unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Grant the puppet k8s role PKI issue and SSH host signing #154

Closed
unkin-agent wants to merge 1 commits from benvin/puppet-k8s-pki-sshca into master
pull from: benvin/puppet-k8s-pki-sshca
merge into: unkin:master
Conversation 0 Commits 1 Files Changed 2
+24
unkin-agent commented 2026-09-22 22:33:04 +10:00
Member
Copy Link
Copy Source

The puppet catalog compilers now run in Kubernetes and authenticate to Vault with the k8s/au/syd1 role puppet. That role only carries kv read policies, so the certmanager and sshsignhost helpers invoked during catalog compilation cannot reach Vault and compiles fail.

  • add policies/pki_int/puppet.yaml allowing create/update on pki_int/issue/servers_default
  • add policies/sshca/puppet.yaml allowing create/update on sshca/sign/signhost
  • bind both to k8s/au/syd1: [puppet]
The puppet catalog compilers now run in Kubernetes and authenticate to Vault with the `k8s/au/syd1` role `puppet`. That role only carries kv read policies, so the `certmanager` and `sshsignhost` helpers invoked during catalog compilation cannot reach Vault and compiles fail. - add `policies/pki_int/puppet.yaml` allowing create/update on `pki_int/issue/servers_default` - add `policies/sshca/puppet.yaml` allowing create/update on `sshca/sign/signhost` - bind both to `k8s/au/syd1: [puppet]`
unkin-agent added 1 commit 2026-09-22 22:33:04 +10:00
Grant the puppet k8s role PKI issue and SSH host signing
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
afbea53d94
unkin-agent closed this pull request 2026-09-22 22:36:32 +10:00
All checks were successful
ci/woodpecker/pr/plan Pipeline was successful
Required
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Required
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#154
Delete Branch "benvin/puppet-k8s-pki-sshca"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?