certmanager and sshsignhost are now Go binaries released as RPMs, and their
packaged paths collide with the venv install these helper classes manage.
- Drop the pyvenv, pip, rendered script and /usr/local/bin symlink resources
- Delete the now-unused Python script templates
- Keep rendering /opt/<tool>/config.yaml, unchanged ownership and mode
- Nest certmanager's output_path under vault:, where the binary reads it
- Drop output_path from sshsignhost's config; the binary has no such key
- Pin certmanager and sshsignhost to 0.1.0 on the puppet master role
- Point sshsignhost at the sshca mount and signhost role
Depends on certmanager-0.1.0 and sshsignhost-0.1.0 in the rpm-internal repo.
- manage python script/venv to sign ssh host certificates
- add approle_id to puppetmaster eyaml files
- add class to sign ssh-rsa host keys
- add facts to check if the current principals match the desired principals
unkin-agent
unkinben