search

shieldproject / shield-boshrelease

BOSH Release for shield
MIT License
11 stars 17 forks source link

Switch to type: ssh for shield-agent-key variable #109

Closed rkoster closed 6 years ago

rkoster commented 6 years ago

https://github.com/starkandwayne/shield-boshrelease/blob/master/manifests/shield.yml#L43-L44

by switching from rsa to ssh we can get the proper format for the public_key this would allow us to no longer supply private keys to the agent (currently the public_key is calculated during startup).

bosh int <(bosh int <(echo -e "foo: ((foo))\nvariables:\n- name: foo\n  type: ssh") --vars-store=/dev/null) --path /foo/public_key
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDG+KD6nt10/hK+byUtJyX0HPbLbXtsf0CjrWSCP+HIm/aCvFzpOyefYoivg1TIpVcAyHUx5bfVavlaVUCYaQOMIH6gmG9oModKly4wOEe572ewE0GbJyCT6L+aSo1nOI6+1jNnKchsT/WLNqwA0s+6NrJXwOyqKmz+JMCWodjKzh3eLbM6xK8KH9q3ouzfjsBqpO1fCbkE3Lptoz7iiPfjA8T//VrdMZ/gH58TerQEDD2E7aksXWFkL96IQMRIy/KHcWDFbypZufmifPtHzbu6DAMa/8hZeDOg1jRNPHqLu4r+F6saSK7cMWG9xqkTp+1ZktKg3lQiymWn7TApgzv9
jhunt commented 6 years ago

This only helps people who are using credhub, no?

rkoster commented 6 years ago

the above example only uses the bosh cli with --vars-store. So no credhub used. Would this conflict with genesis?

jhunt commented 6 years ago

Oh, now I see. You want to change the property to store the public key, not the private key?

The only concern I have is that that requires people not using BOSH variables (yes, they do exist, no they don't all want to upgrade) to run the ssh-keygen -yf themselves.

As long as we document that, I don't see a problem; we should probably change the name of the property and just deprecate use of the agent.key with a raised warning or something.

jhunt commented 6 years ago

I'll try to take a look at implementing this later today or tomorrow.