[#385] ssh_ca role + onboarding playbook (fleet SSH cert CA rollout)

Idempotent role: install fleet User CA public key + TrustedUserCAKeys drop-in, validate sshd -t, reload. Sectestbed wave first, prod under CR. https://projects.knownelement.com/issues/385
2026-09-05 17:11:12 -05:00
parent 3815aee578
commit 88e3f40331
6 changed files with 53 additions and 1 deletions
@@ -0,0 +1,8 @@
+---
+# ssh_ca_onboard.yml — fleet SSH certificate CA rollout [#385]
+# Targets: sectestbed wave first (compliance lab #379), then prod under CR.
+- name: Onboard hosts to the fleet SSH certificate CA
+  hosts: all
+  gather_facts: false
+  roles:
+    - ssh_ca