Ansible playbook to configure sshd for Conch CA certs. #454
Conversation
| @@ -0,0 +1,27 @@ | |||
| # An ansible playbook to configure the SSHD configuration to enable CA cert auth for SSH. | |||
| # Remember to export CI_CLOUD if it isn't part of your environment's variables. | |||
There was a problem hiding this comment.
Why is this needed? How are you running this playbook?
There was a problem hiding this comment.
Yeah we need to talk about where this is included in site.yml, there's a bigger job/discussion here than just adding a playbook I think.
| tasks: | ||
| - name: Copy ssh public key | ||
| ansible.builtin.copy: | ||
| src: /var/lib/rocky/conch/ssh_signing_key.pub |
There was a problem hiding this comment.
How's this getting configured? You just created this by hand right?
| # NOTE: Change the src for the `ssh_signing_key.pub` to be your corresponding directory. | ||
|
|
||
| - hosts: login | ||
| gather_facts: true |
There was a problem hiding this comment.
Doesn't look like you need facts, so I'd turn it off or at least leave it out (which will default to on, but at least you're not documenting that you need something you don't).
| @@ -0,0 +1,27 @@ | |||
| # An ansible playbook to configure the SSHD configuration to enable CA cert auth for SSH. | |||
| # Remember to export CI_CLOUD if it isn't part of your environment's variables. | |||
There was a problem hiding this comment.
CI_CLOUD is only required if you're using app creds. Playbooks aren't the place to document the wriggles of authing to openstack TBH.
| remote_src: true | ||
|
|
||
| - name: Ensure CA Certs are accepted | ||
| ansible.builtin.lineinfile: |
There was a problem hiding this comment.
Does this need a regexp: line to make it idempotent? E.g. if its already there, but commented out?
| - name: Restart SSH service | ||
| ansible.builtin.systemd: | ||
| name: sshd | ||
| state: restarted |
There was a problem hiding this comment.
Depending on how this should actually be integrated, this might need gating somehow
|
|
||
| # NOTE: Change the src for the `ssh_signing_key.pub` to be your corresponding directory. | ||
|
|
||
| - hosts: login |
There was a problem hiding this comment.
Normally we'd have a group for the feature, but I'm not clear on which feature this actually belongs to. I suggested login to @MaxBed4d understanding this was a one-off play running against an already-deployed cluster. But that wouldn't be a PR ...
|
As discussed elsewhere, let's just merge this as-is for now since it's targeting the Waldur proof of concept branch. We can worry about polishing things later if needed. |
No description provided.