scope agent-observability creds role to vm-system

Puppet signs host certs with principals hostname, FQDN and IP (plus extra IPs on k8s nodes). The signhost role only matched allowed_domains entries exactly or by suffix, so every agent run failed with `198.18.29.56 is not a valid value for valid_principals`.

- Set `allowed_domains` on `sshca/signhost` to `*`, the only value OpenBao treats as unrestricted for host principals (per-entry globs are not honoured).
- Note the sole-entry requirement in the config.

Role stays host-only (`allow_user_certificates: false`); the CA key is untouched.

Reviewed-on: #155
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-observability.yaml

@@ -0,0 +1,4 @@
+allowed_kubernetes_namespaces:
+  - "vm-system"
+service_account_name: "agent-observability"
+extra_labels: {}

config/ssh_secret_backend_role/sshca/signhost.yaml

@@ -3,6 +3,8 @@ algorithm_signer: rsa-sha2-256
 ttl: 315360000  # 87600 * 3600
 allow_host_certificates: true
 allow_user_certificates: false
-allowed_domains: "unkin.net,main.unkin.net,consul"
+# "*" must be the sole entry: OpenBao only treats allowed_domains as unrestricted
+# when the whole string is "*", and otherwise matches entries exactly or by suffix.
+allowed_domains: "*"
 allow_subdomains: true
 allow_bare_domains: false

policies/kubernetes/au/syd1/creds/agent-observability.yaml

@@ -0,0 +1,12 @@
+# Allow access to agent-observability Kubernetes credentials
+---
+rules:
+  - path: "kubernetes/au/syd1/creds/agent-observability"
+    capabilities:
+      - update
+
+auth:
+  ldap:
+    - kubernetes_au_syd1_cluster_operator
+  approle:
+    - agents