, and their
packaged paths collide with the venv install these helper classes manage.

- Drop the pyvenv, pip, rendered script and /usr/local/bin symlink resources
- Delete the now-unused Python script templates
- Keep rendering /opt/<tool>/config.yaml, unchanged ownership and mode
- Nest certmanager's output_path under vault:, where the binary reads it
- Drop output_path from sshsignhost's config; the binary has no such key
- Pin certmanager and sshsignhost to 0.1.0 on the puppet master role
- Point sshsignhost at the sshca mount and signhost role

Depends on certmanager-0.1.0 and sshsignhost-0.1.0 in the rpm-internal repo.

hieradata/roles/infra/puppet/master.yaml

@@ -47,12 +47,18 @@ profiles::helpers::certmanager::vault_config:
 
 profiles::helpers::sshsignhost::vault_config:
   addr: 'https://vault.service.consul:8200'
-  mount_point: 'ssh-host-signer'
+  mount_point: 'sshca'
   approle_path: 'approle'
-  role_name: 'hostrole'
-  output_path: '/tmp/sshsignhost'
+  role_name: 'signhost'
   role_id: "%{lookup('sshsignhost::role_id')}"
 
+# Vault signing helpers, delivered as RPMs from the rpm-internal repo.
+profiles::packages::include:
+  certmanager:
+    ensure: '0.1.0'
+  sshsignhost:
+    ensure: '0.1.0'
+
 profiles::puppet::server::agent_server: 'puppet.query.consul'
 profiles::puppet::server::report_server: 'puppet.query.consul'
 profiles::puppet::server::ca_server: 'puppetca.query.consul'