In hieradata/role/common/pki/multirootca.yaml line 40 the profile name for the aux cluster is not consistent with all other profile names.
We should fix it there as well as in private puppet (hieradata/common/profile/pki/multirootca.yaml) and helmfile.d/admin_ng/values/aux-k8s-eqiad/cfssl-issuer-values.yaml.