There are a lot of techniques you can apply to make this less work. I don't know Rackspace specifically, so some of this may not be possible, but you can take some ideas and leave others.
- Use machine images: Have a machine image ready that includes Puppet, your configuration and a key in /root/.ssh/authorized_keys from an automation master.
- Add callback: Set up something in
/etc/init.d
, /etc/rc.local
or similiar to kick off an initial puppet run, then hit the automation and trigger a script that signs the certificate. The host should already be in a node declaration that matches, and a second configuration should trigger with 'waitforcert' set to 'true'.
- Use Puppet to clean up: Have a module that cleans up the entries from the above (root access ssh key,
rc.local
, etc.)