automation-bot 1ae3aee4d6 docs: add the SSH Certificate Flow as its own contract, not folded into #1 ...

Vault's ssh-client-signer mount was undocumented here entirely. Adds it
as flow 2/5 rather than merging into Certificate Flow, since the actual
mechanism differs (own systemd timer, bypasses Vault Agent's render
cycle, only reuses its cached token) - and explains why that distinction
matters for debugging. Diagram updated to match: a third data-plane box
feeding fleet-wide sshd trust instead of a container.

2026-09-05 09:36:19 +03:00

420 KiB

Raw Blame History