Discussed on IRC, certs are taking too much time to be done as current ops are busy.
The whole cert system would need to be moved from the puppet repo to another repo. As well, puppet1 would need to be restricted to just editing certs.
I could take the role of "puppet-admin"/ "cert-admin" and therefore facilitate and expedite cert enabling.
Thanks to @John I've done all the "public" repository work as you can see at https://github.com/miraheze/ssl and https://github.com/miraheze/puppet/pull/451 + https://github.com/miraheze/puppet/pull/452
Now the rest is up to @NDKilla
<JohnLewis> he [NDKilla] has to make a brand new private repo, store it somewhere, have a live version in /etc/puppet/
<JohnLewis> he'd [NDKilla] need to put the git cloned repo in/home/ probably or somewhere else since /etc/puppet should be off limits
<JohnLewis> you [Reception123] shouldn't have the ability to do anything in /etc/puppet
Can you explain how giving you an account on puppet1 without any sudo privileges allows you to add private keys?
(show the exact steps that can be performed without sudo)
Unfortunately I'm not sure myself, but according to @John it is possible to restrict access to only that, so he should probably explain the exact process.
<JohnLewis> No, still have to be puppet1 but you can lock it down a lot
@Southparkfan According to @John, this depends on how the git repo is set up.
"make this new repo, then give privileges for that repo"
The exact steps would be normal git steps, git add . git commit and git push
<JohnLewis> if its on a repo you can edit. if not, you need to be able to sudo git as a suer
Things have been moved to the new directories only we have encountered some issues on the way.
A blocker is me not being able to actually access any private keys from mw1, as that is limited to root since it's in root/acme-tiny.
There are two possible solutions: either to make the private key output when the cert is being generated, or to confirm process at T1923, and with root I'll be able to copy the key directly from there.
Second issue is operations only: T1949
Update on the situation: Outputing certs on mw1 now works, but the new issue is that puppet on puppet1 is failing, and therefore any changes made to the puppet repo are not being pulled correctly, and pushing changes from /home/puppet-users/ssl-keys to /etc/puppet/ssl-keys is also not working.