unkin/puppet-prod
4
0
Fork 0
Code Issues 15 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Let certmanager and sshsignhost authenticate to Vault by kubernetes auth #523

Closed
unkin-agent wants to merge 1 commits from benvin/certmanager-k8s-auth into develop
pull from: benvin/certmanager-k8s-auth
merge into: unkin:develop
Conversation 0 Commits 1 Files Changed 7
+141 -28
unkin-agent commented 2026-09-13 23:06:51 +10:00
Member
Copy Link
Copy Source

The certmanager and sshsignhost helpers run under generate() during catalog compilation and only speak AppRole, whose token_bound_cidrs pin them to the legacy VM masters, so the autoscaled k8s compilers cannot get a token and compiles needing a cert or signed host key fail there.

  • Add a kubernetes login branch reading the SA JWT and posting it to auth/<k8s_mount>/login
  • Select it via a new auth_method config key; default stays approle, so VM masters are unchanged
  • Add auth_method, k8s_mount, k8s_role and jwt_path class parameters
  • Render role_id and approle_path only for the approle case
  • Report a missing JWT, rejected login or unknown auth_method on stderr, no fallback
  • Point sshsignhost at the sshca mount and signhost role Vault has

Needs terraform-vault #152 (applied).

The certmanager and sshsignhost helpers run under generate() during catalog compilation and only speak AppRole, whose token_bound_cidrs pin them to the legacy VM masters, so the autoscaled k8s compilers cannot get a token and compiles needing a cert or signed host key fail there. - Add a kubernetes login branch reading the SA JWT and posting it to auth/<k8s_mount>/login - Select it via a new auth_method config key; default stays approle, so VM masters are unchanged - Add auth_method, k8s_mount, k8s_role and jwt_path class parameters - Render role_id and approle_path only for the approle case - Report a missing JWT, rejected login or unknown auth_method on stderr, no fallback - Point sshsignhost at the sshca mount and signhost role Vault has Needs terraform-vault #152 (applied).
unkin-agent added 1 commit 2026-09-13 23:06:51 +10:00
Let certmanager and sshsignhost authenticate to Vault by kubernetes auth
ci/woodpecker/pr/ruby-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-lint Pipeline was successful
Details
ci/woodpecker/pr/bolt-validate Pipeline was successful
Details
ci/woodpecker/pr/yamllint Pipeline was successful
Details
ci/woodpecker/pr/erb-validate Pipeline was successful
Details
ci/woodpecker/pr/epp-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-validate Pipeline was successful
Details
ci/woodpecker/pr/ruby-check Pipeline was successful
Details
9db9afae8d 
Both helpers are run server-side by generate() during catalog compilation and
only speak AppRole, whose token_bound_cidrs pin them to the six legacy VM
masters, so the autoscaled k8s compilers cannot obtain a token and any compile
needing a cert or a signed host key fails there.

- Add a kubernetes login branch that reads the service account JWT and posts it
  to auth/<k8s_mount>/login, selected by an auth_method config key
- Add auth_method, k8s_mount, k8s_role and jwt_path class parameters, defaulting
  to approle so the VM masters render and behave as before
- Render role_id and approle_path only for the approle case
- Report a missing JWT, a rejected login or an unknown auth_method on stderr
  instead of falling back or raising
- Point sshsignhost at the sshca mount and signhost role that Vault actually has

Needs terraform-vault #152, already applied.
unkin-agent closed this pull request 2026-09-19 16:00:37 +10:00
All checks were successful
ci/woodpecker/pr/ruby-validate Pipeline was successful
Required
Details
ci/woodpecker/pr/puppet-lint Pipeline was successful
Required
Details
ci/woodpecker/pr/bolt-validate Pipeline was successful
Required
Details
ci/woodpecker/pr/yamllint Pipeline was successful
Required
Details
ci/woodpecker/pr/erb-validate Pipeline was successful
Required
Details
ci/woodpecker/pr/epp-validate Pipeline was successful
Required
Details
ci/woodpecker/pr/puppet-validate Pipeline was successful
Required
Details
ci/woodpecker/pr/ruby-check Pipeline was successful
Required
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/puppet-prod#523
Delete Branch "benvin/certmanager-k8s-auth"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?