Skip to content

Add support for authorized_keys.d/ignition in OKD #2779

Closed
LorbusChris wants to merge 2 commits intoopenshift:masterfrom
LorbusChris:okd-authorized-keys
Closed

Add support for authorized_keys.d/ignition in OKD #2779
LorbusChris wants to merge 2 commits intoopenshift:masterfrom
LorbusChris:okd-authorized-keys

Conversation

@LorbusChris
Copy link
Copy Markdown
Contributor

See also #2778

- What I did

commit 22f0fb8e8c38e6da8f3a930ffb2e6f6fcddb3a86
Author: John Fortin <fortinj66@gmail.com>
Date:   Mon Feb 8 17:08:23 2021 -0500

    daemon: Create missing /home/core/.ssh/authorized_keys file on OKD
    
    Ignition on OKD may create dropins in authorized_keys.d instead of a single authorized_keys file, so in order
    to properly manage this file MCO should convert it into a single authorized_keys entry

commit 91c8881805142f21c8a28d60d4b7940b71d1b5a0
Author: Christian Glombek <cglombek@redhat.com>
Date:   Thu Jun 17 14:05:43 2021 +0200

    daemon: Make SSH keys owned by core user
    
    In OKD, the file does not exist and is therefore newly written
    via the atomicallyWriteSSHKey function.
    This change ensures the ownership is explicitly set to the core user
    and group (uid 1000/gid 1000) as it'll otherwise default to root.
    
    Fixes: https://github.com/openshift/okd/issues/655

- How to verify it

OKD e2e

- Description for the changelog
daemon: Create missing /home/core/.ssh/authorized_keys file on OKD
daemon: Make SSH keys owned by core user

cc @fortinj66 @bgilbert

fortinj66 and others added 2 commits September 28, 2021 15:12
Ignition on OKD may create dropins in authorized_keys.d instead of a single authorized_keys file, so in order
to properly manage this file MCO should convert it into a single authorized_keys entry
In OKD, the file does not exist and is therefore newly written
via the atomicallyWriteSSHKey function.
This change ensures the ownership is explicitly set to the core user
and group (uid 1000/gid 1000) as it'll otherwise default to root.

Fixes: okd-project/okd#655
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Sep 28, 2021

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: LorbusChris
To complete the pull request process, please assign yuqi-zhang after the PR has been reviewed.
You can assign the PR to them by writing /assign @yuqi-zhang in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Sep 28, 2021

@LorbusChris: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-workers-rhel7 91c8881 link false /test e2e-aws-workers-rhel7
ci/prow/okd-e2e-aws 91c8881 link false /test okd-e2e-aws
ci/prow/e2e-aws-workers-rhel8 91c8881 link false /test e2e-aws-workers-rhel8
ci/prow/e2e-aws-upgrade-single-node 91c8881 link false /test e2e-aws-upgrade-single-node
ci/prow/e2e-agnostic-upgrade 91c8881 link true /test e2e-agnostic-upgrade
ci/prow/e2e-aws-disruptive 91c8881 link false /test e2e-aws-disruptive

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@LorbusChris
Copy link
Copy Markdown
Contributor Author

This will be folded into #2688

/close

@openshift-ci openshift-ci Bot closed this Sep 28, 2021
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Sep 28, 2021

@LorbusChris: Closed this PR.

Details

In response to this:

This will be folded into #2688

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants