The sshca mount only defines the signhost role, so the policy grant for
sshca/sign/host never matched a real path and every host-key signing
request from the Puppet compilers was denied. The role also excluded
unkin.net, rejecting the git.unkin.net and grafana.unkin.net principals
the manifest sends.
- Grant sshca/sign/signhost instead of sshca/sign/host
- Add unkin.net to the signhost role's allowed_domains
unkin-agent
0dd7bc56b8