unkin-agent
c1e60dad83
ci/woodpecker/push/apply Pipeline was successful
The certmanager and sshsigner approles are CIDR-bound to the six legacy VM puppet-master IPs, so the HPA-autoscaled k8s compilers cannot log in and any catalog compile needing a cert or a signed host key fails. - Add k8s auth roles `puppet_certmanager` and `puppet_sshsigner` on `k8s/au/syd1`, bound to the `default` service account in namespace `puppet` - Attach the existing pki/pki_int certmanager and sshca signing policies to them, keeping the approle token TTLs - Leave the approle roles and their CIDR bindings untouched Follow-up ships the scripts into the compiler pods. Reviewed-on: #152 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
14 lines
197 B
YAML
14 lines
197 B
YAML
# Allow signing SSH user certificates
|
|
---
|
|
rules:
|
|
- path: "sshca/sign/user"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
|
|
auth:
|
|
approle:
|
|
- sshsigner
|
|
k8s/au/syd1:
|
|
- puppet_sshsigner
|