unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Add kubernetes auth roles for the puppet compilers #152

Merged
benvin merged 1 commits from benvin/certmanager-k8s-auth into master 2026-09-13 22:54:45 +10:00
Conversation 0 Commits 1 Files Changed 6
+29

1 Commits

Author SHA1 Message Date
unkin-agent 8e2595c1a9 Add kubernetes auth roles for the puppet compilers
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details 
The certmanager and sshsigner approles are bound to the six legacy VM
puppet-master IPs, so the HPA-autoscaled k8s compilers cannot log in and
every catalog compile that issues a cert or signs a host key fails.

- Add k8s auth roles puppet_certmanager and puppet_sshsigner on
  k8s/au/syd1, bound to the default service account in namespace puppet
- Attach the existing pki_int/pki certmanager and sshca signing policies
  to them, matching the approle token TTLs
- Leave the approle roles and their CIDR bindings untouched
 2026-09-13 22:48:59 +10:00