Deliver tart host autologin kcpassword via the mTLS vault-broker

[rcurranmoz]

Problem

Tart VM hosts need an admin GUI session at boot for Apple's Virtualization framework — tart.pp:134-137 documents a host rebooting to the login window and VMs failing with a "Virtualization error" (hit on macmini-m4-187, 2026-07-16). That session comes from autologin, which requires a local /etc/kcpassword.

profiles::tart already supports this: tart_autologin_kcpassword (base64 of /etc/kcpassword) is looked up at tart.pp:150 and handed to macos_utils::autologin_user. But it is '' in data/roles/tart_worker.yaml, and /var/root/vault.yaml on these hosts is {} — the vault layer is empty. So today autologin is set by hand and undocumented: every one of the 16 pre-existing tart hosts has /etc/kcpassword present with no record of how it got there, and it does not survive a wipe.

Why not the obvious alternatives

• MDM profile: not possible. A profile can set autoLoginUser, but there is no payload that writes /etc/kcpassword, so autologin cannot be fully MDM-driven.
• Commit it to hiera: /etc/kcpassword is the admin password XOR'd with a fixed, publicly known key. It is obfuscation, not encryption — base64-of-kcpassword is password-grade material and must not land in the repo.

Proposal

Deliver it over the mTLS broker the hosts are already provisioned for.

As of 2026-08-19 each tart host enrolled via macos_step_cert holds a self-renewing step-ca client cert whose SAN carries the SPIFFE URI the broker authorizes on. Verified on macmini-m4-245:

URI:spiffe://relops.mozilla/host/macmini-m4-245/role/gecko_t_osx_1500_m_vms

That is the same credential and code path the m4 fleet uses for role-scoped vault.yaml. So:

1. Add a vault-gecko_t_osx_1500_m_vms (or vault-tart_worker) secret in Secret Manager containing tart_autologin_kcpassword.
2. Have the host fetch its role vault.yaml over mTLS and write it to /var/root/vault.yaml, as the m4 bootstrap pkg already does.
3. tart.pp:150 then resolves the value with no code change, and macos_utils::autologin_user manages autologin idempotently.

Result: autologin is puppet-managed, survives a wipe, needs no per-host operator step, and the credential never sits in the repo.

Caveat — verify the requirement first

launchd_type: daemon was chosen precisely so the worker jobs load headlessly without a console session, so it is worth confirming autologin is still needed at all before building this. Initial evidence is encouraging: tart pull over plain SSH (no GUI session) works on macOS 15.3 on m4-245, contradicting the older note that it required the console. If tart run also works headless, this issue can be closed as unnecessary rather than implemented.

Related

• ronin_puppet modules/roles_profiles/manifests/profiles/tart.pp (the lookup and the m4-187 note)
• data/roles/tart_worker.yaml (tart_autologin_kcpassword, step_cert_enabled, cert_source: file)
• Short-term stopgap in use: autologin set by hand on the new hosts.

🤖 Generated with Claude Code