Best option for SSH Host Certificate with cloud-init (wrapping? transit? ..)

[jdvf]

I responded to a similar question here last year:

Strategies for rolling out SSH CA host certs

Basically you’re looking to solve the authentication issue in step 6 within the host verification setup instructions, correct? Or is it steps 5 and 6 (I’m not sure where the host’s public key is coming from here)? Regardless you have some options: Use a config management tool like you mentioned previously Use a common credential (AppRole role_id+secret_id) in your script, which has the obvious drawbacks you mentioned You could leverage an AppRole role with the bind_secret_id parameter set to…

If hosts are AD-joined and have Kerberos credentials, could those credentials be used to obtain the token (with the policy maxb described assigned) and use that to get the host keys signed?

jd