unkin-agent
9db9afae8d
ci/woodpecker/pr/ruby-validate Pipeline was successful
ci/woodpecker/pr/puppet-lint Pipeline was successful
ci/woodpecker/pr/bolt-validate Pipeline was successful
ci/woodpecker/pr/yamllint Pipeline was successful
ci/woodpecker/pr/erb-validate Pipeline was successful
ci/woodpecker/pr/epp-validate Pipeline was successful
ci/woodpecker/pr/puppet-validate Pipeline was successful
ci/woodpecker/pr/ruby-check Pipeline was successful
Both helpers are run server-side by generate() during catalog compilation and only speak AppRole, whose token_bound_cidrs pin them to the six legacy VM masters, so the autoscaled k8s compilers cannot obtain a token and any compile needing a cert or a signed host key fails there. - Add a kubernetes login branch that reads the service account JWT and posts it to auth/<k8s_mount>/login, selected by an auth_method config key - Add auth_method, k8s_mount, k8s_role and jwt_path class parameters, defaulting to approle so the VM masters render and behave as before - Render role_id and approle_path only for the approle case - Report a missing JWT, a rejected login or an unknown auth_method on stderr instead of falling back or raising - Point sshsignhost at the sshca mount and signhost role that Vault actually has Needs terraform-vault #152, already applied.