Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-08-01 19:46:07 -04:00
Code Issues Projects Releases Packages Wiki Activity

Disable SSH key deployment with debugd / cdbg

Browse source
This commit is contained in:
Malte Poll 2022-10-20 09:56:45 +02:00 • committed by Malte Poll
parent b57b25fdaa
commit 6a1405f7c9
5 changed files with 158 additions and 135 deletions
Download patch file Download diff file Expand all files Collapse all files

28
debugd/internal/cdbg/cmd/deploy.go
View file

@ -117,20 +117,24 @@ func deployOnEndpoint(ctx context.Context, in deployOnEndpointInput) error {
defer conn.Close()
client := pb.NewDebugdClient(conn)
log.Println("Uploading authorized keys")
pbKeys := []*pb.AuthorizedKey{}
for _, key := range in.authorizedKeys {
pbKeys = append(pbKeys, &pb.AuthorizedKey{
Username: key.Username,
KeyValue: key.PublicKey,
})
}
authorizedKeysResponse, err := client.UploadAuthorizedKeys(ctx, &pb.UploadAuthorizedKeysRequest{Keys: pbKeys}, grpc.WaitForReady(true))
if err != nil || authorizedKeysResponse.Status != pb.UploadAuthorizedKeysStatus_UPLOAD_AUTHORIZED_KEYS_SUCCESS {
return fmt.Errorf("uploading authorized keys to instance %v failed: %v / %w", in.debugdEndpoint, authorizedKeysResponse, err)
if len(in.authorizedKeys) > 0 {
log.Println("Warning: Uploading authorized keys is currently disabled.")
}
// TODO (stateless-ssh): re-enable once ssh keys can be deployed on readonly rootfs.
// log.Println("Uploading authorized keys")
// pbKeys := []*pb.AuthorizedKey{}
// for _, key := range in.authorizedKeys {
// pbKeys = append(pbKeys, &pb.AuthorizedKey{
// Username: key.Username,
// KeyValue: key.PublicKey,
// })
// }
// authorizedKeysResponse, err := client.UploadAuthorizedKeys(ctx, &pb.UploadAuthorizedKeysRequest{Keys: pbKeys}, grpc.WaitForReady(true))
// if err != nil || authorizedKeysResponse.Status != pb.UploadAuthorizedKeysStatus_UPLOAD_AUTHORIZED_KEYS_SUCCESS {
// return fmt.Errorf("uploading authorized keys to instance %v failed: %v / %w", in.debugdEndpoint, authorizedKeysResponse, err)
// }
stream, err := client.UploadBootstrapper(ctx)
stream, err := client.UploadBootstrapper(ctx, grpc.WaitForReady(true))
if err != nil {
return fmt.Errorf("starting bootstrapper upload to instance %v: %w", in.debugdEndpoint, err)
}