Let certmanager and sshsignhost authenticate to Vault by kubernetes auth #523
Closed
unkin-agent
wants to merge 1 commits from
benvin/certmanager-k8s-auth into develop
pull from: benvin/certmanager-k8s-auth
merge into: unkin:develop
unkin:develop
unkin:benvin/wgvpn-role
unkin:benvin/consul-dns-k8s
unkin:benvin/consul-clients-k8s
unkin:benvin/consul-mesh-gateway
unkin:benvin/consul-server-tls-fed
unkin:benvin/halb-drop-grafana
unkin:benvin/journald-explicit-port
unkin:benvin/openbao-plugin-socket-tmpfiles
unkin:benvin/netbox-facts
unkin:benvin/rke2_upgrade
unkin:benvin/artifactapi_repos
unkin:benvin/backend_dovecot
unkin:benvin/exporter_ip_loopback
unkin:neoloc/ceph
unkin:neoloc/mpls_mpbgp_rr
unkin:neoloc/firewall
unkin:neoloc/includegroups
unkin:neoloc/exportarr
unkin:neoloc/authproxy
unkin:neoloc/openldap
unkin:neoloc/puppetdb_ssl
unkin:master
1 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 unkin-agent
|
9db9afae8d |
Let certmanager and sshsignhost authenticate to Vault by kubernetes auth
ci/woodpecker/pr/ruby-validate Pipeline was successful
ci/woodpecker/pr/puppet-lint Pipeline was successful
ci/woodpecker/pr/bolt-validate Pipeline was successful
ci/woodpecker/pr/yamllint Pipeline was successful
ci/woodpecker/pr/erb-validate Pipeline was successful
ci/woodpecker/pr/epp-validate Pipeline was successful
ci/woodpecker/pr/puppet-validate Pipeline was successful
ci/woodpecker/pr/ruby-check Pipeline was successful
Both helpers are run server-side by generate() during catalog compilation and only speak AppRole, whose token_bound_cidrs pin them to the six legacy VM masters, so the autoscaled k8s compilers cannot obtain a token and any compile needing a cert or a signed host key fails there. - Add a kubernetes login branch that reads the service account JWT and posts it to auth/<k8s_mount>/login, selected by an auth_method config key - Add auth_method, k8s_mount, k8s_role and jwt_path class parameters, defaulting to approle so the VM masters render and behave as before - Render role_id and approle_path only for the approle case - Report a missing JWT, a rejected login or an unknown auth_method on stderr instead of falling back or raising - Point sshsignhost at the sshca mount and signhost role that Vault actually has Needs terraform-vault #152, already applied. |