SSH Certificate Authentication

[bernard-wagner]

Add the ability to use SSH certificates, in addition to SSH keys. This allows team members to manage a cluster without sharing private keys or maintaining a list of authorized_keys. Would also be useful when automating cluster deployment in CI/CD pipeline that uses Vault for secrets management.

Additional background:
https://www.vaultproject.io/docs/secrets/ssh/index.html
https://man.openbsd.org/ssh-keygen.1#CERTIFICATES
https://man.openbsd.org/sshd_config#TrustedUserCAKeys

[cjellick]

@rmweir to validate (work with @galal-hussein to understand the issue)

[rmweir]

Validated that RKE now supports SSH certificates.

Steps to validate:

1. Provision CoreOS vm on Google cloud
2. On local: ssh-keygen -t rsa -b 4096 -f demo-cert -q -P ""
3. cat demo-cert.pub
4. On CoreOS: Create config.yml with following contents OR SKIP TO STEP 6 FOR NON CLOUDCONFIG:

#cloud-config
write_files:
-   content: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCvElTIApYLFvue/GYZYVA4ur+3p+1FDE5jfKRpiTTUDm1/mjrUjXBt2fuJ9Lu9Hzje5bpC5nOYmmFxPFhcF98PpltplrQLcWA8uPCDYgrO1IFivmpBQ2Mn4FqRbMtsYMFdI+mcaYvBEvce/d351kjNKR0EOb7+Aww9EooWb+ca53W6p5pEMF1pb2mtne0Y17g/AmxsnButcmhBb6/U1KnNLeZcWdqUYOO8KZYPl7ishYMJXPpJpXl+NPw5uSkfUORwdmxSe05mUX9RQtd+jjGj4dXwRLebY/WcOIQ4vadfv0FiG+FEzNuJBSSjEhSteyvWE5A1Rp6kFkNS7E3RLz7fyFrrpVgF/0v1XIDbjBDuGQoYz5zT8BpQ2mg/50RnaHqVvj9cXPhL8v2EQXeHzHBGamLGy+1KGKAG+UKfzhEmm43Z5l0Pw3eyZbeO3HMKuJC8kQzfF3yMVieIhKExCzZWPsxc/KbenUSXdRkiFNb6/6aZtbG7d5S4Iq2TDdIKm2gvmQ1LkouSKriYVAi7Spzew4t8byWeITHPIg210FkiwiMrO7GwztxLxHZ0OLk1jqxJ+fvWlT0yEGMaNV5bgVS2DHdt6qDFMxOoqQ7QORk0ToQOysn3C667O5FbBj37fcSBzZivK5v5mZkbIBMABbHPz2RjPSfvOgOK8oZqtnG12w== rmweir@Austins-MBP.tempe.rancherlabs.com
    owner: root
    path: /etc/ssh/ssh_trusted_user_ca_keys2
    permissions: '0644'
-   content: UsePrivilegeSeparation sandbox

        Subsystem sftp internal-sftp

        UseDNS no


        PermitRootLogin no

        AllowUsers core

        AuthenticationMethods publickey

        TrustedUserCAKeys /etc/ssh/ssh_trusted_user_ca_keys
    owner: root
    path: /etc/ssh/sshd_config2

5. On CoresOs, run cloud config: sudo coreos-cloudinit --from-file=config.yml
6. On CoreOS: Created sshd_config with 0644 access:

UsePrivilegeSeparation sandbox
Subsystem sftp internal-sftp
UseDNS no

PermitRootLogin no
AllowUsers core
AuthenticationMethods publickey
TrustedUserCAKeys /etc/ssh/ssh_trusted_user_ca_keys

7. On CoreOS, created file /etc/ssh/ssh_trusted_user_ca_keys with content (output from step 3 on one line) with 0644 access:
   ssh-rsa AAAAB3NzaC1yc2EA...

8. On CoreOs, restart sshd:
   sudo systemctl restart sshd

9. On local, create new keys:
   ssh-keygen -f test-key -q -P ""

10. On local, signed key:
    ssh-keygen -s demo-cert -I TEST -n core -V +2h test-key.pub

11. On local, create cluster.yml with contents:

`
nodes:
  - address: 35.192.208.253
    port: 22
    user: core
    ssh_key_path: ~/.ssh/test-key
    ssh_cert_path: ~/.ssh/test-key-cert.pub
    role: [controlplane,worker,etcd]

ignore_docker_version: true
`

12. On local (in same folder as clutser.yml), use RKE binary made from master latest:
    rke up

13. On local (in same folder as last step):
    kubectl --kubeconfig kube_config_cluster.yml get nodes

Results:
Behaved as expected. Properly SSH'd into VM, and created nodes.

[cjellick]

Validation is good