-
Notifications
You must be signed in to change notification settings - Fork 70
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
install: Add support for
--root-ssh-authorized-keys
The current `bootc install` model is VERY opinionated: we install the running container image to disk, and that is (almost!) it. The only non-container out of band state that we support injecting right now is kargs (via `--karg`) - we know we need this for machine local kernel arguments. (We do have a current outstanding PR to add a highly generic mechanism to inject arbitrary files in `/etc`, but I want to think about that more) THis current strict stance is quite painful for a use case like "take a generic container image and bootc install to-filesystem --alongside" in a cloud environment, because the generic container may not have cloud-init. With this change it becomes extremely convenient to: - Boot generic cloud image (e.g. AMI with apt/dnf + cloud-init) - cloud-init fetches SSH keys from hypervisor (instance metadata) - podman run -v /root/.ssh/authorized_keys:/keys:ro <image> bootc install ... --root-ssh-authorized-keys=/keys` And then the instance will carry forward those hypervisor-provided keys but without a dependency on cloud-init. Another use case for this of course is being the backend of things like Anaconda's kickstart verbs which support injecting SSH keys. Signed-off-by: Colin Walters <walters@verbum.org>
- Loading branch information
Showing
3 changed files
with
71 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,41 @@ | ||
use anyhow::Result; | ||
use camino::Utf8Path; | ||
use cap_std::fs::Dir; | ||
use cap_std_ext::{cap_std, dirext::CapStdExtDirExt}; | ||
use fn_error_context::context; | ||
|
||
const ETC_TMPFILES: &str = "etc/tmpfiles.d"; | ||
const ROOT_SSH_TMPFILE: &str = "bootc-root-ssh.conf"; | ||
|
||
#[context("Injecting root authorized_keys")] | ||
pub(crate) fn inject_root_ssh_authorized_keys(root: &Dir, contents: &str) -> Result<()> { | ||
// While not documented right now, this one looks like it does not newline wrap | ||
let b64_encoded = ostree_ext::glib::base64_encode(contents.as_bytes()); | ||
// See the example in https://systemd.io/CREDENTIALS/ | ||
// HOWEVER: I chose to use `f` and not `f~` in order to allow this to be overwritten | ||
// by something else later - e.g. for later key rotation support. The real more ideal | ||
// model here would be to have e.g .`/usr/lib/ssh/authorized_keys/root` that would be | ||
// *merged at runtime* with the home directory (if present) - but would be clearly immutable | ||
// underneath `/usr`. | ||
let tmpfiles_content = format!("f /root/.ssh/authorized_keys 600 root root - {b64_encoded}"); | ||
|
||
let tmpfiles_dir = Utf8Path::new(ETC_TMPFILES); | ||
root.create_dir_all(tmpfiles_dir)?; | ||
let target = tmpfiles_dir.join(ROOT_SSH_TMPFILE); | ||
root.atomic_write(target, &tmpfiles_content) | ||
.map_err(Into::into) | ||
} | ||
|
||
#[test] | ||
fn test_inject_root_ssh() -> Result<()> { | ||
let root = &cap_std_ext::cap_tempfile::TempDir::new(cap_std::ambient_authority())?; | ||
|
||
inject_root_ssh_authorized_keys(root, "ssh-ed25519 ABCDE example@demo\n").unwrap(); | ||
|
||
let content = root.read_to_string(format!("etc/tmpfiles.d/{ROOT_SSH_TMPFILE}"))?; | ||
assert_eq!( | ||
content, | ||
"f /root/.ssh/authorized_keys 600 root root - c3NoLWVkMjU1MTkgQUJDREUgZXhhbXBsZUBkZW1vCg==" | ||
); | ||
Ok(()) | ||
} |