config/auth_kubernetes_role/k8s/au/syd1/puppet_certmanager.yaml

@@ -0,0 +1,11 @@
+---
+# Kubernetes auth for the puppetserver compilers, which run certmanager
+# server-side during catalog compilation. The AppRole equivalent is pinned to
+# the legacy VM master IPs and cannot be used from autoscaled compiler pods.
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - puppet
+token_ttl: 30
+token_max_ttl: 30
+audience: https://kubernetes.default.svc.cluster.local

config/auth_kubernetes_role/k8s/au/syd1/puppet_sshsigner.yaml

@@ -0,0 +1,10 @@
+---
+# Kubernetes auth for the puppetserver compilers, which run sshsignhost
+# server-side during catalog compilation.
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - puppet
+token_ttl: 30
+token_max_ttl: 30
+audience: https://kubernetes.default.svc.cluster.local

policies/pki/au/syd1/certmanager.yaml

@@ -17,3 +17,5 @@ rules:
 auth:
   approle:
     - certmanager
+  k8s/au/syd1:
+    - puppet_certmanager

policies/pki_int/certmanager.yaml

@@ -17,3 +17,5 @@ rules:
 auth:
   approle:
     - certmanager
+  k8s/au/syd1:
+    - puppet_certmanager

policies/sshca/sign/host.yaml

@@ -9,3 +9,5 @@ rules:
 auth:
   approle:
     - sshsigner
+  k8s/au/syd1:
+    - puppet_sshsigner

policies/sshca/sign/user.yaml

@@ -9,3 +9,5 @@ rules:
 auth:
   approle:
     - sshsigner
+  k8s/au/syd1:
+    - puppet_sshsigner