oriolrius/pki-manager-web v3.8.0

v3.8.0 — SSH REST surface + module-driven Ansible (oriolrius.pki_manager)

on GitHub

SSH automation is now Ansible-native and REST-only. The ssh_host_cert role and every PKI Manager SSH operation moved to the oriolrius.pki_manager collection (2.3.0); this repo consumes it.

Backend

• New SSH REST endpoints so the collection drives the whole workflow over REST (no tRPC): POST/GET /api/v1/ssh/tokens (+ revoke), GET /api/v1/ssh/hosts (lookup by ?fqdn=), POST /api/v1/ssh/principals/grant.
• Fleet-token auth_principals host-fetch endpoint (ANS-01).

Ansible — Integration milestone (ANS-00..ANS-11)

• ssh_host_cert grown into a full SSH-CA node: host cert, User/Host-CA trust anchors, login-RBAC principals, authoritative sshd drop-in, unattended renewal, and a KRL revocation channel (public cron or encrypted krl-client). Now published in the collection and consumed here via site.yml + YAML inventory + requirements.yml.
• Dockerized containers-as-hosts e2e wired into CI (ansible-e2e.yml): converge + idempotence (changed=0) + real ssh login (no TOFU) + principal RBAC + revocation on both KRL channels.

Docs

• docs/ssh/deploy-server-and-user.md — module-driven, end-to-end operator guide.

Full changelog: v3.7.1...v3.8.0