containers: Use secrets for SSH keys, not env vars

Signed-off-by: Zack Cerza <zack@redhat.com>

diff --git a/containers/docker-compose/README.md b/containers/docker-compose/README.md
index e69d1bf7f130f1b280dc311f3914cc025ef2a2a6..b2c14822e36040eff993b8042ad1951a812a8041 100644 (file)
--- a/containers/docker-compose/README.md
+++ b/containers/docker-compose/README.md
@@ -40,11 +40,13 @@ Depending on your local operating system, it may be necessary to connect to the
 
 #### Using your SSH private key
 
-In your local shell, simply:
+In your local shell, first:
 ```bash
-export SSH_PRIVKEY_PATH=$HOME/.ssh/id_rsa
+cp ~/.ssh/id_rsa{,.pub} .
+docker secret create id_rsa ~/.ssh/id_rsa
+docker secret create id_rsa.pub ~/.ssh/id_rsa.pub
 ```
-The teuthology container will write it to a file at runtime.
+Then, remove the entire top-level `secrets:` section from docker-compose.yml.
 
 #### Reserving Machines in the Lab
 
@@ -90,4 +92,4 @@ TEUTHOLOGY_WAIT=1 ./start.sh
 To schedule tests in wait mode:
 ```bash
 docker exec docker-compose_teuthology_1 /venv/bin/teuthology-suite ...
-```
\ No newline at end of file
+```

diff --git a/containers/docker-compose/docker-compose.yml b/containers/docker-compose/docker-compose.yml
index 30cc9fc3285dfdf53633d057b7032bb76a087cc7..fff32fb9cfb8fe8fcf18584ac0a6993ffc5ab0bf 100644 (file)
--- a/containers/docker-compose/docker-compose.yml
+++ b/containers/docker-compose/docker-compose.yml
@@ -1,5 +1,12 @@
 version: '3.8'
 
+
+secrets:
+  id_rsa:
+    file: id_rsa
+  id_rsa.pub:
+    file: id_rsa.pub
+
 services:
   postgres:
     image: postgres:14
@@ -59,8 +66,6 @@ services:
     build:
       context: ../../
       dockerfile: ./containers/teuthology-dev/Dockerfile
-      args:
-        SSH_PRIVKEY_FILE: $SSH_PRIVKEY_FILE
     depends_on:
         paddles:
             condition: service_healthy
@@ -68,12 +73,12 @@ services:
         - paddles
         - beanstalk
     environment:
-      SSH_PRIVKEY:
-      SSH_PRIVKEY_FILE:
       MACHINE_TYPE:
       TESTNODES:
       TEUTHOLOGY_WAIT:
       TEUTH_BRANCH:
+    secrets:
+      - id_rsa
   testnode:
     build:
       context: ../testnode-docker-compose
@@ -87,6 +92,6 @@ services:
       - paddles
     ports:
       - "22"
-    environment:
-      SSH_PUBKEY:
+    secrets:
+      - id_rsa.pub
     platform: linux/amd64

diff --git a/containers/docker-compose/start.sh b/containers/docker-compose/start.sh
index 871258c5beb81c4e9f4df42d6a6abaf02e583f68..c2e0bcebfcf35c103e6ed1e9cd5dae948a4eec59 100755 (executable)
--- a/containers/docker-compose/start.sh
+++ b/containers/docker-compose/start.sh
@@ -24,15 +24,8 @@ if [ -n "$CUSTOM_CONF" ]; then
 fi
 
 # Generate an SSH keypair to use if necessary
-if [ -z "$SSH_PRIVKEY_PATH" ]; then
-    SSH_PRIVKEY_PATH=$(mktemp -u /tmp/teuthology-ssh-key-XXXXXX)
-    ssh-keygen -t rsa -N '' -f $SSH_PRIVKEY_PATH
-    export SSH_PRIVKEY=$(cat $SSH_PRIVKEY_PATH)
-    export SSH_PUBKEY=$(cat $SSH_PRIVKEY_PATH.pub)
-    export SSH_PRIVKEY_FILE=id_rsa
-else
-    export SSH_PRIVKEY=$(cat $SSH_PRIVKEY_PATH)
-    export SSH_PRIVKEY_FILE=$(basename $SSH_PRIVKEY_PATH | cut -d. -f1)
+if [ ! -f id_rsa ]; then
+    ssh-keygen -t rsa -N '' -f id_rsa
 fi
 
 if [ -z "$TEUTHOLOGY_WAIT" ]; then

diff --git a/containers/testnode-docker-compose/testnode_start.sh b/containers/testnode-docker-compose/testnode_start.sh
index d29c3b6d0ae94a6331d7a48fe654337d01f52ca1..46d44179eb4a21baf30928fe668f660731a255f4 100755 (executable)
--- a/containers/testnode-docker-compose/testnode_start.sh
+++ b/containers/testnode-docker-compose/testnode_start.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/bash
 set -x
-echo "$SSH_PUBKEY" > /root/.ssh/authorized_keys
-echo "$SSH_PUBKEY" > /home/ubuntu/.ssh/authorized_keys
+cat /run/secrets/id_rsa.pub >> /root/.ssh/authorized_keys
+cat /run/secrets/id_rsa.pub >> /home/ubuntu/.ssh/authorized_keys
 chown ubuntu /home/ubuntu/.ssh/authorized_keys
 payload="{\"name\": \"$(hostname)\", \"machine_type\": \"testnode\", \"up\": true, \"locked\": false, \"os_type\": \"ubuntu\", \"os_version\": \"20.04\"}"
 for i in $(seq 1 5); do

diff --git a/containers/testnode/Dockerfile b/containers/testnode/Dockerfile
index 016d32117a65ea29d049b99d80c10f92a5a4a1a3..355b6951f85bc4007eb11362f218b25295db8b1b 100644 (file)
--- a/containers/testnode/Dockerfile
+++ b/containers/testnode/Dockerfile
@@ -14,7 +14,7 @@ COPY testnode_start.sh /
 COPY testnode_stop.sh /
 COPY testnode_sudoers /etc/sudoers.d/teuthology
 RUN \
-    ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key -N '' && \
+    ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N '' && \
     sed -i 's/#PermitRootLogin yes/PermitRootLogin yes/' /etc/ssh/sshd_config && \
     mkdir -p /root/.ssh && \
     chmod 700 /root/.ssh && \

diff --git a/containers/testnode/testnode_start.sh b/containers/testnode/testnode_start.sh
index d29c3b6d0ae94a6331d7a48fe654337d01f52ca1..46d44179eb4a21baf30928fe668f660731a255f4 100755 (executable)
--- a/containers/testnode/testnode_start.sh
+++ b/containers/testnode/testnode_start.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/bash
 set -x
-echo "$SSH_PUBKEY" > /root/.ssh/authorized_keys
-echo "$SSH_PUBKEY" > /home/ubuntu/.ssh/authorized_keys
+cat /run/secrets/id_rsa.pub >> /root/.ssh/authorized_keys
+cat /run/secrets/id_rsa.pub >> /home/ubuntu/.ssh/authorized_keys
 chown ubuntu /home/ubuntu/.ssh/authorized_keys
 payload="{\"name\": \"$(hostname)\", \"machine_type\": \"testnode\", \"up\": true, \"locked\": false, \"os_type\": \"ubuntu\", \"os_version\": \"20.04\"}"
 for i in $(seq 1 5); do

diff --git a/containers/teuthology-dev/Dockerfile b/containers/teuthology-dev/Dockerfile
index f350b31dbde2e03a19e787548a8675eb1f2bd4de..c2566a0455448fc7773d65ad7227b5b3fc575766 100644 (file)
--- a/containers/teuthology-dev/Dockerfile
+++ b/containers/teuthology-dev/Dockerfile
@@ -1,5 +1,4 @@
 FROM ubuntu:latest
-ARG SSH_PRIVKEY_FILE=id_ed25519
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && \
     apt-get install -y \
@@ -36,8 +35,8 @@ COPY containers/teuthology-dev/ansible_inventory/hosts /etc/ansible/
 COPY containers/teuthology-dev/ansible_inventory/secrets /etc/ansible/
 RUN \
     mkdir $HOME/.ssh && \
-    touch $HOME/.ssh/${SSH_PRIVKEY_FILE} && \
-    chmod 600 $HOME/.ssh/${SSH_PRIVKEY_FILE} && \
+    touch $HOME/.ssh/id_rsa && \
+    chmod 600 $HOME/.ssh/id_rsa && \
     echo "StrictHostKeyChecking=no" > $HOME/.ssh/config && \
     echo "UserKnownHostsFile=/dev/null" >> $HOME/.ssh/config
-ENTRYPOINT /teuthology.sh
\ No newline at end of file
+ENTRYPOINT /teuthology.sh

diff --git a/containers/teuthology-dev/teuthology.sh b/containers/teuthology-dev/teuthology.sh
index 0378f93d44c62fe702e6793e3abddcba759f6563..7f8eed6501f327629a7c8be9ca68c967dff6c6f0 100755 (executable)
--- a/containers/teuthology-dev/teuthology.sh
+++ b/containers/teuthology-dev/teuthology.sh
@@ -1,11 +1,8 @@
 #!/usr/bin/bash
 set -e
-# We don't want -x yet, in case the private key is sensitive
-if [ -n "$SSH_PRIVKEY_FILE" ]; then
-    echo "$SSH_PRIVKEY" > $HOME/.ssh/$SSH_PRIVKEY_FILE
-fi
 source /teuthology/virtualenv/bin/activate
 set -x
+cat /run/secrets/id_rsa > $HOME/.ssh/id_rsa
 if [ -n "$TESTNODES" ]; then
     for node in $(echo $TESTNODES | tr , ' '); do
         teuthology-update-inventory -m $MACHINE_TYPE $node