Add ansible role for GCP #1

avery-blanchard · 2022-07-01T19:01:55Z

Create ansible role for deploying Keylime against a vTPM in the google cloud environment. @lkatalin

mpeters

I'm not seeing anything in here that's GCP specific. There are new additions for the rust agent and dependencies, but it's very similar to the existing ansible-keylime project.

Are there other planned additions that are GCP specific that are coming later?

mpeters · 2022-07-06T13:49:48Z

keylime-ansible-gcp/playbook.yml

+        name: libselinux-python3
+        state: present
+  roles:
+    - keylime-gcp


Can you add a new line at the end of the files? It's a pretty common thing to require and most code editors have some setting to enable it if it's not the default.

mpeters · 2022-07-06T13:53:08Z

keylime-ansible-gcp/README.md

+For details on the Rust agent, please consult the [repository](https://github.com/keylime/rust-keylime).
+
+## Usage
+Run the playbook against your target remote host(s). Note: the hosts must have the vTPM enabled in the Google Cloud Console. 


A cooler next step would be to have this playbook actually create the host(s) in GCP with all of the right settings (OS, image, vTPM, etc). It could have some parameters passed on the cmd line to override some defaults (like compute size, storage size, etc). And since almost all real world scenarios don't have the agent and the server side components (verifier, registrar, etc) running on the same host, it could create a couple of hosts, say 1 where the agent is running and 1 where the server side components are running.

I've done these kinds of playbooks before in ansible for AWS, so I'm making an assumption that they can also work for GCP.

lkatalin

I did a quick test and ran into an error! Luckily for us, I am the perfect naive user here so a problem I run into is likely to be found by others as well. It's probably something I'm doing wrong, I can help troubleshoot if it's useful.

Also was wondering how does one run the tests? Can that go in the README also?

lkatalin · 2022-07-14T18:28:21Z

README.md

-# keylime-cloud-environments
-Setup instructions and scripts for running Keylime in cloud environments
+# Keylime Cloud Environments
+Setup instructions and scripts for running [Keylime](https://github.com/keylime/keylime) in cloud environments.


I would add a line here that says something like: each cloud environment is located in a separate directory. Navigate to these and follow the instructions in the README. (maybe with links)

lkatalin · 2022-07-14T18:30:53Z

keylime-ansible-gcp/README.md

+`$ pip3 install requests google-auth`
+2. [Create a GCP service account](https://developers.google.com/identity/protocols/oauth2/service-account#creatinganaccount) for ansible's use.
+3. [Create and download keys linked to this service account](https://support.google.com/cloud/answer/6158849?hl=en&ref_topic=6262490#serviceaccounts&zippy=%2Cservice-accounts)
+4. Add path to ssh key to ansible config (/etc/ansible/ansible.conf) \


Suggested change

4. Add path to ssh key to ansible config (/etc/ansible/ansible.conf) \

4. Add path to ssh key to ansible config (`/etc/ansible/ansible.conf`) \

lkatalin · 2022-07-14T18:32:46Z

keylime-ansible-gcp/README.md

+[defaults] \
+private_key_file = /home/user/my_key


Would suggest putting this in a code block

lkatalin · 2022-07-14T18:36:15Z

keylime-ansible-gcp/README.md

+1.  Install dependecies for the Ansible - GCP module 
+`$ pip3 install requests google-auth`
+2. [Create a GCP service account](https://developers.google.com/identity/protocols/oauth2/service-account#creatinganaccount) for ansible's use.
+3. [Create and download keys linked to this service account](https://support.google.com/cloud/answer/6158849?hl=en&ref_topic=6262490#serviceaccounts&zippy=%2Cservice-accounts)


"Choose whether to download the service account's public/private key as a standard P12 file, or as a JSON file that can be loaded by a Google API client library." which one here? I ended up using P12

lkatalin · 2022-07-14T18:38:58Z

keylime-ansible-gcp/README.md

+## Configuration
+1.  Install dependecies for the Ansible - GCP module 
+`$ pip3 install requests google-auth`
+2. [Create a GCP service account](https://developers.google.com/identity/protocols/oauth2/service-account#creatinganaccount) for ansible's use.


It might be good to add a step about using an existing project or creating a new one, because GCP forces you to do this before you can create the service account. Or just change this step to "create/use a project in your GCP account and then [create a GCP service account]"

lkatalin · 2022-07-14T18:55:25Z

keylime-ansible-gcp/README.md

+
+## Configuration
+1.  Install dependecies for the Ansible - GCP module 
+`$ pip3 install requests google-auth`


Maybe add that openssl is required / helpful

lkatalin · 2022-07-14T18:58:58Z

keylime-ansible-gcp/README.md

+`$ export GCP_PROJECT="<name of GCP project>"` \
+`$ export GCP_CRED_KIND="serviceaccount"`\
+`$ export GCP_CRED_FILE="<path to your service account key file>"` \
+`$ export GCP_ZONE="<zone for GCP instance>"` \


I think it'd be nice to suggest a default zone and/or link to the GCP zones page

lkatalin · 2022-07-14T19:00:10Z

keylime-ansible-gcp/README.md

+`$ export GCP_CRED_KIND="serviceaccount"`\
+`$ export GCP_CRED_FILE="<path to your service account key file>"` \
+`$ export GCP_ZONE="<zone for GCP instance>"` \
+`$ export GCP_REGION="<region for GCP instance>"` 


Same for this

lkatalin · 2022-07-14T19:01:11Z

keylime-ansible-gcp/README.md

+
+## Configuration
+1.  Install dependecies for the Ansible - GCP module 
+`$ pip3 install requests google-auth`


I'd say ansible is also a dependency!

lkatalin · 2022-07-14T19:03:12Z

keylime-ansible-gcp/README.md

+Run the playbook to create and set up an instance. 
+
+```bash
+ansible-playbook playbook.yml


I got this error:

[lily@localhost keylime-ansible-gcp]$ ansible-playbook playbook.yml [WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all' ERROR! couldn't resolve module/action 'google.cloud.gcp_compute_disk'. This often indicates a misspelling, missing collection, or incorrect module path. The error appears to be in '/home/lily/Repos/keylime-cloud-environments/keylime-ansible-gcp/roles/create-gcp/tasks/gcp.yml': line 1, column 3, but may be elsewhere in the file depending on the exact syntax problem. The offending line appears to be: - name: Create disk mapped from Fedora image ^ here

This looks like it may be the problem but I'm not sure what to enter for hostname / username, do you know?

keylime-ansible-gcp/README.md

lkatalin

The playbook seems to work this time in setting up the instance (from my local laptop)!! 💯

Though it does fail on

TASK [Wait to SSH into instance] ***********************************************
fatal: [localhost]: FAILED! => {"changed": false, "elapsed": 105, "msg": "Timeout when waiting for 34.152.62.86:22"}

PLAY RECAP *********************************************************************
localhost                  : ok=5    changed=2    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0

Maybe it's a network or permissions setting? Should I try from a GCP instance?

keylime-ansible-gcp/README.md

keylime-ansible-gcp/set_env_var.sh

keylime-ansible-gcp/README.md

lkatalin

This is working for me! Thanks for all the debugging and hard work, @avery-blanchard !

@mpeters Should we merge? Or would you like to try it? There is one step where a script parses the JSON file downloaded from GCP (this file includes a private key) and the script emits a warning before doing so. I think this should be okay but let me know if you think otherwise.

mpeters · 2022-07-29T18:47:32Z

I'll give this a spin on Monday and then we can merge it if there isn't anything big.

keylime-ansible-gcp/README.md

keylime-ansible-gcp/playbook.yml

keylime-ansible-gcp/roles/create-gcp/handlers/main.yml

keylime-ansible-gcp/roles/create-gcp/defaults/main.yml

keylime-ansible-gcp/roles/create-gcp/meta/main.yml

keylime-ansible-gcp/roles/keylime-gcp/defaults/main.yml

mpeters

It's looking good, but a couple of points:

If, as I suspect, the create-gcp role only holds tasks, then it doesn't need to be a role at all. It can just be a playbook of tasks. Not everything has to be a role and in fact, simple groups of tasks are better off as just a playbook instead of a role.
You moved a lot of stuff into the other ansible keylime project but I'd like to it better connected. The coolest would be to have some way to automatically apply that other role to these newly created instances. But if that seems too unwieldy, maybe just making it more explicit about how you would create an inventory file, checkout the project and run the playbooks in there.

mpeters · 2022-08-09T17:52:41Z

keylime-ansible-gcp/roles/create-gcp/tasks/main.yml

@@ -0,0 +1 @@
+- include: gcp.yml


What is the reason for splitting the tasks out into an include instead of directly in the main.yml?

mpeters · 2022-08-09T17:53:19Z

keylime-ansible-gcp/roles/create-gcp/vars/main.yml

@@ -0,0 +1,4 @@
+---
+# Section for vars
+shell_profiles:


I don't see this shell_profiles variable used anywhere.

mpeters · 2022-08-09T17:54:25Z

keylime-ansible-gcp/tests/inventory

@@ -0,0 +1 @@
+localhost


What is the purpose of this /tests directory and this inventory file?

mpeters · 2022-08-09T18:42:50Z

@avery-blanchard can you squash all of these commits into a single commit? That makes it easier to manage and is typical for most projects. There's no reason to keep all of the back and forth and fixes in separate commits and we'll have a nice clean history.

Signed-off-by: Avery Blanchard <[email protected]>

mpeters requested changes Jul 6, 2022

View reviewed changes

avery-blanchard force-pushed the ansible-gcp branch 2 times, most recently from 8ce3eea to cabaaf4 Compare July 13, 2022 18:07

lkatalin requested changes Jul 14, 2022

View reviewed changes

lkatalin reviewed Jul 18, 2022

View reviewed changes

keylime-ansible-gcp/README.md Outdated Show resolved Hide resolved

avery-blanchard force-pushed the ansible-gcp branch from 92bf857 to 107c32b Compare July 20, 2022 19:02

lkatalin reviewed Jul 21, 2022

View reviewed changes

lkatalin reviewed Jul 25, 2022

View reviewed changes

keylime-ansible-gcp/README.md Show resolved Hide resolved

lkatalin approved these changes Jul 27, 2022

View reviewed changes

mpeters requested changes Aug 3, 2022

View reviewed changes

lkatalin mentioned this pull request Aug 9, 2022

Add support for the rust agent keylime/ansible-keylime#25

Merged

avery-blanchard requested a review from mpeters August 9, 2022 17:33

mpeters requested changes Aug 9, 2022

View reviewed changes

mpeters approved these changes Aug 9, 2022

View reviewed changes

Add ansible role for GCP

34971b1

Signed-off-by: Avery Blanchard <[email protected]>

avery-blanchard force-pushed the ansible-gcp branch from 93aab03 to 34971b1 Compare August 9, 2022 18:53

mpeters approved these changes Aug 9, 2022

View reviewed changes

mpeters merged commit 7b9f0d9 into keylime:main Aug 9, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add ansible role for GCP #1

Add ansible role for GCP #1

avery-blanchard commented Jul 1, 2022

mpeters left a comment

mpeters Jul 6, 2022

mpeters Jul 6, 2022

lkatalin left a comment

lkatalin Jul 14, 2022

lkatalin Jul 14, 2022

lkatalin Jul 14, 2022

lkatalin Jul 14, 2022

lkatalin Jul 14, 2022

lkatalin Jul 14, 2022

lkatalin Jul 14, 2022

lkatalin Jul 14, 2022

lkatalin Jul 14, 2022

lkatalin Jul 14, 2022

lkatalin Jul 14, 2022

lkatalin left a comment

lkatalin left a comment

mpeters commented Jul 29, 2022

mpeters left a comment

mpeters Aug 9, 2022

mpeters Aug 9, 2022

mpeters Aug 9, 2022

mpeters commented Aug 9, 2022

	4. Add path to ssh key to ansible config (/etc/ansible/ansible.conf) \
	4. Add path to ssh key to ansible config (`/etc/ansible/ansible.conf`) \

		[defaults] \
		private_key_file = /home/user/my_key

Add ansible role for GCP #1

Add ansible role for GCP #1

Conversation

avery-blanchard commented Jul 1, 2022

mpeters left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lkatalin left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lkatalin left a comment

Choose a reason for hiding this comment

lkatalin left a comment

Choose a reason for hiding this comment

mpeters commented Jul 29, 2022

mpeters left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mpeters commented Aug 9, 2022