unkin/puppet-prod
4
0
Fork 0
Code Issues 15 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Trust the sshca host CA alongside the legacy signer #530

Merged
benvin merged 1 commits from benvin/trust-sshca-host-ca into develop 2026-09-24 22:46:31 +10:00
Conversation 1 Commits 1 Files Changed 1
+1
unkin-agent commented 2026-09-24 22:39:11 +10:00
Member
Copy Link
Copy Source

Catalog compilation moved to the k8s puppetserver compilers, which sign host certificates against the terraform-managed sshca mount. Clients only trust the legacy ssh-host-signer CA, so every re-signed node (ausyd1nxvm2120 already) presents a certificate nothing accepts, and knownhosts emits no plain host-key fallback.

  • Add a second @cert-authority * entry for the sshca public key to profiles::ssh::knownhosts::lines.
  • Keep the legacy entry untouched so legacy-signed hosts still verify.
Catalog compilation moved to the k8s puppetserver compilers, which sign host certificates against the terraform-managed `sshca` mount. Clients only trust the legacy `ssh-host-signer` CA, so every re-signed node (ausyd1nxvm2120 already) presents a certificate nothing accepts, and knownhosts emits no plain host-key fallback. - Add a second `@cert-authority *` entry for the `sshca` public key to `profiles::ssh::knownhosts::lines`. - Keep the legacy entry untouched so legacy-signed hosts still verify.
unkin-agent added 1 commit 2026-09-24 22:39:11 +10:00
Trust the sshca host CA alongside the legacy signer
ci/woodpecker/pr/ruby-validate Pipeline was successful
Details
ci/woodpecker/pr/yamllint Pipeline was successful
Details
ci/woodpecker/pr/puppet-lint Pipeline was successful
Details
ci/woodpecker/pr/bolt-validate Pipeline was successful
Details
ci/woodpecker/pr/epp-validate Pipeline was successful
Details
ci/woodpecker/pr/erb-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-validate Pipeline was successful
Details
ci/woodpecker/pr/ruby-check Pipeline was successful
Details
a0dc9e99b2
benvin merged commit cb9f8870bf into develop 2026-09-24 22:46:31 +10:00
benvin deleted branch benvin/trust-sshca-host-ca 2026-09-24 22:46:31 +10:00
unkin-agent commented 2026-09-24 22:49:05 +10:00
Author
Member
Copy Link
Copy Source

No findings.

No findings.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/puppet-prod#530
Delete Branch "benvin/trust-sshca-host-ca"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?