unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Add kubernetes auth roles for the puppet compilers #152

Merged
benvin merged 1 commits from benvin/certmanager-k8s-auth into master 2026-09-13 22:54:45 +10:00
Conversation 0 Commits 1 Files Changed 6
+29
unkin-agent commented 2026-09-13 22:49:30 +10:00
Member
Copy Link
Copy Source

The certmanager and sshsigner approles are CIDR-bound to the six legacy VM puppet-master IPs, so the HPA-autoscaled k8s compilers cannot log in and any catalog compile needing a cert or a signed host key fails.

  • Add k8s auth roles puppet_certmanager and puppet_sshsigner on k8s/au/syd1, bound to the default service account in namespace puppet
  • Attach the existing pki/pki_int certmanager and sshca signing policies to them, keeping the approle token TTLs
  • Leave the approle roles and their CIDR bindings untouched

Follow-up ships the scripts into the compiler pods.

The certmanager and sshsigner approles are CIDR-bound to the six legacy VM puppet-master IPs, so the HPA-autoscaled k8s compilers cannot log in and any catalog compile needing a cert or a signed host key fails. - Add k8s auth roles `puppet_certmanager` and `puppet_sshsigner` on `k8s/au/syd1`, bound to the `default` service account in namespace `puppet` - Attach the existing pki/pki_int certmanager and sshca signing policies to them, keeping the approle token TTLs - Leave the approle roles and their CIDR bindings untouched Follow-up ships the scripts into the compiler pods.
unkin-agent added 1 commit 2026-09-13 22:49:30 +10:00
Add kubernetes auth roles for the puppet compilers
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
8e2595c1a9 
The certmanager and sshsigner approles are bound to the six legacy VM
puppet-master IPs, so the HPA-autoscaled k8s compilers cannot log in and
every catalog compile that issues a cert or signs a host key fails.

- Add k8s auth roles puppet_certmanager and puppet_sshsigner on
  k8s/au/syd1, bound to the default service account in namespace puppet
- Attach the existing pki_int/pki certmanager and sshca signing policies
  to them, matching the approle token TTLs
- Leave the approle roles and their CIDR bindings untouched
benvin merged commit c1e60dad83 into master 2026-09-13 22:54:45 +10:00
benvin deleted branch benvin/certmanager-k8s-auth 2026-09-13 22:54:45 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#152
Delete Branch "benvin/certmanager-k8s-auth"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?