The only role on the sshca mount is signhost, so a policy granting the
literal path sshca/sign/host matches no role and every host signing
request is denied after a successful login.
- Rename the policy to sshca/sign/signhost and grant that path
- Move the policy's state to the new name so the rename is tracked
The sshca mount only defines the signhost role, so the policy grant for
sshca/sign/host never matched a real path and every host-key signing
request from the Puppet compilers was denied. The role also excluded
unkin.net, rejecting the git.unkin.net and grafana.unkin.net principals
the manifest sends.
- Grant sshca/sign/signhost instead of sshca/sign/host
- Add unkin.net to the signhost role's allowed_domains
unkin-agent