Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Override the default ssh askpass flow on project clone step #1291

Merged
merged 2 commits into from
Aug 5, 2024
Merged

Override the default ssh askpass flow on project clone step #1291

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a2cd37e
Override the default ssh askpass flow on project clone step
vinokurig Jul 30, 2024
7aac7ce
fixup! Override the default ssh askpass flow on project clone step
vinokurig Aug 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions docs/additional-configuration.adoc
View file
Open in desktop
AObuchow marked this conversation as resolved.
Show resolved Hide resolved
Original file line number Diff line number Diff line change
Expand Up @@ -185,10 +185,11 @@ Git SSH keys can be configured for DevWorkspaces by mounting secrets to workspac

Prerequisites:

* An SSH keypair with _no passphrase_, with the public key uploaded to the Git provider that stores your repository.
* An SSH keypair, with the public key uploaded to the Git provider, that stores your repository.
** The steps below assume the following environment variables are set:
*** `$SSH_KEY`: path on disk to private key for SSH keypair (e.g. `~/.ssh/id_ed25519`)
*** `$SSH_PUB_KEY`: path on disk to public key for SSH keypair (e.g. `~/.ssh/id_ed25519.pub`)
*** `$PASSPHRASE`: SSH keypair passphrase (optional)
*** `$NAMESPACE`: namespace where workspaces using the SSH keypair will be started.

Process:
Expand All @@ -211,7 +212,8 @@ EOF
kubectl create secret -n "$NAMESPACE" generic git-ssh-key \
--from-file=dwo_ssh_key="$SSH_KEY" \
--from-file=dwo_ssh_key.pub="$SSH_PUB_KEY" \
--from-file=ssh_config=/tmp/ssh_config
--from-file=ssh_config=/tmp/ssh_config \
--from-literal=passphrase="$PASSPHRASE"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to verify that adding the --from-literal=passphrase="$PASSPHRASE" will not break things if the user does not provide a passphrase. Perhaps we should add an alternate instruction for users that are providing a passphrase?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have tried the command without the PASSPHRASE env variable and it worked ok, but the passphrase key of the secret data has no value:

data:
  dwo_ssh_key: ***
  dwo_ssh_key.pub: ***
  passphrase: ''
  ssh_config: ***

Such empty keys will not be mounted to the container file system as files and if the ssh-askpass.sh is executed it will throw an error about missing passphrase file.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for checking. Just to confirm: if the user's SSH key does not have a passphrase, will ssh-askpass.sh be invoked? I imagine it won't, based on it's documentation:

If ssh-add **needs** a passphrase, it will read the passphrase from the current terminal if it was run from a terminal...

The concern is just making sure that users are able to copy & paste the instructions and have them work, even if their SSH key does not have a passphrase (though their secret will have an empty passphrase data field).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if the user's SSH key does not have a passphrase, will ssh-askpass.sh be invoked?

I have tried the flow with SSH key with an empty passphrase, and neither the default askpass scriptn nore the provided ssh-askpass.sh script was not invoked.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perfect!

----

3. Annotate the secret to configure automatic mounting to DevWorkspaces
Expand Down
6 changes: 5 additions & 1 deletion project-clone/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,10 +44,14 @@ COPY --from=builder /project-clone/_output/bin/project-clone /usr/local/bin/proj

ENV USER_UID=1001 \
USER_NAME=project-clone \
HOME=/home/user
HOME=/home/user \
DISPLAY=":0" \
SSH_ASKPASS=/usr/local/bin/ssh-askpass.sh

COPY build/bin /usr/local/bin
COPY project-clone/ssh-askpass.sh /usr/local/bin
RUN /usr/local/bin/user_setup
RUN chmod +x /usr/local/bin/ssh-askpass.sh

USER ${USER_UID}

Expand Down
7 changes: 7 additions & 0 deletions project-clone/ssh-askpass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
#!/bin/sh
PASSPHRASE_FILE_PATH="/etc/ssh/passphrase"
if [ ! -f $PASSPHRASE_FILE_PATH ]; then
echo "Error: passphrase file is missing in the '/etc/ssh/' directory" 1>&2
exit 1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@vinokurig could you elaborate a bit? why do we exit 1 if the optional passphrase is missing?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Passphrase is optional because we do not need to specify passphrase if the ssh key is generated with an empty passphrase, but if the ssh key is generated WITH a passphrase we do not consider the passphrase as optional.

fi
cat $PASSPHRASE_FILE_PATH
Loading