diff --git a/config/auth_kubernetes_role/k8s/au/syd1/puppet_certmanager.yaml b/config/auth_kubernetes_role/k8s/au/syd1/puppet_certmanager.yaml
new file mode 100644
index 0000000..f57cd08
--- /dev/null
+++ b/config/auth_kubernetes_role/k8s/au/syd1/puppet_certmanager.yaml
@@ -0,0 +1,11 @@
+---
+# Kubernetes auth for the puppetserver compilers, which run certmanager
+# server-side during catalog compilation. The AppRole equivalent is pinned to
+# the legacy VM master IPs and cannot be used from autoscaled compiler pods.
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - puppet
+token_ttl: 30
+token_max_ttl: 30
+audience: https://kubernetes.default.svc.cluster.local
diff --git a/config/auth_kubernetes_role/k8s/au/syd1/puppet_sshsigner.yaml b/config/auth_kubernetes_role/k8s/au/syd1/puppet_sshsigner.yaml
new file mode 100644
index 0000000..320c13a
--- /dev/null
+++ b/config/auth_kubernetes_role/k8s/au/syd1/puppet_sshsigner.yaml
@@ -0,0 +1,10 @@
+---
+# Kubernetes auth for the puppetserver compilers, which run sshsignhost
+# server-side during catalog compilation.
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - puppet
+token_ttl: 30
+token_max_ttl: 30
+audience: https://kubernetes.default.svc.cluster.local
diff --git a/policies/pki/au/syd1/certmanager.yaml b/policies/pki/au/syd1/certmanager.yaml
index 2d29ac0..ca19713 100644
--- a/policies/pki/au/syd1/certmanager.yaml
+++ b/policies/pki/au/syd1/certmanager.yaml
@@ -17,3 +17,5 @@ rules:
 auth:
   approle:
     - certmanager
+  k8s/au/syd1:
+    - puppet_certmanager
diff --git a/policies/pki_int/certmanager.yaml b/policies/pki_int/certmanager.yaml
index 362ff75..2f5ba0d 100644
--- a/policies/pki_int/certmanager.yaml
+++ b/policies/pki_int/certmanager.yaml
@@ -17,3 +17,5 @@ rules:
 auth:
   approle:
     - certmanager
+  k8s/au/syd1:
+    - puppet_certmanager
diff --git a/policies/sshca/sign/host.yaml b/policies/sshca/sign/host.yaml
index 8c1e978..5f99869 100644
--- a/policies/sshca/sign/host.yaml
+++ b/policies/sshca/sign/host.yaml
@@ -9,3 +9,5 @@ rules:
 auth:
   approle:
     - sshsigner
+  k8s/au/syd1:
+    - puppet_sshsigner
diff --git a/policies/sshca/sign/user.yaml b/policies/sshca/sign/user.yaml
index 8b41c4e..e9d4824 100644
--- a/policies/sshca/sign/user.yaml
+++ b/policies/sshca/sign/user.yaml
@@ -9,3 +9,5 @@ rules:
 auth:
   approle:
     - sshsigner
+  k8s/au/syd1:
+    - puppet_sshsigner