Preload popular ssh public keys at build time

Dockerfile

@@ -3,6 +3,21 @@ ARG FROM_IMAGE_TAG=20.04
 
 FROM "${FROM_IMAGE}":"${FROM_IMAGE_TAG}" AS minimal
 
+ARG EASY_INFRA_VERSION
+ENV EASY_INFRA_VERSION="${EASY_INFRA_VERSION}"
+ARG VERSION="${EASY_INFRA_VERSION}"
+ARG COMMIT_HASH
+
+LABEL org.opencontainers.image.authors="Jon Zeolla"
+LABEL org.opencontainers.image.licenses="BSD-3-Clause"
+LABEL org.opencontainers.image.vendor="Seiso"
+LABEL org.opencontainers.image.version="${VERSION}"
+LABEL org.opencontainers.image.title="easy_infra"
+LABEL org.opencontainers.image.description="This is a docker container that simplifies and secures Infrastructure as Code deployments"
+LABEL org.opencontainers.image.url="https://seisollc.com"
+LABEL org.opencontainers.image.source="https://github.com/SeisoLLC/easy_infra"
+LABEL org.opencontainers.image.revision="${COMMIT_HASH}"
+
 # minimal setup
 ARG BUILDARCH
 ARG KICS_ARCH
@@ -55,6 +70,19 @@ RUN groupadd --gid 53150 -r easy_infra \
                                                tini \
                                                unzip \
  && apt-get -y upgrade \
+ && su - easy_infra -c "mkdir -p /home/easy_infra/.ssh" \
+ && su - easy_infra -c "touch /home/easy_infra/.ssh/known_hosts" \
+ && echo "# START preloaded known_hosts" >> /home/easy_infra/.ssh/known_hosts \
+ && ssh-keyscan gitlab.com \
+                github.com \
+                bitbucket.org \
+                ssh.dev.azure.com \
+                git-codecommit.us-east-1.amazonaws.com \
+                git-codecommit.us-east-2.amazonaws.com \
+                git-codecommit.us-west-1.amazonaws.com \
+                git-codecommit.us-west-2.amazonaws.com \
+    >> /home/easy_infra/.ssh/known_hosts \
+ && echo "# END preloaded known_hosts" >> /home/easy_infra/.ssh/known_hosts \
  && if [ "${TRACE}" = "true" ]; then \
     apt-get -y install --no-install-recommends libcap2-bin \
                                                strace \
@@ -121,19 +149,6 @@ ENV BASH_ENV=/functions
 WORKDIR /iac
 ENTRYPOINT ["tini", "-g", "--", "/usr/local/bin/docker-entrypoint.sh"]
 
-ARG VERSION
-ARG COMMIT_HASH
-
-LABEL org.opencontainers.image.authors="Jon Zeolla"
-LABEL org.opencontainers.image.licenses="BSD-3-Clause"
-LABEL org.opencontainers.image.vendor="Seiso"
-LABEL org.opencontainers.image.version="${VERSION}"
-LABEL org.opencontainers.image.title="easy_infra"
-LABEL org.opencontainers.image.description="This is a docker container that simplifies and secures Infrastructure as Code deployments"
-LABEL org.opencontainers.image.url="https://seisollc.com"
-LABEL org.opencontainers.image.source="https://github.com/SeisoLLC/easy_infra"
-LABEL org.opencontainers.image.revision="${COMMIT_HASH}"
-
 
 FROM minimal AS az
 USER root

easy_infra/constants.py

@@ -63,18 +63,18 @@
     ):
         if VARIANT == "final":
             CONTEXT[VARIANT]["buildargs"] = {
-                "VERSION": __version__,
+                "EASY_INFRA_VERSION": __version__,
             }
         else:
             CONTEXT[VARIANT]["buildargs"] = {
-                "VERSION": f"{__version__}-{VARIANT}",
+                "EASY_INFRA_VERSION": f"{__version__}-{VARIANT}",
             }
     else:
         if VARIANT == "final":
             CONTEXT[VARIANT]["buildargs"] = {
-                "VERSION": f"{__version__}-{COMMIT_HASH_SHORT}",
+                "EASY_INFRA_VERSION": f"{__version__}-{COMMIT_HASH_SHORT}",
             }
         else:
             CONTEXT[VARIANT]["buildargs"] = {
-                "VERSION": f"{__version__}-{VARIANT}-{COMMIT_HASH_SHORT}",
+                "EASY_INFRA_VERSION": f"{__version__}-{VARIANT}-{COMMIT_HASH_SHORT}",
             }

functions.j2

@@ -3,9 +3,6 @@
 # DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN #
 #####################################################################
 
-# Globals
-EASY_INFRA_VERSION="2022.10.08"
-
 # All private functions (start with _) come from here
 source /usr/local/bin/common.sh
 

setup.cfg

@@ -17,5 +17,3 @@ url = "https://github.com/SeisoLLC/easy_infra"
 [bumpversion:file:setup.cfg]
 
 [bumpversion:file:docs/conf.py]
-
-[bumpversion:file:functions.j2]

tasks.py

@@ -239,7 +239,7 @@ def build(_c, stage="all", trace=False, debug=False):
         CLIENT.images.pull(image_and_latest_tag)
 
         buildargs.update(constants.CONTEXT[variant]["buildargs"])
-        versioned_tag = constants.CONTEXT[variant]["buildargs"]["VERSION"]
+        versioned_tag = constants.CONTEXT[variant]["buildargs"]["EASY_INFRA_VERSION"]
         image_and_versioned_tag = f"{constants.IMAGE}:{versioned_tag}"
 
         LOG.info(f"Building {image_and_versioned_tag} (platform {PLATFORM})...")
@@ -274,7 +274,7 @@ def sbom(_c, stage="all", debug=False):
     variants = process_stages(stage=stage)
 
     for variant in variants:
-        latest_tag = constants.CONTEXT[variant]["buildargs"]["VERSION"]
+        latest_tag = constants.CONTEXT[variant]["buildargs"]["EASY_INFRA_VERSION"]
         image_and_tag = f"{constants.IMAGE}:{latest_tag}"
 
         try:
@@ -331,7 +331,7 @@ def test(_c, stage="all", debug=False):
 
     for variant in variants:
         # Only test using the current, versioned tag of each variant
-        versioned_tag = constants.CONTEXT[variant]["buildargs"]["VERSION"]
+        versioned_tag = constants.CONTEXT[variant]["buildargs"]["EASY_INFRA_VERSION"]
         image_and_tag = f"{constants.IMAGE}:{versioned_tag}"
 
         LOG.info(f"Testing {image_and_tag} for platform {PLATFORM}...")
@@ -431,7 +431,7 @@ def publish(_c, tag, stage="all", debug=False):
 
     for variant in variants:
         # Always push the versioned tag (should already have a unique ID when appropriate)
-        versioned_tag = constants.CONTEXT[variant]["buildargs"]["VERSION"]
+        versioned_tag = constants.CONTEXT[variant]["buildargs"]["EASY_INFRA_VERSION"]
         image_and_tags = [f"{constants.IMAGE}:{versioned_tag}"]
 
         # Add the latest tag for merges into main