From 8e2595c1a90f7f08857b73e674fd4b850cb82dea Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 13 Sep 2026 22:48:59 +1000 Subject: [PATCH] Add kubernetes auth roles for the puppet compilers The certmanager and sshsigner approles are bound to the six legacy VM puppet-master IPs, so the HPA-autoscaled k8s compilers cannot log in and every catalog compile that issues a cert or signs a host key fails. - Add k8s auth roles puppet_certmanager and puppet_sshsigner on k8s/au/syd1, bound to the default service account in namespace puppet - Attach the existing pki_int/pki certmanager and sshca signing policies to them, matching the approle token TTLs - Leave the approle roles and their CIDR bindings untouched --- .../k8s/au/syd1/puppet_certmanager.yaml | 11 +++++++++++ .../k8s/au/syd1/puppet_sshsigner.yaml | 10 ++++++++++ policies/pki/au/syd1/certmanager.yaml | 2 ++ policies/pki_int/certmanager.yaml | 2 ++ policies/sshca/sign/host.yaml | 2 ++ policies/sshca/sign/user.yaml | 2 ++ 6 files changed, 29 insertions(+) create mode 100644 config/auth_kubernetes_role/k8s/au/syd1/puppet_certmanager.yaml create mode 100644 config/auth_kubernetes_role/k8s/au/syd1/puppet_sshsigner.yaml diff --git a/config/auth_kubernetes_role/k8s/au/syd1/puppet_certmanager.yaml b/config/auth_kubernetes_role/k8s/au/syd1/puppet_certmanager.yaml new file mode 100644 index 0000000..f57cd08 --- /dev/null +++ b/config/auth_kubernetes_role/k8s/au/syd1/puppet_certmanager.yaml @@ -0,0 +1,11 @@ +--- +# Kubernetes auth for the puppetserver compilers, which run certmanager +# server-side during catalog compilation. The AppRole equivalent is pinned to +# the legacy VM master IPs and cannot be used from autoscaled compiler pods. +bound_service_account_names: + - default +bound_service_account_namespaces: + - puppet +token_ttl: 30 +token_max_ttl: 30 +audience: https://kubernetes.default.svc.cluster.local diff --git a/config/auth_kubernetes_role/k8s/au/syd1/puppet_sshsigner.yaml b/config/auth_kubernetes_role/k8s/au/syd1/puppet_sshsigner.yaml new file mode 100644 index 0000000..320c13a --- /dev/null +++ b/config/auth_kubernetes_role/k8s/au/syd1/puppet_sshsigner.yaml @@ -0,0 +1,10 @@ +--- +# Kubernetes auth for the puppetserver compilers, which run sshsignhost +# server-side during catalog compilation. +bound_service_account_names: + - default +bound_service_account_namespaces: + - puppet +token_ttl: 30 +token_max_ttl: 30 +audience: https://kubernetes.default.svc.cluster.local diff --git a/policies/pki/au/syd1/certmanager.yaml b/policies/pki/au/syd1/certmanager.yaml index 2d29ac0..ca19713 100644 --- a/policies/pki/au/syd1/certmanager.yaml +++ b/policies/pki/au/syd1/certmanager.yaml @@ -17,3 +17,5 @@ rules: auth: approle: - certmanager + k8s/au/syd1: + - puppet_certmanager diff --git a/policies/pki_int/certmanager.yaml b/policies/pki_int/certmanager.yaml index 362ff75..2f5ba0d 100644 --- a/policies/pki_int/certmanager.yaml +++ b/policies/pki_int/certmanager.yaml @@ -17,3 +17,5 @@ rules: auth: approle: - certmanager + k8s/au/syd1: + - puppet_certmanager diff --git a/policies/sshca/sign/host.yaml b/policies/sshca/sign/host.yaml index 8c1e978..5f99869 100644 --- a/policies/sshca/sign/host.yaml +++ b/policies/sshca/sign/host.yaml @@ -9,3 +9,5 @@ rules: auth: approle: - sshsigner + k8s/au/syd1: + - puppet_sshsigner diff --git a/policies/sshca/sign/user.yaml b/policies/sshca/sign/user.yaml index 8b41c4e..e9d4824 100644 --- a/policies/sshca/sign/user.yaml +++ b/policies/sshca/sign/user.yaml @@ -9,3 +9,5 @@ rules: auth: approle: - sshsigner + k8s/au/syd1: + - puppet_sshsigner -- 2.47.3