From 0dd7bc56b8d614740ee82392efbe8b2aa1bde30f Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 19 Sep 2026 12:51:47 +1000 Subject: [PATCH 1/4] Point the SSH host sign policy at the role that exists The sshca mount only defines the signhost role, so the policy grant for sshca/sign/host never matched a real path and every host-key signing request from the Puppet compilers was denied. The role also excluded unkin.net, rejecting the git.unkin.net and grafana.unkin.net principals the manifest sends. - Grant sshca/sign/signhost instead of sshca/sign/host - Add unkin.net to the signhost role's allowed_domains --- config/ssh_secret_backend_role/sshca/signhost.yaml | 2 +- policies/sshca/sign/host.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config/ssh_secret_backend_role/sshca/signhost.yaml b/config/ssh_secret_backend_role/sshca/signhost.yaml index e3b71b4..fc8c1e5 100644 --- a/config/ssh_secret_backend_role/sshca/signhost.yaml +++ b/config/ssh_secret_backend_role/sshca/signhost.yaml @@ -3,6 +3,6 @@ algorithm_signer: rsa-sha2-256 ttl: 315360000 # 87600 * 3600 allow_host_certificates: true allow_user_certificates: false -allowed_domains: "main.unkin.net,consul" +allowed_domains: "unkin.net,main.unkin.net,consul" allow_subdomains: true allow_bare_domains: false diff --git a/policies/sshca/sign/host.yaml b/policies/sshca/sign/host.yaml index 5f99869..4a5b474 100644 --- a/policies/sshca/sign/host.yaml +++ b/policies/sshca/sign/host.yaml @@ -1,7 +1,7 @@ # Allow signing SSH host certificates --- rules: - - path: "sshca/sign/host" + - path: "sshca/sign/signhost" capabilities: - create - update -- 2.47.3 From 92149cbebef8bec85740451172de7a10c30f93d4 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 19 Sep 2026 14:58:09 +1000 Subject: [PATCH 2/4] Restore the SSH host sign policy path --- policies/sshca/sign/host.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policies/sshca/sign/host.yaml b/policies/sshca/sign/host.yaml index 4a5b474..5f99869 100644 --- a/policies/sshca/sign/host.yaml +++ b/policies/sshca/sign/host.yaml @@ -1,7 +1,7 @@ # Allow signing SSH host certificates --- rules: - - path: "sshca/sign/signhost" + - path: "sshca/sign/host" capabilities: - create - update -- 2.47.3 From 2a3ef51f7d5a8f182ebd5124398e13ea03c65125 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 19 Sep 2026 15:31:13 +1000 Subject: [PATCH 3/4] Name the SSH host sign policy after its sshca role The only role on the sshca mount is signhost, so a policy granting the literal path sshca/sign/host matches no role and every host signing request is denied after a successful login. - Rename the policy to sshca/sign/signhost and grant that path - Move the policy's state to the new name so the rename is tracked --- modules/vault_cluster/state_migrations.tf | 6 ++++++ policies/sshca/sign/{host.yaml => signhost.yaml} | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) rename policies/sshca/sign/{host.yaml => signhost.yaml} (84%) diff --git a/modules/vault_cluster/state_migrations.tf b/modules/vault_cluster/state_migrations.tf index e9a2020..03a852a 100644 --- a/modules/vault_cluster/state_migrations.tf +++ b/modules/vault_cluster/state_migrations.tf @@ -338,6 +338,12 @@ moved { to = module.vault_policy["sshca/sign/host"].vault_policy.this } +# The SSH host signing policy is named after the sshca role it grants (signhost) +moved { + from = module.vault_policy["sshca/sign/host"].vault_policy.this + to = module.vault_policy["sshca/sign/signhost"].vault_policy.this +} + moved { from = vault_policy.policies["sys/sys_audit_read"] to = module.vault_policy["sys/audit/read"].vault_policy.this diff --git a/policies/sshca/sign/host.yaml b/policies/sshca/sign/signhost.yaml similarity index 84% rename from policies/sshca/sign/host.yaml rename to policies/sshca/sign/signhost.yaml index 5f99869..4a5b474 100644 --- a/policies/sshca/sign/host.yaml +++ b/policies/sshca/sign/signhost.yaml @@ -1,7 +1,7 @@ # Allow signing SSH host certificates --- rules: - - path: "sshca/sign/host" + - path: "sshca/sign/signhost" capabilities: - create - update -- 2.47.3 From 3e8cd32e1f426b0a3368dd9710e5422a49187cae Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 19 Sep 2026 15:44:42 +1000 Subject: [PATCH 4/4] Drop the sshca sign policy moved block --- modules/vault_cluster/state_migrations.tf | 6 ------ 1 file changed, 6 deletions(-) diff --git a/modules/vault_cluster/state_migrations.tf b/modules/vault_cluster/state_migrations.tf index 03a852a..e9a2020 100644 --- a/modules/vault_cluster/state_migrations.tf +++ b/modules/vault_cluster/state_migrations.tf @@ -338,12 +338,6 @@ moved { to = module.vault_policy["sshca/sign/host"].vault_policy.this } -# The SSH host signing policy is named after the sshca role it grants (signhost) -moved { - from = module.vault_policy["sshca/sign/host"].vault_policy.this - to = module.vault_policy["sshca/sign/signhost"].vault_policy.this -} - moved { from = vault_policy.policies["sys/sys_audit_read"] to = module.vault_policy["sys/audit/read"].vault_policy.this -- 2.47.3