support multiple SSH CA key pairs

files/get_cert.sh

@@ -2,11 +2,11 @@
 set -euo pipefail
 IFS=$'\n\t'
 
-eval "$(jq -r '@sh "PUBKEY=\(.pubkey) HOST=\(.host) CAHOST=\(.cahost) CASCRIPT=\(.cascript)"')"
+eval "$(jq -r '@sh "PUBKEY=\(.pubkey) HOST=\(.host) CAHOST=\(.cahost) CASCRIPT=\(.cascript) CAKEY=\(.cakey)"')"
 
 # TODO: Can this be done more eye-pleasingly?
 set +e
-CERT=$(ssh -o ConnectTimeout=3 -o ConnectionAttempts=1 root@$CAHOST '"'"$CASCRIPT"'" host "'"$PUBKEY"'" "'"$HOST"'".dmz')
+CERT=$(ssh -o ConnectTimeout=3 -o ConnectionAttempts=1 root@$CAHOST '"'"$CASCRIPT"'" "'"$CAKEY"'" host "'"$PUBKEY"'" "'"$HOST"'".dmz')
 retval=$?
 set -e
 

main.tf

@@ -39,6 +39,7 @@ data "external" "cert" {
     host     = var.name
     cahost   = var.ca_host
     cascript = var.ca_script
+    cakey    = var.ca_key
   }
 }
 

variables.tf

@@ -42,6 +42,12 @@ variable "ca_script" {
   description = "Script to call when fetching a SSH host certificate."
 }
 
+variable "ca_key" {
+  type        = string
+  default     = ""
+  description = "File name of the SSH CA key pair."
+}
+
 variable "domain_name" {
   type        = string
   default     = null