Feature/gh 201 use ssh agent #207
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Allow to provide private key content to Terraform instead of file
Allow to use ssh-agent for Ansible ssh connections
Check private key is valid path when use_ssh_agent is false Fix concurrency issue on sshAgent use with googleGenerator
3 tasks
|
Seeing a failure in unit tests: Looks like the testdata yaml file describing the compute should be updated to provide a private key content ? |
|
The file ~/.ssh/yorc.pem is not present in Travis build vm. I fix it with a test key pem file |
Codecov Report
@@ Coverage Diff @@
## develop #207 +/- ##
===========================================
- Coverage 39.79% 39.37% -0.43%
===========================================
Files 159 162 +3
Lines 14574 14851 +277
===========================================
+ Hits 5800 5847 +47
- Misses 7872 8077 +205
- Partials 902 927 +25
Continue to review full report at Codecov.
|
loicalbertin
requested changes
Nov 28, 2018
helper/stringutil/stringutil.go
Outdated
| // Truncate truncates a string if it's longer than defined length | ||
| // Add ... after the cut | ||
| func Truncate(str string, l int) string { | ||
| if len(str) > l { |
prov/ansible/execution.go
Outdated
| if !e.cfg.UseSSHAgent && sshCredentials.privateKey != "" { | ||
| // check privateKey's a valid path | ||
| if is, err := pathutil.IsValidPath(sshCredentials.privateKey); err != nil || !is { | ||
| return errors.Errorf("%q is not a valid path", stringutil.Truncate(sshCredentials.privateKey, 20)) |
There was a problem hiding this comment.
Why truncate where?
We want to will typically want to get the invalid path and make ls /my/deep/deep/path/to/key.pem ; ls /my/deep/deep/path/to; ls /my/deep/deep/path/; ls /my/deep/deep/ and so on to find the missing part.
prov/terraform/google/generator.go
Outdated
| @@ -37,11 +38,24 @@ const infrastructureName = "google" | |||
| type googleGenerator struct { | |||
| } | |||
|
|
|||
| func (g *googleGenerator) GenerateTerraformInfraForNode(ctx context.Context, cfg config.Configuration, deploymentID, nodeName, infrastructurePath string) (bool, map[string]string, []string, error) { | |||
| func getSSHAgent(ctx context.Context, privateKey string) (*sshutil.SSHAgent, error) { | |||
There was a problem hiding this comment.
Why is this not in the commons package?
…to feature/gh-201-use-ssh-agent
# Conflicts: # CHANGELOG.md # config/config.go
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pull Request description
Use ssh-agent to not write ssh private keys on disk
As: An ops
I want: to ensure that connection credentials are not left non-encrypted on disk
So that: I can relax and sleep this night
AC1: Allow to either specify a key path or a key content into the credential part of a Compute
AC2: before running Ansible command store key content into an ssh-agent for a limited amount of time
AC3: check if it also works with paramiko (anyways document what works or not)
AC4: support key content for terraform provisioning
AC5: Keys content should never be store unencrypted on disk
Description of the change
What I did
Add ssh_agent API to:
Update Ansible to :
Update Terraform to:
How to verify it
Description for the changelog
Applicable Issues
fixes #201