unkin-agent
c1e60dad83
ci/woodpecker/push/apply Pipeline was successful
The certmanager and sshsigner approles are CIDR-bound to the six legacy VM puppet-master IPs, so the HPA-autoscaled k8s compilers cannot log in and any catalog compile needing a cert or a signed host key fails. - Add k8s auth roles `puppet_certmanager` and `puppet_sshsigner` on `k8s/au/syd1`, bound to the `default` service account in namespace `puppet` - Attach the existing pki/pki_int certmanager and sshca signing policies to them, keeping the approle token TTLs - Leave the approle roles and their CIDR bindings untouched Follow-up ships the scripts into the compiler pods. Reviewed-on: #152 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>