How to setup SSH key signing process every time some Ansible stage runs? Or at some interval at least.
I have pipeline which creates VM's with the Terraform and then runs Ansible. At cloud-init stage Host keys are created and signed as well public User CA key are configured. Client/Host CA authorities are configured/running in the HashiCorp Vault. So, at this point, no matter what VM's are provisioned, i can SSH into every of them as i have hosts CA public key
@cert-authority *.example.com ecdsa-sha2-nistp521 AAAAB3NzaC1yc2EAAA... set globally in
/etc/ssh/ssh_known_hosts. All i need to do is to create new personal key and to sign it because my TTL is quite short.
But this does not work in Jenkins. Jenkins stores all SSH keys under
/var/lib/jenkins/.ssh and by default there is nothing. If just for the testing reasons i do copy my personal user (or generated) keys and certificate + ssh config file into
/var/lib/jenkins/.ssh, then Jenkins can run Ansible happily. But, i can't generate, sign and copy the jenkins keys every time i do some commit in my infra repo. Creating long living certs also does not smell good.
What is the idiomatic automated workflow for SSH key signing and rotation?