[#385] ssh_ca role + onboarding playbook (fleet SSH cert CA rollout)

Idempotent role: install fleet User CA public key + TrustedUserCAKeys drop-in, validate sshd -t, reload. Sectestbed wave first, prod under CR. https://projects.knownelement.com/issues/385
2026-09-05 17:11:12 -05:00
parent 3815aee578
commit 88e3f40331
6 changed files with 53 additions and 1 deletions
@@ -0,0 +1,6 @@
+---
+# ssh_ca role defaults [#385]
+ssh_ca_key_src: fleet_user_ca.pub          # role file (public key only)
+ssh_ca_key_dest: /etc/ssh/fleet_user_ca.pub
+ssh_ca_dropin: /etc/ssh/sshd_config.d/99-fleet-ca.conf
+ssh_ca_trusted_line: "TrustedUserCAKeys /etc/ssh/fleet_user_ca.pub"