Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update SSH docs #3233

Merged
merged 2 commits into from
Feb 15, 2021
+58 −16
Merged

Update SSH docs #3233

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1e8f353
Update SSH docs
aclevername Feb 8, 2021
f0c61f9
Merge branch 'main' into ssh-docs
Feb 15, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
7 changes: 6 additions & 1 deletion examples/07-ssh-keys.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,14 +27,19 @@ nodeGroups:
instanceType: m5.large
desiredCapacity: 1
ssh: # import inline public key
publicKey: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDqZEdzvHnK/GVP8nLngRHu/GDi/3PeES7+Bx6l3koXn/Oi/UmM9/jcW5XGziZ/oe1cPJ777eZV7muEvXg5ZMQBrYxUtYCdvd8Rt6DIoSqDLsIPqbuuNlQoBHq/PU2IjpWnp/wrJQXMk94IIrGjY8QHfCnpuMENCucVaifgAhwyeyuO5KiqUmD8E0RmcsotHKBV9X8H5eqLXd8zMQaPl+Ub7j5PG+9KftQu0F/QhdFvpSLsHaxvBzA5nhIltjkaFcwGQnD1rpCM3+UnQE7Izoa5Yt1xoUWRwnF+L2TKovW7+bYQ1kxsuuiX149jXTCJDVjkYCqi7HkrXYqcC1sbsror someuser@hostname"
publicKey: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDqZEdzvHnK/GVP8nLngRHu/GDi/3PeES7+Bx6l3koXn/Oi/UmM9/jcW5XGziZ/oe1cPJ777eZV7muEvXg5ZMQBrYxUtYCdvd8Rt6DIoSqDLsIPqbuuNlQoBHq/PU2IjpWnp/wrJQXMk94IIrGjY8QHfCnpuMENCucVaifgAhwyeyuO5KiqUmD8E0RmcsotHKBV9X8H5eqLXd8zMQaPl+Ub7j5PG+9KftQu0F/QhdFvpSLsHaxvBzA5nhIltjkaFcwGQnD1rpCM3+UnQE7Izoa5Yt1xoUWRwnF+L2TKovW7+bYQ1kxsuuiX149jXTCJDVjkYCqi7HkrXYqcC1sbsror someuser@hostname"
- name: ng-5
instanceType: m5.large
desiredCapacity: 1
ssh: # use existing EC2 key but don't allow SSH access to nodegroup (security group is not created to allow SSH access).
publicKeyName: ec2_dev_key
allow: false
- name: ng-6
instanceType: m5.large
desiredCapacity: 1
ssh:
enableSsm: true
- name: ng-7
instanceType: m5.large
desiredCapacity: 1
# no SSH
16 changes: 11 additions & 5 deletions pkg/apis/eksctl.io/v1alpha5/assets/schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1612,22 +1612,28 @@
"properties": {
"allow": {
"type": "boolean",
"description": "Enables/Disables the security group configuration. Values provided by SourceSecurityGroupIDs are ignored if set to false",
"x-intellij-html-description": "Enables/Disables the security group configuration. Values provided by SourceSecurityGroupIDs are ignored if set to false"
"description": "If Allow is true the SSH configuration provided is used, otherwise it is ignored. Only one of PublicKeyPath, PublicKey and PublicKeyName can be configured",
"x-intellij-html-description": "If Allow is true the SSH configuration provided is used, otherwise it is ignored. Only one of PublicKeyPath, PublicKey and PublicKeyName can be configured"
},
"enableSsm": {
"type": "boolean",
"description": "Enables the ability to [SSH onto nodes using SSM](/introduction#ssh-access)",
"x-intellij-html-description": "Enables the ability to <a href=\"/introduction#ssh-access\">SSH onto nodes using SSM</a>"
},
"publicKey": {
"type": "string"
"type": "string",
"description": "Public key to be added to the nodes SSH keychain. If Allow is false this value is ignored.",
"x-intellij-html-description": "Public key to be added to the nodes SSH keychain. If Allow is false this value is ignored."
},
"publicKeyName": {
"type": "string"
"type": "string",
"description": "Public key name in EC2 to be added to the nodes SSH keychain. If Allow is false this value is ignored.",
"x-intellij-html-description": "Public key name in EC2 to be added to the nodes SSH keychain. If Allow is false this value is ignored."
},
"publicKeyPath": {
"type": "string"
"type": "string",
"description": "The path to the SSH public key to be added to the nodes SSH keychain. If Allow is true this value defaults to \"~/.ssh/id_rsa.pub\", otherwise the value is ignored.",
"x-intellij-html-description": "The path to the SSH public key to be added to the nodes SSH keychain. If Allow is true this value defaults to &quot;~/.ssh/id_rsa.pub&quot;, otherwise the value is ignored."
},
"sourceSecurityGroupIds": {
"items": {
Expand Down
6 changes: 3 additions & 3 deletions pkg/apis/eksctl.io/v1alpha5/schema.go
View file
Open in desktop

Large diffs are not rendered by default.

12 changes: 7 additions & 5 deletions pkg/apis/eksctl.io/v1alpha5/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1065,14 +1065,16 @@ type (

// NodeGroupSSH holds all the ssh access configuration to a NodeGroup
NodeGroupSSH struct {
// +optional Enables/Disables the security group configuration. Values provided by SourceSecurityGroupIDs
// are ignored if set to false
// +optional If Allow is true the SSH configuration provided is used, otherwise it is ignored. Only one of
// PublicKeyPath, PublicKey and PublicKeyName can be configured
Allow *bool `json:"allow"`
// +optional
// +optional The path to the SSH public key to be added to the nodes SSH keychain. If Allow is true this value
// defaults to "~/.ssh/id_rsa.pub", otherwise the value is ignored.
aclevername marked this conversation as resolved.
Show resolved Hide resolved
PublicKeyPath *string `json:"publicKeyPath,omitempty"`
// +optional
// +optional Public key to be added to the nodes SSH keychain. If Allow is false this value is ignored.
aclevername marked this conversation as resolved.
Show resolved Hide resolved
PublicKey *string `json:"publicKey,omitempty"`
// +optional
// +optional Public key name in EC2 to be added to the nodes SSH keychain. If Allow is false this value
// is ignored.
PublicKeyName *string `json:"publicKeyName,omitempty"`
// +optional
SourceSecurityGroupIDs []string `json:"sourceSecurityGroupIds,omitempty"`
Expand Down
4 changes: 2 additions & 2 deletions pkg/ctl/cmdutils/configfile_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -266,8 +266,8 @@ var _ = Describe("cmdutils configfile", func() {
{"03-two-nodegroups.yaml", 2, false, false},
{"05-advanced-nodegroups.yaml", 3, true, false},
{"05-advanced-nodegroups.yaml", 3, false, false},
{"07-ssh-keys.yaml", 6, true, false},
{"07-ssh-keys.yaml", 6, false, false},
{"07-ssh-keys.yaml", 7, true, false},
{"07-ssh-keys.yaml", 7, false, false},
{"15-managed-nodes.yaml", 4, true, true},
{"15-managed-nodes.yaml", 4, false, true},
{"20-bottlerocket.yaml", 2, false, false},
Expand Down
29 changes: 29 additions & 0 deletions userdocs/src/usage/managing-nodegroups.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,35 @@ There are no specific commands in `eksctl`to update the labels of a nodegroup bu
kubectl label nodes -l alpha.eksctl.io/nodegroup-name=ng-1 new-label=foo
```

### SSH Access
Copy link
Contributor Author

@aclevername aclevername Feb 8, 2021 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't really have a great place for these docs to live, and I don't really want to add a page for just SSH configuration as its pretty minor. I've put it here for now, open to suggests

You can enable SSH access for nodegroups by configuring one of `publicKey`, `publicKeyName` and `publicKeyPath` in your
aclevername marked this conversation as resolved.
Show resolved Hide resolved
nodegroup configuration. Alternatively you can use [AWS Systems Manager (SSM)](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-sessions-start.html#sessions-start-cli) to SSH onto nodes, by configuring the nodegroup with `enableSsm`:


```yaml
nodeGroups:
- name: ng-1
instanceType: m5.large
desiredCapacity: 1
ssh: # import public key from file
publicKeyPath: ~/.ssh/id_rsa_tests.pub
- name: ng-2
instanceType: m5.large
desiredCapacity: 1
ssh: # use existing EC2 key
publicKeyName: ec2_dev_key
- name: ng-3
instanceType: m5.large
desiredCapacity: 1
ssh: # import inline public key
publicKey: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDqZEdzvHnK/GVP8nLngRHu/GDi/3PeES7+Bx6l3koXn/Oi/UmM9/jcW5XGziZ/oe1cPJ777eZV7muEvXg5ZMQBrYxUtYCdvd8Rt6DIoSqDLsIPqbuuNlQoBHq/PU2IjpWnp/wrJQXMk94IIrGjY8QHfCnpuMENCucVaifgAhwyeyuO5KiqUmD8E0RmcsotHKBV9X8H5eqLXd8zMQaPl+Ub7j5PG+9KftQu0F/QhdFvpSLsHaxvBzA5nhIltjkaFcwGQnD1rpCM3+UnQE7Izoa5Yt1xoUWRwnF+L2TKovW7+bYQ1kxsuuiX149jXTCJDVjkYCqi7HkrXYqcC1sbsror someuser@hostname"
- name: ng-4
instanceType: m5.large
desiredCapacity: 1
ssh: # enable SSH using SSM
enableSsm: true
```

### Deleting and draining

To delete a nodegroup, run:
Expand Down