-
Notifications
You must be signed in to change notification settings - Fork 18
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Enable sshd
service when using ssh
on a specific node
#325
Comments
I believe that gardenctl should not manipulate this setting and attempt to restore it afterwards, as suggested in #331. Please refer to my comment for reasons why I consider this to be a poor approach. Instead, I suggest to extend workersSettings:
sshAccess:
enabled: false
# policy: # has no effect if set workersSettings:
sshAccess:
enabled: true
policy: 'ondemand' # allows Bastions to be created. sshd will be running on the worker nodes as long as there are Bastion resources workersSettings:
sshAccess:
enabled: true
policy: 'always' # regardless if there are Bastion resources, the sshd is running on the worker nodes We currently support options 1 and 3. The newly introduced feature is option 2. If a Bastion is created, the sshd will be initiated and subsequently terminated once the last bastion resource has been deleted. This eliminates the need for gardentl to manipulate the sshAccess settings on the Shoot and attempt to restore the initial enabled state. Moreover, the shoot owner retains control of the setting. This means that if it's disabled, debugging is not possible unless it's explicitly enabled. @AleksandarSavchev @rfranzke @dimityrmirchev (as you were involved in #7188), WDYT? |
I agree with you that I approve your suggested approach and would like to point out that when option 2 is used it would work the same way as option 1. When a Bastion is created for a node in a cluster using option 2 the following steps should happen:
When all Bastions for a node are deleted we can start the |
I also think that what @petersutter suggested is reasonable approach. |
if I understand correctly the implementation will not be in Gardenctl repo or Bastions repo. it will be enhanced from gardener/gardener? not clear if new implementation comes from gardener/gardener side? waiting answer from Devs |
What would you like to be added:
Currently it is not possible to use
gardenctl ssh
on nodes when the cluster hasprovider.workersSettings.sshAccess.enabled
set tofalse
. I would like to enablessh
access when usinggardenctl ssh
on a specific node if it had been disabled and disable it again when thessh
session ends.Why is this needed:
Improve debugging of issues when cluster has
provider.workersSettings.sshAccess.enabled
set tofalse
.The text was updated successfully, but these errors were encountered: