Re:Certificate Transparency Log Compromised via Salt Vulnera...
by gnufx on Monday May 04, 2020 @12:10PM
(#23069740)
And sshd is a fairly common thing to fall over in my experience (though particularly on badly-managed clusters). Presumably more so on otherwise-inaccessible systems, by the laws of life. The agent saved systems isolated in places like x-ray hutches a number of times back when I thought using cfengine was a good idea.
Once your configuration management is tied into your CI/CD pipeline, I don't really see much of a difference between an agent running on each machine vs a master node that has a root ssh key into your whole fleet.