unkin-agent
cb9f8870bf
Catalog compilation moved to the k8s puppetserver compilers, which sign host certificates against the terraform-managed `sshca` mount. Clients only trust the legacy `ssh-host-signer` CA, so every re-signed node (ausyd1nxvm2120 already) presents a certificate nothing accepts, and knownhosts emits no plain host-key fallback. - Add a second `@cert-authority *` entry for the `sshca` public key to `profiles::ssh::knownhosts::lines`. - Keep the legacy entry untouched so legacy-signed hosts still verify. Reviewed-on: #530 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>