Skip to content

feat: use SSH host certificates #3786

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 47 commits into from
Jul 1, 2025
Merged

feat: use SSH host certificates #3786

merged 47 commits into from
Jul 1, 2025

Conversation

miampf
Copy link
Contributor

@miampf miampf commented Apr 28, 2025 •
edited
Loading

Context

Currently, if you use the emergency SSH access, you have to manually validate each nodes host key (TOFU). This PR fixes that by introducing host certificates.

Proposed change(s)

  • Each node gets a host certificate that is used to verify it's authenticity

Additional info

  • For some reason, wildcards as a principal do not work which means that if you try to connect using the load balancers host name, verification would fail. However, connecting with the LBs public IP is not a problem so this is recommended in the documentation.

Checklist

  • Run the E2E tests that are relevant to this PR's changes
  • Update docs
  • Add labels (e.g., for changelog category)
  • Is PR title adequate for changelog?
  • Link to Milestone

@miampf miampf added the no changelog Change won't be listed in release changelog label Apr 28, 2025
@miampf miampf added this to the v2.23.0 milestone Apr 28, 2025
@netlify Netlify
Copy link

netlify bot commented Apr 28, 2025 •
edited
Loading

✅ Deploy Preview for constellation-docs ready!

Name Link
🔨 Latest commit 8b17992
🔍 Latest deploy log https://app.netlify.com/projects/constellation-docs/deploys/6863b0b76e2b950008ea084e
😎 Deploy Preview https://deploy-preview-3786--constellation-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@miampf miampf force-pushed the miampf/feat/sign-host-key branch 5 times, most recently from 4a02c6b to b566934 Compare May 2, 2025 13:17
@miampf miampf marked this pull request as ready for review May 2, 2025 14:04
msanft
msanft reviewed May 5, 2025
View reviewed changes
Copy link
Contributor

@msanft msanft left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mostly LGTM!

@miampf miampf force-pushed the miampf/feat/sign-host-key branch from b566934 to aaf5e88 Compare May 7, 2025 09:19
@miampf miampf requested a review from msanft May 7, 2025 11:15
burgerdev
burgerdev reviewed May 7, 2025
View reviewed changes
@daniel-weisse
Copy link
Member

Do these certificates work across node reboots?

@miampf miampf force-pushed the miampf/feat/sign-host-key branch from 3dfbfce to 679f67b Compare May 9, 2025 09:11
@miampf
Copy link
Contributor Author

miampf commented May 9, 2025

Do these certificates work across node reboots?

As long as the master key doesn't change they should, but I'll test this just to be sure

@miampf miampf force-pushed the miampf/feat/sign-host-key branch 3 times, most recently from 5b73d2a to 1950103 Compare May 16, 2025 09:19
@miampf miampf removed the request for review from 3u13r May 16, 2025 09:33
daniel-weisse
daniel-weisse reviewed May 16, 2025
View reviewed changes
Copy link
Member

@daniel-weisse daniel-weisse left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good to me if tests pass

@miampf miampf requested a review from burgerdev May 16, 2025 12:53
@miampf miampf force-pushed the miampf/feat/sign-host-key branch from c2df904 to 58066e5 Compare May 21, 2025 10:22
@miampf
Copy link
Contributor Author

miampf commented May 21, 2025

Successful emergency ssh e2e test run

miampf added 25 commits July 1, 2025 11:55
@miampf
ci: resolve ip of lb
cf0cf8b
@miampf
fix: overwrite host key on join
00e220d
@miampf
joinclient: extend unit test
fa79989
@miampf
Revert "fix: overwrite host key on join"
a1c252c 
This reverts commit 9c69f954a5efb00e8c95835d98a4c2e6b87c984c.
@miampf
joinclient: error if stat fails
10847b7
@miampf
joinclient: error if host key path is directory instead of file
702b588
@miampf
joinclient: simplify unit test
c82c1ea
@miampf
joinclient: introduce error testcase for not matching cert
101aa11
@miampf
chore: gazelle generate
19a11a0
@miampf
chore: please bazel check
81b55ef
@miampf
chore: generate keys in service [skip ci]
8e21bfe
@miampf
refactor: only read newly generated file
29a7661
@miampf
fix: correct paths and service files [skip ci]
e4dd12e
@miampf
fix: correct argument passing [skip ci]
3fa0ad1
@miampf
WIP: overwrite script
c0ac37e
@miampf
fix: requires instead of wants in bootstrapper [skip ci]
a30e684
@miampf
fix: run after keygen [skip ci]
f55e681
@miampf
fix: correct after? [skip ci]
1085534
@miampf
fix: explicit before [skip ci]
64fd1df
@miampf
fix: reference sshd-keygen.target instead of service [skip ci]
5a18f55
@miampf
chore: set -x in keygen script [skip ci]
5e2707d
@miampf
fix: create state dir before keygen
dee9566
@miampf
fix: unit test joinclient
3825fb7
@miampf
chore: tidy
6dd2c6f
@miampf
fix: please shellcheck
8b17992
@miampf miampf force-pushed the miampf/feat/sign-host-key branch from 4e3f6d4 to 8b17992 Compare July 1, 2025 09:56
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Jul 1, 2025

Coverage report

Package Old New Trend
bootstrapper/internal/addresses 0.00% 80.00% 🆕
bootstrapper/internal/initserver 67.90% 76.10% ↗️
bootstrapper/internal/joinclient 86.50% 82.50% ↘️
cli/internal/cmd 57.80% 57.80% ↔️
internal/constants 0.00% 0.00% 🚧
internal/crypto 73.30% 64.70% ↘️
joinservice/cmd 0.00% 0.00% 🚧
joinservice/internal/server 78.20% 79.20% ↗️
joinservice/joinproto 0.00% 0.00% 🚧

@miampf miampf merged commit 7ea5c41 into main Jul 1, 2025
11 checks passed
@miampf miampf deleted the miampf/feat/sign-host-key branch July 1, 2025 10:47
@burgerdev burgerdev mentioned this pull request Jul 31, 2025
Merged
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@burgerdev burgerdev burgerdev approved these changes

@msanft msanft msanft approved these changes

@daniel-weisse daniel-weisse daniel-weisse approved these changes

Assignees
No one assigned
Labels
no changelog Change won't be listed in release changelog
Projects
None yet
Milestone
v2.23.0
Development

Successfully merging this pull request may close these issues.
4 participants
@miampf @daniel-weisse @burgerdev @msanft