unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Accept IP and short-hostname principals on sshca/signhost #155

Merged
benvin merged 1 commits from benvin/sshca-ip-principals into master 2026-09-24 22:26:56 +10:00
Conversation 0 Commits 1 Files Changed 1
+3 -1
unkin-agent commented 2026-09-24 21:50:57 +10:00
Member
Copy Link
Copy Source

Puppet signs host certs with principals hostname, FQDN and IP (plus extra IPs on k8s nodes). The signhost role only matched allowed_domains entries exactly or by suffix, so every agent run failed with 198.18.29.56 is not a valid value for valid_principals.

  • Set allowed_domains on sshca/signhost to *, the only value OpenBao treats as unrestricted for host principals (per-entry globs are not honoured).
  • Note the sole-entry requirement in the config.

Role stays host-only (allow_user_certificates: false); the CA key is untouched.

Puppet signs host certs with principals hostname, FQDN and IP (plus extra IPs on k8s nodes). The signhost role only matched allowed_domains entries exactly or by suffix, so every agent run failed with `198.18.29.56 is not a valid value for valid_principals`. - Set `allowed_domains` on `sshca/signhost` to `*`, the only value OpenBao treats as unrestricted for host principals (per-entry globs are not honoured). - Note the sole-entry requirement in the config. Role stays host-only (`allow_user_certificates: false`); the CA key is untouched.
unkin-agent added 1 commit 2026-09-24 21:50:57 +10:00
Allow IP and short-hostname principals on the sshca signhost role
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
b7a20f94b6
benvin merged commit b576524553 into master 2026-09-24 22:26:56 +10:00
benvin deleted branch benvin/sshca-ip-principals 2026-09-24 22:26:56 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#155
Delete Branch "benvin/sshca-ip-principals"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?