Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Optional SSH known host keys configurable per project #318

Closed
mumoshu opened this issue Feb 15, 2018 · 4 comments
Closed

Optional SSH known host keys configurable per project #318

mumoshu opened this issue Feb 15, 2018 · 4 comments
Labels
enhancement New feature or request

Comments

@mumoshu
Copy link
Contributor

mumoshu commented Feb 15, 2018

I like the automatic and out-of-box support for SSH host key verification of GitHub and Bitbucket attempted in #86.

However, that isn't a generic solution as:

  • It doesn't support other git hosts like e.g. GitHub Enterprise
  • It is vulnerable to future changes in the host keys

Instead, how about making it configurable via project's values.yaml like the below?

# OPTIONAL: Set to whatever content you like to have for .ssh/known_hosts on worker nodes
# The below example was generated by running `ssh-keyscan -H github.com`
# When omitted, ssh host key verification is disabled(this is the previous behavior)
sshKnownHosts: |
  # github.com:22 SSH-2.0-libssh_0.7.0
  # github.com:22 SSH-2.0-libssh_0.7.0
  |1|a62YvGNxzDMqnXWOroqxhzaSflk=|yqCMdMiP53NP+vwrOATvJMvipTw= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
  # github.com:22 SSH-2.0-libssh_0.7.0
@mumoshu
Copy link
Contributor Author

mumoshu commented Feb 15, 2018

Alternatively, we could go further with a much richer configuration API.
An example would be something like below, which we can see in an another CI system.

sshKnownHosts:
- hostname: github.com
   fingerprint: nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8
   type: rsa

I don't find any concrete use-case for such a rich API myself though.

@technosophos
Copy link
Contributor

Yeah, I like the idea of making it possible to specify the key data like that.

@technosophos technosophos added the enhancement New feature or request label Feb 15, 2018
@technosophos
Copy link
Contributor

Somewhat related to #407

@krancour
Copy link
Contributor

Closing due to staleness. Please do re-open if appropriate.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants