From b576524553bb37367b11d6145ae2c139d0020f9e Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Thu, 24 Sep 2026 22:26:55 +1000 Subject: [PATCH] Accept IP and short-hostname principals on sshca/signhost (#155) Puppet signs host certs with principals hostname, FQDN and IP (plus extra IPs on k8s nodes). The signhost role only matched allowed_domains entries exactly or by suffix, so every agent run failed with `198.18.29.56 is not a valid value for valid_principals`. - Set `allowed_domains` on `sshca/signhost` to `*`, the only value OpenBao treats as unrestricted for host principals (per-entry globs are not honoured). - Note the sole-entry requirement in the config. Role stays host-only (`allow_user_certificates: false`); the CA key is untouched. Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/155 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- config/ssh_secret_backend_role/sshca/signhost.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/config/ssh_secret_backend_role/sshca/signhost.yaml b/config/ssh_secret_backend_role/sshca/signhost.yaml index fc8c1e5..2a7db8d 100644 --- a/config/ssh_secret_backend_role/sshca/signhost.yaml +++ b/config/ssh_secret_backend_role/sshca/signhost.yaml @@ -3,6 +3,8 @@ algorithm_signer: rsa-sha2-256 ttl: 315360000 # 87600 * 3600 allow_host_certificates: true allow_user_certificates: false -allowed_domains: "unkin.net,main.unkin.net,consul" +# "*" must be the sole entry: OpenBao only treats allowed_domains as unrestricted +# when the whole string is "*", and otherwise matches entries exactly or by suffix. +allowed_domains: "*" allow_subdomains: true allow_bare_domains: false