unkin-agent
0dd7bc56b8
The sshca mount only defines the signhost role, so the policy grant for sshca/sign/host never matched a real path and every host-key signing request from the Puppet compilers was denied. The role also excluded unkin.net, rejecting the git.unkin.net and grafana.unkin.net principals the manifest sends. - Grant sshca/sign/signhost instead of sshca/sign/host - Add unkin.net to the signhost role's allowed_domains
14 lines
201 B
YAML
14 lines
201 B
YAML
# Allow signing SSH host certificates
|
|
---
|
|
rules:
|
|
- path: "sshca/sign/signhost"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
|
|
auth:
|
|
approle:
|
|
- sshsigner
|
|
k8s/au/syd1:
|
|
- puppet_sshsigner
|