Add kubernetes auth roles for the puppet compilers (#152)

The certmanager and sshsigner approles are CIDR-bound to the six legacy VM puppet-master IPs, so the HPA-autoscaled k8s compilers cannot log in and any catalog compile needing a cert or a signed host key fails.

- Add k8s auth roles `puppet_certmanager` and `puppet_sshsigner` on `k8s/au/syd1`, bound to the `default` service account in namespace `puppet`
- Attach the existing pki/pki_int certmanager and sshca signing policies to them, keeping the approle token TTLs
- Leave the approle roles and their CIDR bindings untouched

Follow-up ships the scripts into the compiler pods.

Reviewed-on: #152
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

config/auth_kubernetes_role/k8s/au/syd1/puppet_certmanager.yaml

@@ -0,0 +1,11 @@
+---
+# Kubernetes auth for the puppetserver compilers, which run certmanager
+# server-side during catalog compilation. The AppRole equivalent is pinned to
+# the legacy VM master IPs and cannot be used from autoscaled compiler pods.
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - puppet
+token_ttl: 30
+token_max_ttl: 30
+audience: https://kubernetes.default.svc.cluster.local

config/auth_kubernetes_role/k8s/au/syd1/puppet_sshsigner.yaml

@@ -0,0 +1,10 @@
+---
+# Kubernetes auth for the puppetserver compilers, which run sshsignhost
+# server-side during catalog compilation.
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - puppet
+token_ttl: 30
+token_max_ttl: 30
+audience: https://kubernetes.default.svc.cluster.local

policies/pki/au/syd1/certmanager.yaml

@@ -17,3 +17,5 @@ rules:
 auth:
   approle:
     - certmanager
+  k8s/au/syd1:
+    - puppet_certmanager

policies/pki_int/certmanager.yaml

@@ -17,3 +17,5 @@ rules:
 auth:
   approle:
     - certmanager
+  k8s/au/syd1:
+    - puppet_certmanager

policies/sshca/sign/host.yaml

@@ -9,3 +9,5 @@ rules:
 auth:
   approle:
     - sshsigner
+  k8s/au/syd1:
+    - puppet_sshsigner

policies/sshca/sign/user.yaml

@@ -9,3 +9,5 @@ rules:
 auth:
   approle:
     - sshsigner
+  k8s/au/syd1:
+    - puppet_sshsigner