Add kubernetes auth roles for the puppet compilers

The certmanager and sshsigner approles are bound to the six legacy VM
puppet-master IPs, so the HPA-autoscaled k8s compilers cannot log in and
every catalog compile that issues a cert or signs a host key fails.

- Add k8s auth roles puppet_certmanager and puppet_sshsigner on
  k8s/au/syd1, bound to the default service account in namespace puppet
- Attach the existing pki_int/pki certmanager and sshca signing policies
  to them, matching the approle token TTLs
- Leave the approle roles and their CIDR bindings untouched

config/auth_kubernetes_role/k8s/au/syd1/puppet_certmanager.yaml

@@ -0,0 +1,11 @@
+---
+# Kubernetes auth for the puppetserver compilers, which run certmanager
+# server-side during catalog compilation. The AppRole equivalent is pinned to
+# the legacy VM master IPs and cannot be used from autoscaled compiler pods.
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - puppet
+token_ttl: 30
+token_max_ttl: 30
+audience: https://kubernetes.default.svc.cluster.local

config/auth_kubernetes_role/k8s/au/syd1/puppet_sshsigner.yaml

@@ -0,0 +1,10 @@
+---
+# Kubernetes auth for the puppetserver compilers, which run sshsignhost
+# server-side during catalog compilation.
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - puppet
+token_ttl: 30
+token_max_ttl: 30
+audience: https://kubernetes.default.svc.cluster.local

policies/pki/au/syd1/certmanager.yaml

@@ -17,3 +17,5 @@ rules:
 auth:
   approle:
     - certmanager
+  k8s/au/syd1:
+    - puppet_certmanager

policies/pki_int/certmanager.yaml

@@ -17,3 +17,5 @@ rules:
 auth:
   approle:
     - certmanager
+  k8s/au/syd1:
+    - puppet_certmanager

policies/sshca/sign/host.yaml

@@ -9,3 +9,5 @@ rules:
 auth:
   approle:
     - sshsigner
+  k8s/au/syd1:
+    - puppet_sshsigner

policies/sshca/sign/user.yaml

@@ -9,3 +9,5 @@ rules:
 auth:
   approle:
     - sshsigner
+  k8s/au/syd1:
+    - puppet_sshsigner