Mount each private key into single kubernetes secret #14950

vzhukovs · 2019-10-22T12:49:44Z

What does this PR do?

This changes proposal changes default behavior of storing ssh private keys in Kubernetes secrets. There was a mechanism, that stored each private key in dedicated secret, that might faced with exception related to secret count limit in internal infrastructure. New behavior puts all ssh private keys in one Kubernetes secret in following structure: host_name:private_key. Location of private ssh keys was changes on file system and become: /etc/ssh/private/{private_key_with_host_name}. Kubernetes secret type was changed from kubernetes.io/ssh-auth to opaque to allow multi value secret.

Here is example of secret stored in Kubernetes 1 and file system structure 2.

Signed-off-by: Vlad Zhukovskyi vzhukovs@redhat.com

What issues does this PR fix or reference?

#14438

Mount each private key into single kubernetes secret

Release Notes

Mount each private key into single kubernetes secret

Docs PR

N/A

vzhukovs · 2019-10-22T12:50:44Z

Set status to draft. Need to be checked on OpenShift environment. Just checked only on Kubernetes.

che-bot · 2019-10-22T12:55:26Z

E2E tests of Eclipse Che Multiuser on OCP has failed:

Build details
Test report
docker image: eclipseche/che-server:14950
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.
Use command "ci-test" to rerun the test.

che-bot · 2019-10-22T13:01:15Z

E2E Happy path tests of Eclipse Che Single User on K8S (minikube v1.1.1) has been successful:

build details
logs and configs
"che-server" docker image: maxura/che-server:14950

che-bot · 2019-10-22T13:37:09Z

E2E Happy path tests of Eclipse Che Single User on K8S (minikube v1.1.1) has been successful:

build details
logs and configs
"che-server" docker image: maxura/che-server:14950

che-bot · 2019-10-22T14:41:24Z

E2E tests of Eclipse Che Multiuser on OCP has been successful:

Build details
Test report
docker image: eclipseche/che-server:14950

vzhukovs · 2019-10-23T13:28:47Z

Checked on Minishift. All private keys stored in single secret.

vzhukovs · 2019-10-24T07:57:28Z

ci-build

amisevsk

Generally LGTM, a few comments inline.

...ava/org/eclipse/che/workspace/infrastructure/kubernetes/provision/VcsSshKeysProvisioner.java

che-bot · 2019-10-28T10:58:08Z

E2E Happy path tests of Eclipse Che Single User on K8S (minikube v1.1.1) has failed:

build details
test report
logs and configs
"che-server" docker image: maxura/che-server:14950
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.
Use command "crw-ci-test" to rerun the test.

vzhukovs · 2019-10-28T11:35:56Z

crw-ci-test

che-bot · 2019-10-28T11:37:32Z

E2E tests of Eclipse Che Multiuser on OCP has been successful:

Build details
Test report
docker image: eclipseche/che-server:14950

che-bot · 2019-10-28T11:47:40Z

E2E Happy path tests of Eclipse Che Single User on K8S (minikube v1.1.1) has been successful:

build details
logs and configs
"che-server" docker image: maxura/che-server:14950

sleshchenko · 2019-10-29T09:24:47Z

...ava/org/eclipse/che/workspace/infrastructure/kubernetes/provision/VcsSshKeysProvisioner.java

+            .stream()
+            .filter(
+                sshPair ->
+                    !isNullOrEmpty(sshPair.getName()) && !isNullOrEmpty(sshPair.getPrivateKey()))


I believe that name must not be null or empty https://github.com/eclipse/che/blob/07263f1e30089689d71b057f747a44a29283e3c4/wsmaster/che-core-api-ssh-shared/src/main/java/org/eclipse/che/api/ssh/shared/model/SshPair.java#L25

And PrivateKey may be null, so the check is needed.

There is a filter that checks only non nullable ssh keys, isn't it?

...ava/org/eclipse/che/workspace/infrastructure/kubernetes/provision/VcsSshKeysProvisioner.java

sleshchenko

LGTM

Please take a look my minor inline comments

che-bot · 2019-10-29T09:41:06Z

E2E tests of Eclipse Che Multiuser on OCP has failed:

Build details
Test report
docker image: eclipseche/che-server:14950
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.
Use command "ci-test" to rerun the test.

che-bot · 2019-10-29T09:42:55Z

E2E Happy path tests of Eclipse Che Single User on K8S (minikube v1.1.1) has been successful:

build details
logs and configs
"che-server" docker image: maxura/che-server:14950

skabashnyuk · 2019-10-29T09:58:11Z

Do we need any changes in docs?

che-bot · 2019-10-29T09:59:54Z

E2E Happy path tests of Eclipse Che Single User on K8S (minikube v1.1.1) has been successful:

build details
logs and configs
"che-server" docker image: maxura/che-server:14950

vzhukovs · 2019-10-29T10:35:58Z

@skabashnyuk no, this is an internal modification, that is not reflected in any docs.

che-bot · 2019-10-29T10:40:37Z

E2E tests of Eclipse Che Multiuser on OCP has failed:

Build details
Test report
docker image: eclipseche/che-server:14950
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.
Use command "ci-test" to rerun the test.

vzhukovs · 2019-10-29T12:05:21Z

ci-test

che-bot · 2019-10-29T13:01:10Z

E2E tests of Eclipse Che Multiuser on OCP has failed:

Build details
Test report
docker image: eclipseche/che-server:14950
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.
Use command "ci-test" to rerun the test.

vzhukovs · 2019-10-29T13:25:11Z

ci-test

che-bot · 2019-10-29T14:18:31Z

E2E tests of Eclipse Che Multiuser on OCP has failed:

Build details
Test report
docker image: eclipseche/che-server:14950
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.
Use command "ci-test" to rerun the test.

dmytro-ndp · 2019-10-29T16:04:43Z

ci-test

che-bot · 2019-10-29T16:54:04Z

E2E tests of Eclipse Che Multiuser on OCP has been successful:

Build details
Test report
docker image: eclipseche/che-server:14950

Signed-off-by: Vlad Zhukovskyi <vzhukovs@redhat.com>

che-bot · 2019-10-30T13:13:18Z

E2E Happy path tests of Eclipse Che Single User on K8S (minikube v1.1.1) has been successful:

build details
logs and configs
"che-server" docker image: maxura/che-server:14950

che-bot · 2019-10-30T13:13:27Z

E2E Happy path tests of Eclipse Che Single User on K8S (minikube v1.1.1) has failed:

build details
test report
logs and configs
"che-server" docker image: maxura/che-server:14950
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.
Use command "crw-ci-test" to rerun the test.

che-bot · 2019-10-30T13:49:06Z

E2E tests of Eclipse Che Multiuser on OCP has failed:

Build details
Test report
docker image: eclipseche/che-server:14950
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.
Use command "ci-test" to rerun the test.

vzhukovs added kind/task Internal things, technical debt, and to-do tasks to be performed. team/ide severity/P2 Has a minor but important impact to the usage or development of the system. labels Oct 22, 2019

vzhukovs added this to the 7.4.0 milestone Oct 22, 2019

vzhukovs requested a review from vparfonov October 22, 2019 12:49

vzhukovs self-assigned this Oct 22, 2019

che-bot added the status/code-review This issue has a pull request posted for it and is awaiting code review completion by the community. label Oct 22, 2019

vzhukovs requested review from ibuziuk and l0rd October 23, 2019 13:27

vzhukovs marked this pull request as ready for review October 23, 2019 13:27

vzhukovs requested review from amisevsk, metlos, nickboldt, rhopp and sleshchenko as code owners October 23, 2019 13:27

amisevsk reviewed Oct 24, 2019

View reviewed changes

vparfonov approved these changes Oct 29, 2019

View reviewed changes

sleshchenko reviewed Oct 29, 2019

View reviewed changes

...ava/org/eclipse/che/workspace/infrastructure/kubernetes/provision/VcsSshKeysProvisioner.java Outdated Show resolved Hide resolved

sleshchenko approved these changes Oct 29, 2019

View reviewed changes

amisevsk approved these changes Oct 29, 2019

View reviewed changes

eclipse-che deleted a comment from che-bot Oct 29, 2019

Mount each private key into single kubernetes secret

906ea32

Signed-off-by: Vlad Zhukovskyi <vzhukovs@redhat.com>

vzhukovs force-pushed the che#14438 branch from 87f8b3a to 906ea32 Compare October 30, 2019 12:52

vzhukovs merged commit 09c9de9 into master Oct 30, 2019

vzhukovs deleted the che#14438 branch October 30, 2019 13:08

che-bot removed the status/code-review This issue has a pull request posted for it and is awaiting code review completion by the community. label Oct 30, 2019

vparfonov mentioned this pull request Oct 30, 2019

[Hosted Che] Forbidden!Configured service account doesn't have access. Service account may have been revoked. #14830

Closed

4 tasks

monaka mentioned this pull request Nov 15, 2019

Use the hashed name for the path to each ssh-secret. (eclipse#14151). #14243

Closed

vinokurig mentioned this pull request Apr 3, 2020

Restart workspace fail (OpenShift Dedicated, minishift) #16512

Closed

24 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Mount each private key into single kubernetes secret #14950

Mount each private key into single kubernetes secret #14950

vzhukovs commented Oct 22, 2019

vzhukovs commented Oct 22, 2019

che-bot commented Oct 22, 2019

che-bot commented Oct 22, 2019

che-bot commented Oct 22, 2019

che-bot commented Oct 22, 2019

vzhukovs commented Oct 23, 2019

vzhukovs commented Oct 24, 2019

amisevsk left a comment

che-bot commented Oct 28, 2019

vzhukovs commented Oct 28, 2019

che-bot commented Oct 28, 2019

che-bot commented Oct 28, 2019

sleshchenko Oct 29, 2019

vzhukovs Oct 29, 2019

sleshchenko left a comment

che-bot commented Oct 29, 2019

che-bot commented Oct 29, 2019

skabashnyuk commented Oct 29, 2019

che-bot commented Oct 29, 2019

vzhukovs commented Oct 29, 2019

che-bot commented Oct 29, 2019

vzhukovs commented Oct 29, 2019

che-bot commented Oct 29, 2019

vzhukovs commented Oct 29, 2019

che-bot commented Oct 29, 2019

dmytro-ndp commented Oct 29, 2019

che-bot commented Oct 29, 2019

che-bot commented Oct 30, 2019

che-bot commented Oct 30, 2019

che-bot commented Oct 30, 2019

Mount each private key into single kubernetes secret #14950

Mount each private key into single kubernetes secret #14950

Conversation

vzhukovs commented Oct 22, 2019

What does this PR do?

What issues does this PR fix or reference?

Release Notes

Docs PR

vzhukovs commented Oct 22, 2019

che-bot commented Oct 22, 2019

che-bot commented Oct 22, 2019

che-bot commented Oct 22, 2019

che-bot commented Oct 22, 2019

vzhukovs commented Oct 23, 2019

vzhukovs commented Oct 24, 2019

amisevsk left a comment

Choose a reason for hiding this comment

che-bot commented Oct 28, 2019

vzhukovs commented Oct 28, 2019

che-bot commented Oct 28, 2019

che-bot commented Oct 28, 2019

sleshchenko Oct 29, 2019

Choose a reason for hiding this comment

vzhukovs Oct 29, 2019

Choose a reason for hiding this comment

sleshchenko left a comment

Choose a reason for hiding this comment

che-bot commented Oct 29, 2019

che-bot commented Oct 29, 2019

skabashnyuk commented Oct 29, 2019

che-bot commented Oct 29, 2019

vzhukovs commented Oct 29, 2019

che-bot commented Oct 29, 2019

vzhukovs commented Oct 29, 2019

che-bot commented Oct 29, 2019

vzhukovs commented Oct 29, 2019

che-bot commented Oct 29, 2019

dmytro-ndp commented Oct 29, 2019

che-bot commented Oct 29, 2019

che-bot commented Oct 30, 2019

che-bot commented Oct 30, 2019

che-bot commented Oct 30, 2019