Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Control Git SSH passphrase injection in Che Dashboard instead of DevWorkspace Operator #23248

Open
AObuchow opened this issue Nov 13, 2024 · 0 comments
Labels
area/dashboard area/devworkspace-operator kind/task Internal things, technical debt, and to-do tasks to be performed. severity/P1 Has a major impact to usage or development of the system.

Comments

@AObuchow
Copy link

Is your task related to a problem? Please describe

Currently, DevWorkspace Operator is responsible for injecting a postStart event that allows the workspace's SSH agent to automatically read the SSH passphrase mounted in a workspace.

This SSH agent initialization postStart event was previously injected unconditionally to all workspaces, causing issues such as #23213 & devfile/devworkspace-operator#1337. In order to prevent this feature from breaking existing workspaces, we have guarded this feature under the DevWorkspaceOperatorConfig's config.enableExperimentalFeatures option & ensured the postStart event will always succeed.

After reconsideration (mentioned in devfile/devworkspace-operator#1337 (comment) and devfile/devworkspace-operator#1340 (comment)) I believe the Che Dashboard would be better suited for injecting the postStart event as well as creating an automount configmap that provides a passphrase-injection script for the SSH agent to use.

Describe the solution you'd like

If the user provides a passphrase for their SSH key, the Dashboard should:

  1. Create an automount configmap in the user's namespace that will mount this script into their workspace. The SSH agent will use this script to automatically read the user's SSH passphrase when performing git operations.
  2. Add a postStart event to every devworkspace generated by the Dashboard. The postStart event will initialize the SSH agent to read the user's SSH passphrase everytime the workspace's .bashrc is sourced.

Once this functionality is implemented in the Dashboard, we should remove it from DevWorkspace Operator.

Describe alternatives you've considered

Before migrating the SSH passphrase injection functionality from the DevWorkspace Operator to the Che Dashboard, we could:

Keep the SSH agent functionality in DWO, but have it enabled only when a devworkspace attribute is provided, e.g. controller.devfile.io/initialize-ssh-agent: true. The Che Dashboard could then add this attribute to devworkspace's when the user provides an SSH key that has a passphrase.

By performing this intermediary step, we would no longer have to guard the SSH passphrase injection functionality with the DevWorkspaceOperatorConfigs config.enableExperimentalFeatures field. Instead, this functionality would be guarded by the controller.devfile.io/initialize-ssh-agent: true devworkspace attribute, that the Dashboard would inject when appropriate.

Additional context

Currently https://issues.redhat.com/browse/CRW-6614 is marked as a Technology Preview Feature. Resolving the current issue (with the proposed solution or the alternate solution) would allow us to move it out of tech preview.

@AObuchow AObuchow added kind/task Internal things, technical debt, and to-do tasks to be performed. area/dashboard area/devworkspace-operator labels Nov 13, 2024
@che-bot che-bot added the status/need-triage An issue that needs to be prioritized by the curator responsible for the triage. See https://github. label Nov 13, 2024
@ibuziuk ibuziuk added the severity/P1 Has a major impact to usage or development of the system. label Nov 13, 2024
@ibuziuk ibuziuk moved this to 📋 Backlog in Eclipse Che Team A Backlog Nov 13, 2024
@dmytro-ndp dmytro-ndp removed the status/need-triage An issue that needs to be prioritized by the curator responsible for the triage. See https://github. label Nov 13, 2024
@ibuziuk ibuziuk moved this from 📋 Backlog to 📅 Planned in Eclipse Che Team A Backlog Nov 18, 2024
@tolusha tolusha moved this from 📅 Planned to 📋 Backlog in Eclipse Che Team A Backlog Nov 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/dashboard area/devworkspace-operator kind/task Internal things, technical debt, and to-do tasks to be performed. severity/P1 Has a major impact to usage or development of the system.
Projects
Status: 📋 Backlog
Development

No branches or pull requests

4 participants