fix: Upgrade base image to 0.1.5: clean all authorized_keys

.github/scripts/aws-delete-ci-resources.sh

@@ -9,12 +9,20 @@ REGION="eu-west-1"
 instance_ids=$(aws ec2 describe-instances --query 'Reservations[].Instances[].InstanceId' --region "$REGION" --output text)
 # Loop through each instance ID and terminate it
 for instance_id in $instance_ids; do
-  echo "Listing instance: $instance_name ($instance_id)"
   instance_name=$(aws ec2 describe-tags --filters "Name=resource-id,Values=$instance_id" "Name=key,Values=Name" --region "$REGION" --output=text | cut -f5)
+  echo "Listing instance: $instance_name ($instance_id)"
   if [[ $instance_name == *"packer"* ]] || [[ $instance_name == *"gh-ci"* ]]; then
     echo "--> Terminating instance: $instance_name ($instance_id)"
     aws ec2 terminate-instances --instance-ids "$instance_id" --region "$REGION"
   fi
+
+   # Get SSH key name
+  ssh_key_name=$(aws ec2 describe-instances --instance-ids "$instance_id" --query 'Reservations[].Instances[].KeyName' --region "$REGION" --output text)
+  echo "Listing SSH key: $ssh_key_name"
+  if [[ $ssh_key_name == *"packer"* ]]; then
+    echo "--> Terminating instance: $ssh_key_name ($instance_id)"
+    aws ec2 terminate-instances --instance-ids "$instance_id" --region "$REGION"
+  fi
 done
 
 # List all EBS volume IDs and extract their IDs

.github/scripts/azure-new-instance.sh

@@ -28,6 +28,7 @@ if [ "$TECHNO" = "tdx" ]; then
     --ssh-key-values "$SSH_PUB_KEY"
 else
   IMAGE_NAME="/subscriptions/e04f52be-d51f-43fe-95f8-d63a8fc91464/resourceGroups/packer-snp/providers/Microsoft.Compute/galleries/cosmian_packer/images/cosmian-vm-${DISTRIB}-${TECHNO}/versions/0.0.0"
+  IMAGE_NAME="/subscriptions/e04f52be-d51f-43fe-95f8-d63a8fc91464/resourceGroups/packer-snp/providers/Microsoft.Compute/galleries/cosmian_packer/images/base-image-${DISTRIB}-${TECHNO}/versions/0.1.5"
 
   if [ "$DISTRIB" = "ubuntu" ]; then
     # Ubuntu SEV
@@ -53,3 +54,6 @@ else
 fi
 
 az vm open-port -g packer-snp -n "$NAME" --priority 100 --port 5555,443,22
+
+HOST=$(az vm show -d -g packer-snp -n "$NAME" --query publicIps -o tsv)
+echo "$HOST"

.github/workflows/aws_ansible.yml

@@ -114,7 +114,7 @@ jobs:
           for i in {1..1}
           do
             echo "Iteration: $i"
-            ansible-playbook ${{ inputs.product }}-playbook.yml -i ${IP_ADDR}, -u $SSH_USER --private-key="$HOME/packer.pem" -e cosmian_vm_version=$COSMIAN_VM_VERSION -e cosmian_kms_version=${{ inputs.kms-version }} -e cosmian_ai_runner_version=${{ inputs.ai-runner-version }} -e '{ "check_app_test_reboot": false, "check_cosmian_vm_test_reboot": false, "reboot_allowed": false }' --tags playbook-base-image,playbook-${{ inputs.product }},check-${{ inputs.product }}
+            ansible-playbook ${{ inputs.product }}-playbook.yml -i ${IP_ADDR}, -u $SSH_USER --private-key="$HOME/packer.pem" -e cosmian_vm_version=$COSMIAN_VM_VERSION -e cosmian_kms_version=${{ inputs.kms-version }} -e cosmian_ai_runner_version=${{ inputs.ai-runner-version }} -e '{ "check_app_test_reboot": false, "check_cosmian_vm_test_reboot": false, "reboot_allowed": false }' --tags playbook-base-image,playbook-${{ inputs.product }},check-${{ inputs.product }} --skip-tags role-cleanup
           done
 
       - name: Stop and delete AWS instance

.github/workflows/aws_base_image.yml

@@ -54,6 +54,7 @@ jobs:
 
       - name: Packer build image
         env:
+          PACKER_GITHUB_API_TOKEN: ${{ secrets.PACKER_GITHUB_TOKEN }}
           IMAGE_NAME: ${{ steps.env.outputs.IMAGE_NAME }}
         run: |
           set -ex

.github/workflows/aws_base_main.yml

@@ -22,4 +22,4 @@ jobs:
       techno: sev
       distrib: ${{ matrix.distrib }}
       product: ${{ matrix.product }}
-      base-version: 0.1.4
+      base-version: 0.1.5

.github/workflows/aws_image.yml

@@ -64,6 +64,7 @@ jobs:
 
       - name: Packer build image
         env:
+          PACKER_GITHUB_API_TOKEN: ${{ secrets.PACKER_GITHUB_TOKEN }}
           TIMESTAMP: ${{ steps.env.outputs.TIMESTAMP }}
           IMAGE_NAME: ${{ steps.env.outputs.IMAGE_NAME }}
           KMS_VERSION: ${{ inputs.kms-version }}

.github/workflows/aws_main.yml

@@ -17,20 +17,19 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        distrib: [ubuntu]
+        distrib: [ubuntu, rhel]
         product: [cosmian-vm]
     name: (AWS) ${{ matrix.product }} - ${{ matrix.distrib }} - SEV
     needs:
       - clean-resources
     secrets: inherit
-    uses: ./.github/workflows/aws_image.yml
+    uses: ./.github/workflows/aws_ansible.yml
     with:
       techno: sev
       distrib: ${{ matrix.distrib }}
       product: ${{ matrix.product }}
       kms-version: 4.16.0
       ai-runner-version: 0.3.0
-      base-version: 0.1.4
 
   post-clean-resources:
     if: success() || cancelled()

.github/workflows/azure_ansible.yml

@@ -110,7 +110,7 @@ jobs:
           for i in {1..1}
           do
             echo "Iteration: $i"
-            ansible-playbook ${{ inputs.product }}-playbook.yml -i ${IP_ADDR}, -u cosmian -e cosmian_vm_version=$COSMIAN_VM_VERSION -e cosmian_kms_version=${{ inputs.kms-version }} -e cosmian_ai_runner_version=${{ inputs.ai-runner-version }}
+            ansible-playbook ${{ inputs.product }}-playbook.yml -i ${IP_ADDR}, -u cosmian -e cosmian_vm_version=$COSMIAN_VM_VERSION -e cosmian_kms_version=${{ inputs.kms-version }} -e cosmian_ai_runner_version=${{ inputs.ai-runner-version }} --skip-tags role-cleanup
           done
 
       - name: Stop and delete Azure instance

.github/workflows/azure_base_main.yml

@@ -26,6 +26,6 @@ jobs:
       techno: ${{ matrix.techno }}
       distrib: ${{ matrix.distrib }}
       product: ${{ matrix.product }}
-      base-version: 0.1.4
+      base-version: 0.1.5
       kms-version: 0.0.0
       ai-runner-version: 0.0.0

.github/workflows/azure_packer_build.yml

@@ -50,6 +50,7 @@ jobs:
 
       - name: Packer build image
         env:
+          PACKER_GITHUB_API_TOKEN: ${{ secrets.PACKER_GITHUB_TOKEN }}
           CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
           TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
           SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

.github/workflows/gcp_ansible.yml

@@ -146,7 +146,7 @@ jobs:
           for i in {1..1}
           do
             echo "Iteration: $i"
-            ansible-playbook ${{ inputs.product }}-playbook.yml -i ${IP_ADDR}, -u cosmian -e cosmian_vm_version=$COSMIAN_VM_VERSION -e cosmian_kms_version=${{ inputs.kms-version }} -e cosmian_ai_runner_version=${{ inputs.ai-runner-version }}
+            ansible-playbook ${{ inputs.product }}-playbook.yml -i ${IP_ADDR}, -u cosmian -e cosmian_vm_version=$COSMIAN_VM_VERSION -e cosmian_kms_version=${{ inputs.kms-version }} -e cosmian_ai_runner_version=${{ inputs.ai-runner-version }} --skip-tags role-cleanup
           done
 
       - name: Stop and delete GCP instance

.github/workflows/gcp_base_image.yml

@@ -56,6 +56,7 @@ jobs:
 
       - name: Packer build image
         env:
+          PACKER_GITHUB_API_TOKEN: ${{ secrets.PACKER_GITHUB_TOKEN }}
           IMAGE_NAME: ${{ steps.env.outputs.IMAGE_NAME }}
           TECHNO: ${{ inputs.techno }}
         run: |

.github/workflows/gcp_base_main.yml

@@ -26,4 +26,4 @@ jobs:
       techno: ${{ matrix.techno }}
       distrib: ${{ matrix.distrib }}
       product: ${{ matrix.product }}
-      base-version: 0.1.4
+      base-version: 0.1.5

.github/workflows/gcp_image.yml

@@ -79,6 +79,7 @@ jobs:
 
       - name: Packer build image
         env:
+          PACKER_GITHUB_API_TOKEN: ${{ secrets.PACKER_GITHUB_TOKEN }}
           TIMESTAMP: ${{ steps.env.outputs.TIMESTAMP }}
           IMAGE_NAME: ${{ steps.env.outputs.IMAGE_NAME }}
           KMS_VERSION: ${{ inputs.kms-version }}

.github/workflows/nightly_aws_main.yml

@@ -35,7 +35,7 @@ jobs:
       product: ${{ matrix.product }}
       kms-version: 4.16.0
       ai-runner-version: 0.3.0
-      base-version: 0.1.4
+      base-version: 0.1.5
 
   # Too many failures when rebooting EC2
   # ansible:

.github/workflows/nightly_azure_main.yml

@@ -18,14 +18,16 @@ jobs:
       fail-fast: false
       max-parallel: 3
       matrix:
-        distrib: [ubuntu, rhel]
+        distrib: [rhel, ubuntu]
         product: [cosmian-vm, kms, ai-runner]
         techno: [sev, tdx]
         exclude:
           - product: ai-runner
             distrib: rhel
           - techno: tdx
             distrib: rhel
+          - product: ai-runner
+            techno: sev
     name: (AZURE) ${{ matrix.product }} - ${{ matrix.distrib }} - ${{ matrix.techno }}
     needs:
       - clean-resources
@@ -37,22 +39,24 @@ jobs:
       product: ${{ matrix.product }}
       kms-version: 4.16.0
       ai-runner-version: 0.3.0
-      base-version: 0.1.4
+      base-version: 0.1.5
 
   ansible:
     if: startsWith(github.ref, 'refs/tags/') != true
     strategy:
       fail-fast: false
       max-parallel: 3
       matrix:
-        distrib: [ubuntu, rhel]
+        distrib: [rhel, ubuntu]
         product: [cosmian-vm, kms, ai-runner]
         techno: [sev, tdx]
         exclude:
           - product: ai-runner
             distrib: rhel
           - techno: tdx
             distrib: rhel
+          - product: ai-runner
+            techno: sev
     name: (AZURE) ${{ matrix.product }} - ${{ matrix.distrib }} - ${{ matrix.techno }}
     needs:
       - clean-resources

.github/workflows/nightly_clean.yml

@@ -0,0 +1,21 @@
+---
+name: Nightly clean cloud providers resources
+
+on:
+  schedule:
+    # every day at 0 AM
+    - cron: 00 0 * * *
+  workflow_dispatch:
+
+jobs:
+  azure:
+    uses: ./.github/workflows/azure_clean.yml
+    secrets: inherit
+
+  gcp:
+    uses: ./.github/workflows/gcp_clean.yml
+    secrets: inherit
+
+  aws:
+    uses: ./.github/workflows/aws_clean.yml
+    secrets: inherit

.github/workflows/nightly_gcp_main.yml

@@ -18,14 +18,16 @@ jobs:
       fail-fast: false
       max-parallel: 3
       matrix:
-        distrib: [ubuntu, rhel]
+        distrib: [rhel, ubuntu]
         product: [cosmian-vm, kms, ai-runner]
         techno: [sev, tdx]
         exclude:
           - product: ai-runner
             distrib: rhel
           - techno: tdx
             distrib: rhel
+          - product: ai-runner
+            techno: sev
         include:
           - techno: sev
             machine-type: n2d-standard-2
@@ -55,22 +57,24 @@ jobs:
       product: ${{ matrix.product }}
       kms-version: 4.16.0
       ai-runner-version: 0.3.0
-      base-version: 0.1.4
+      base-version: 0.1.5
 
   ansible:
     if: startsWith(github.ref, 'refs/tags/') != true
     strategy:
       fail-fast: false
       max-parallel: 3
       matrix:
-        distrib: [ubuntu, rhel]
+        distrib: [rhel, ubuntu]
         product: [cosmian-vm, kms, ai-runner]
         techno: [sev, tdx]
         exclude:
           - product: ai-runner
             distrib: rhel
           - techno: tdx
             distrib: rhel
+          - product: ai-runner
+            techno: sev
         include:
           - techno: sev
             machine-type: n2d-standard-2

.github/workflows/nightly_marketplaces.yml

@@ -8,7 +8,7 @@ on:
       - '**'
   # schedule:
   #   # every day at 0 AM
-  #   - cron: 00 0 * * *
+  #   - cron: 00 1 * * *
   workflow_dispatch:
 
 jobs:

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.2.3] - 2024-06-15
+
+### Bug Fixes
+
+- Upgrade base image to 0.1.5: clean all authorized_keys and users ([#140](https://github.com/Cosmian/cosmian_vm/pull/140))
+
 ## [1.2.2] - 2024-06-13
 
 ### Bug Fixes

Cargo.toml

@@ -9,7 +9,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "1.2.2"
+version = "1.2.3"
 edition = "2021"
 license = "BUSL-1.1"
 license-file = "LICENSE"

README.md

@@ -46,13 +46,13 @@ Our client CLI [cosmian_vm](https://github.com/Cosmian/cosmian_vm/tree/main/crat
 - [Snapshot of the system](#snapshot-of-the-system)
 - [Verification of the remote instance](#verification-of-the-remote-instance)
 - [Cloud providers support](#cloud-providers-support)
-  - [Marketplace Image content](#marketplace-image-content)
-  - [Configuration file](#configuration-file)
-  - [First Cosmian VM launch](#first-cosmian-vm-launch)
-  - [Handle Cosmian VM status](#handle-cosmian-vm-status)
-  - [Usage](#usage)
-  - [Provide secrets without SSH access](#provide-secrets-without-ssh-access)
-- [Other Cosmian Products base on Cosmian VM](#other-cosmian-products-base-on-cosmian-vm)
+  * [Marketplace Image content](#marketplace-image-content)
+  * [Configuration file](#configuration-file)
+  * [First Cosmian VM launch](#first-cosmian-vm-launch)
+  * [Handle Cosmian VM status](#handle-cosmian-vm-status)
+  * [Usage](#usage)
+  * [Provide secrets without SSH access](#provide-secrets-without-ssh-access)
+- [Other Cosmian Products based on Cosmian VM](#other-cosmian-products-based-on-cosmian-vm)
 
 <!-- tocstop -->
 
@@ -279,11 +279,12 @@ The `restart` subcommand can restart the application identified in `service_name
 cosmian_vm --url https://my_app.dev app restart
 ```
 
-## Other Cosmian Products base on Cosmian VM
+## Other Cosmian Products based on Cosmian VM
 
-| Cosmian VM | Cosmian KMS | Cosmian AI Runner |
-| ---------- | ----------- | ----------------- |
-| 1.2.2      | 4.16.0      | 0.3.0             |
-| 1.2.1      | 4.16.0      | 0.3.0             |
-| 1.2.0      | 4.16.0      | -                 |
-| 1.1.2      | 4.15.0      | -                 |
+| Base image | Cosmian VM | Cosmian KMS | Cosmian AI Runner |
+| ---------- | ---------- | ----------- | ----------------- |
+| 0.1.5      | 1.2.3      | 4.16.0      | 0.3.0             |
+| 0.1.4      | 1.2.2      | 4.16.0      | 0.3.0             |
+| 0.1.3      | 1.2.1      | 4.16.0      | 0.3.0             |
+|            | 1.2.0      | 4.16.0      | -                 |
+|            | 1.1.2      | 4.15.0      | -                 |