provider/lxd: add interactive auth-type #6941

Merged
merged 1 commit into from Feb 9, 2017

Conversation

Projects
None yet
3 participants
Member

axw commented Feb 8, 2017

Description of change

Add the "interactive" auth-type for LXD, which is
used in add-credential for interactively adding a
credential for a LXD cloud. Currently we only
support generating credentials for local LXD;
later we will extend this to support generating
credentials for remote, untrusted LXD by prompting
the user to verify the certificate fingerprint and
enter a trust password.

QA steps

  1. juju add-credential localhost
Enter credential name: foo
Auth Types
interactive*
certificate

Select auth-type: 
Loaded client cert/key from "/home/andrew/.config/lxc"
Credentials added for cloud localhost.
  1. juju bootstrap localhost
  2. juju add-user bob
  3. juju grant bob add-model
  4. lxc launch ubuntu-xenial x
  5. lxc file push `which juju` x/tmp/juju
  6. lxc exec x /tmp/juju register ...
  7. lxc exec x /tmp/juju add-model foo
ERROR cannot auto-generate credential for remote LXD

Until support is added for verifying and authenticating to remote LXD hosts,
you must generate the credential by hand, adding the certificate to LXD using
the "lxc config trust" command.
  1. juju credentials --format=yaml localhost > /tmp/localhost-credentials.yaml
  2. lxc file push /tmp/localhost-credentials.yaml x/root/.local/share/juju/credentials.yaml
  3. lxc exec x /tmp/juju add-model foo
Uploading credential 'localhost/bob/foo' to controller
Added 'foo' model on localhost/localhost with credential 'foo' for user 'bob'

Documentation changes

There is a change in workflow, but probably unusual enough that it doesn't need documenting?

Bug reference

Does not fix any bugs, but hopefully alleviates some of the pain caused by https://bugs.launchpad.net/juju/+bug/1662587.

provider/lxd/credentials.go
+
+Until support is added for verifying and authenticating to remote LXD hosts,
+you must generate the credential by hand, adding the certificate to LXD using
+the "lxc config trust" command.
@wallyworld

wallyworld Feb 8, 2017

Owner

Can we point the user to online doc here, just like we do in other cases, eg how to properly configure lxd kernel params.
The text tells to user something needs to be done but doesn't show them how etc. Online we can walk them through the steps. When to run autoload-credential? When to choose interactive vs certificate etc. Describe the main usage scenarios.

@axw

axw Feb 9, 2017

Member

I've added a pointer to the LXD page on jujucharms.com.

Member

axw commented Feb 9, 2017

Additional QA step:

  1. juju autoload-credentials, select LXD/localhost
  2. Confirm there's a "server-cert" attribute in the credential, and that bootstrap succeeds.
  3. sudo service lxd stop
  4. juju autoload-credentials, observe that there's no LXD/localhost option
Member

axw commented Feb 9, 2017

$$merge$$

Contributor

jujubot commented Feb 9, 2017

Status: merge request accepted. Url: http://juju-ci.vapour.ws:8080/job/github-merge-juju

Member

axw commented Feb 9, 2017

$$merge$$

Contributor

jujubot commented Feb 9, 2017

Build failed: Generating tarball failed
build url: http://juju-ci.vapour.ws:8080/job/github-merge-juju/10251

Member

axw commented Feb 9, 2017

$$merge$$

Contributor

jujubot commented Feb 9, 2017

Status: merge request accepted. Url: http://juju-ci.vapour.ws:8080/job/github-merge-juju

Contributor

jujubot commented Feb 9, 2017

Build failed: Tests failed
build url: http://juju-ci.vapour.ws:8080/job/github-merge-juju/10252

provider/lxd: add interactive auth-type
Add the "interactive" auth-type for LXD, which is
used in add-credential for interactively adding a
credential for a LXD cloud. Currently we only
support generating credentials for local LXD;
later we will extend this to support generating
credentials for remote, untrusted LXD by prompting
the user to verify the certificate fingerprint and
enter a trust password.
Member

axw commented Feb 9, 2017

$$merge$$

Contributor

jujubot commented Feb 9, 2017

Status: merge request accepted. Url: http://juju-ci.vapour.ws:8080/job/github-merge-juju

@jujubot jujubot merged commit 16a134d into juju:2.1 Feb 9, 2017

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment