The details of how the autosign mechanism works can be found here.
In summary, the autosign executable is run by the Puppet master server process. It is given the certname (FQDN) of the node as the first argument. The CSR in pem format is provided over stdin.
If the executable exits 0, the certificate is autosigned. Any other exit code, the certificate is not autosigned.
At the moment, our autosigner works in two ways:
- Instance autosigning - When a new instance is created on GCP, the jwt-builder.py script gets some additional information from the Google Metadata server. This information is validated by the autosigner to prove that the instance is in one of our GCP projects.
- Jail autosigning - We generate a token on the Puppet master during the jail creation and add it to the csr_attributes.yaml file inside the jail. This token gets included in the CSR generated by Puppet inside the jail. This is effectively a pre-shared key, which can be validated by the autosigner.