Cosmian · Manuthor · Jun 17, 2024 · Jun 14, 2024 · Jun 15, 2024 · Jun 15, 2024
diff --git a/.github/scripts/aws-delete-ci-resources.sh b/.github/scripts/aws-delete-ci-resources.sh
@@ -9,12 +9,20 @@ REGION="eu-west-1"
 instance_ids=$(aws ec2 describe-instances --query 'Reservations[].Instances[].InstanceId' --region "$REGION" --output text)
 # Loop through each instance ID and terminate it
 for instance_id in $instance_ids; do
-  echo "Listing instance: $instance_name ($instance_id)"
   instance_name=$(aws ec2 describe-tags --filters "Name=resource-id,Values=$instance_id" "Name=key,Values=Name" --region "$REGION" --output=text | cut -f5)
+  echo "Listing instance: $instance_name ($instance_id)"
   if [[ $instance_name == *"packer"* ]] || [[ $instance_name == *"gh-ci"* ]]; then
     echo "--> Terminating instance: $instance_name ($instance_id)"
     aws ec2 terminate-instances --instance-ids "$instance_id" --region "$REGION"
   fi
+
+   # Get SSH key name
+  ssh_key_name=$(aws ec2 describe-instances --instance-ids "$instance_id" --query 'Reservations[].Instances[].KeyName' --region "$REGION" --output text)
+  echo "Listing SSH key: $ssh_key_name"
+  if [[ $ssh_key_name == *"packer"* ]]; then
+    echo "--> Terminating instance: $ssh_key_name ($instance_id)"
+    aws ec2 terminate-instances --instance-ids "$instance_id" --region "$REGION"
+  fi
 done
 
 # List all EBS volume IDs and extract their IDs

diff --git a/.github/scripts/azure-new-instance.sh b/.github/scripts/azure-new-instance.sh
@@ -28,6 +28,7 @@ if [ "$TECHNO" = "tdx" ]; then
     --ssh-key-values "$SSH_PUB_KEY"
 else
   IMAGE_NAME="/subscriptions/e04f52be-d51f-43fe-95f8-d63a8fc91464/resourceGroups/packer-snp/providers/Microsoft.Compute/galleries/cosmian_packer/images/cosmian-vm-${DISTRIB}-${TECHNO}/versions/0.0.0"
+  IMAGE_NAME="/subscriptions/e04f52be-d51f-43fe-95f8-d63a8fc91464/resourceGroups/packer-snp/providers/Microsoft.Compute/galleries/cosmian_packer/images/base-image-${DISTRIB}-${TECHNO}/versions/0.1.5"
 
   if [ "$DISTRIB" = "ubuntu" ]; then
     # Ubuntu SEV
@@ -53,3 +54,6 @@ else
 fi
 
 az vm open-port -g packer-snp -n "$NAME" --priority 100 --port 5555,443,22
+
+HOST=$(az vm show -d -g packer-snp -n "$NAME" --query publicIps -o tsv)
+echo "$HOST"
diff --git a/.github/workflows/aws_ansible.yml b/.github/workflows/aws_ansible.yml
@@ -114,7 +114,7 @@ jobs:
           for i in {1..1}
           do
             echo "Iteration: $i"
-            ansible-playbook ${{ inputs.product }}-playbook.yml -i ${IP_ADDR}, -u $SSH_USER --private-key="$HOME/packer.pem" -e cosmian_vm_version=$COSMIAN_VM_VERSION -e cosmian_kms_version=${{ inputs.kms-version }} -e cosmian_ai_runner_version=${{ inputs.ai-runner-version }} -e '{ "check_app_test_reboot": false, "check_cosmian_vm_test_reboot": false, "reboot_allowed": false }' --tags playbook-base-image,playbook-${{ inputs.product }},check-${{ inputs.product }}
+            ansible-playbook ${{ inputs.product }}-playbook.yml -i ${IP_ADDR}, -u $SSH_USER --private-key="$HOME/packer.pem" -e cosmian_vm_version=$COSMIAN_VM_VERSION -e cosmian_kms_version=${{ inputs.kms-version }} -e cosmian_ai_runner_version=${{ inputs.ai-runner-version }} -e '{ "check_app_test_reboot": false, "check_cosmian_vm_test_reboot": false, "reboot_allowed": false }' --tags playbook-base-image,playbook-${{ inputs.product }},check-${{ inputs.product }} --skip-tags role-cleanup
           done
 
       - name: Stop and delete AWS instance

diff --git a/.github/workflows/aws_base_image.yml b/.github/workflows/aws_base_image.yml
@@ -54,6 +54,7 @@ jobs:
 
       - name: Packer build image
         env:
+          PACKER_GITHUB_API_TOKEN: ${{ secrets.PACKER_GITHUB_TOKEN }}
           IMAGE_NAME: ${{ steps.env.outputs.IMAGE_NAME }}
         run: |
           set -ex

diff --git a/.github/workflows/aws_base_main.yml b/.github/workflows/aws_base_main.yml
@@ -22,4 +22,4 @@ jobs:
       techno: sev
       distrib: ${{ matrix.distrib }}
       product: ${{ matrix.product }}
-      base-version: 0.1.4
+      base-version: 0.1.5
diff --git a/.github/workflows/aws_image.yml b/.github/workflows/aws_image.yml
@@ -64,6 +64,7 @@ jobs:
 
       - name: Packer build image
         env:
+          PACKER_GITHUB_API_TOKEN: ${{ secrets.PACKER_GITHUB_TOKEN }}
           TIMESTAMP: ${{ steps.env.outputs.TIMESTAMP }}
           IMAGE_NAME: ${{ steps.env.outputs.IMAGE_NAME }}
           KMS_VERSION: ${{ inputs.kms-version }}

diff --git a/.github/workflows/aws_main.yml b/.github/workflows/aws_main.yml
@@ -17,20 +17,19 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        distrib: [ubuntu]
+        distrib: [ubuntu, rhel]
         product: [cosmian-vm]
     name: (AWS) ${{ matrix.product }} - ${{ matrix.distrib }} - SEV
     needs:
       - clean-resources
     secrets: inherit
-    uses: ./.github/workflows/aws_image.yml
+    uses: ./.github/workflows/aws_ansible.yml
     with:
       techno: sev
       distrib: ${{ matrix.distrib }}
       product: ${{ matrix.product }}
       kms-version: 4.16.0
       ai-runner-version: 0.3.0
-      base-version: 0.1.4
 
   post-clean-resources:
     if: success() || cancelled()

diff --git a/.github/workflows/azure_ansible.yml b/.github/workflows/azure_ansible.yml
@@ -110,7 +110,7 @@ jobs:
           for i in {1..1}
           do
             echo "Iteration: $i"
-            ansible-playbook ${{ inputs.product }}-playbook.yml -i ${IP_ADDR}, -u cosmian -e cosmian_vm_version=$COSMIAN_VM_VERSION -e cosmian_kms_version=${{ inputs.kms-version }} -e cosmian_ai_runner_version=${{ inputs.ai-runner-version }}
+            ansible-playbook ${{ inputs.product }}-playbook.yml -i ${IP_ADDR}, -u cosmian -e cosmian_vm_version=$COSMIAN_VM_VERSION -e cosmian_kms_version=${{ inputs.kms-version }} -e cosmian_ai_runner_version=${{ inputs.ai-runner-version }} --skip-tags role-cleanup
           done
 
       - name: Stop and delete Azure instance

diff --git a/.github/workflows/azure_base_main.yml b/.github/workflows/azure_base_main.yml
@@ -26,6 +26,6 @@ jobs:
       techno: ${{ matrix.techno }}
       distrib: ${{ matrix.distrib }}
       product: ${{ matrix.product }}
-      base-version: 0.1.4
+      base-version: 0.1.5
       kms-version: 0.0.0
       ai-runner-version: 0.0.0
diff --git a/.github/workflows/azure_packer_build.yml b/.github/workflows/azure_packer_build.yml
@@ -50,6 +50,7 @@ jobs:
 
       - name: Packer build image
         env:
+          PACKER_GITHUB_API_TOKEN: ${{ secrets.PACKER_GITHUB_TOKEN }}
           CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
           TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
           SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

diff --git a/.github/workflows/gcp_ansible.yml b/.github/workflows/gcp_ansible.yml
@@ -146,7 +146,7 @@ jobs:
           for i in {1..1}
           do
             echo "Iteration: $i"
-            ansible-playbook ${{ inputs.product }}-playbook.yml -i ${IP_ADDR}, -u cosmian -e cosmian_vm_version=$COSMIAN_VM_VERSION -e cosmian_kms_version=${{ inputs.kms-version }} -e cosmian_ai_runner_version=${{ inputs.ai-runner-version }}
+            ansible-playbook ${{ inputs.product }}-playbook.yml -i ${IP_ADDR}, -u cosmian -e cosmian_vm_version=$COSMIAN_VM_VERSION -e cosmian_kms_version=${{ inputs.kms-version }} -e cosmian_ai_runner_version=${{ inputs.ai-runner-version }} --skip-tags role-cleanup
           done
 
       - name: Stop and delete GCP instance

diff --git a/.github/workflows/gcp_base_image.yml b/.github/workflows/gcp_base_image.yml
@@ -56,6 +56,7 @@ jobs:
 
       - name: Packer build image
         env:
+          PACKER_GITHUB_API_TOKEN: ${{ secrets.PACKER_GITHUB_TOKEN }}
           IMAGE_NAME: ${{ steps.env.outputs.IMAGE_NAME }}
           TECHNO: ${{ inputs.techno }}
         run: |

diff --git a/.github/workflows/gcp_base_main.yml b/.github/workflows/gcp_base_main.yml
@@ -26,4 +26,4 @@ jobs:
       techno: ${{ matrix.techno }}
       distrib: ${{ matrix.distrib }}
       product: ${{ matrix.product }}
-      base-version: 0.1.4
+      base-version: 0.1.5
diff --git a/.github/workflows/gcp_image.yml b/.github/workflows/gcp_image.yml
@@ -79,6 +79,7 @@ jobs:
 
       - name: Packer build image
         env:
+          PACKER_GITHUB_API_TOKEN: ${{ secrets.PACKER_GITHUB_TOKEN }}
           TIMESTAMP: ${{ steps.env.outputs.TIMESTAMP }}
           IMAGE_NAME: ${{ steps.env.outputs.IMAGE_NAME }}
           KMS_VERSION: ${{ inputs.kms-version }}

diff --git a/.github/workflows/nightly_aws_main.yml b/.github/workflows/nightly_aws_main.yml
@@ -35,7 +35,7 @@ jobs:
       product: ${{ matrix.product }}
       kms-version: 4.16.0
       ai-runner-version: 0.3.0
-      base-version: 0.1.4
+      base-version: 0.1.5
 
   # Too many failures when rebooting EC2
   # ansible:

diff --git a/.github/workflows/nightly_azure_main.yml b/.github/workflows/nightly_azure_main.yml
@@ -37,7 +37,7 @@ jobs:
       product: ${{ matrix.product }}
       kms-version: 4.16.0
       ai-runner-version: 0.3.0
-      base-version: 0.1.4
+      base-version: 0.1.5
 
   ansible:
     if: startsWith(github.ref, 'refs/tags/') != true

diff --git a/.github/workflows/nightly_clean.yml b/.github/workflows/nightly_clean.yml
@@ -0,0 +1,21 @@
+---
+name: Nightly clean cloud providers resources
+
+on:
+  schedule:
+    # every day at 0 AM
+    - cron: 00 0 * * *
+  workflow_dispatch:
+
+jobs:
+  azure:
+    uses: ./.github/workflows/azure_clean.yml
+    secrets: inherit
+
+  gcp:
+    uses: ./.github/workflows/gcp_clean.yml
+    secrets: inherit
+
+  aws:
+    uses: ./.github/workflows/aws_clean.yml
+    secrets: inherit
diff --git a/.github/workflows/nightly_gcp_main.yml b/.github/workflows/nightly_gcp_main.yml
@@ -55,7 +55,7 @@ jobs:
       product: ${{ matrix.product }}
       kms-version: 4.16.0
       ai-runner-version: 0.3.0
-      base-version: 0.1.4
+      base-version: 0.1.5
 
   ansible:
     if: startsWith(github.ref, 'refs/tags/') != true

diff --git a/.github/workflows/nightly_marketplaces.yml b/.github/workflows/nightly_marketplaces.yml
@@ -8,7 +8,7 @@ on:
       - '**'
   # schedule:
   #   # every day at 0 AM
-  #   - cron: 00 0 * * *
+  #   - cron: 00 1 * * *
   workflow_dispatch:
 
 jobs:

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.2.3] - 2024-06-15
+
+### Bug Fixes
+
+- Upgrade base image to 0.1.5: clean all authorized_keys and users ([#140](https://github.com/Cosmian/cosmian_vm/pull/140))
+
 ## [1.2.2] - 2024-06-13
 
 ### Bug Fixes

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -9,7 +9,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "1.2.2"
+version = "1.2.3"
 edition = "2021"
 license = "BUSL-1.1"
 license-file = "LICENSE"

diff --git a/README.md b/README.md
@@ -46,13 +46,13 @@ Our client CLI [cosmian_vm](https://github.com/Cosmian/cosmian_vm/tree/main/crat
 - [Snapshot of the system](#snapshot-of-the-system)
 - [Verification of the remote instance](#verification-of-the-remote-instance)
 - [Cloud providers support](#cloud-providers-support)
-  - [Marketplace Image content](#marketplace-image-content)
-  - [Configuration file](#configuration-file)
-  - [First Cosmian VM launch](#first-cosmian-vm-launch)
-  - [Handle Cosmian VM status](#handle-cosmian-vm-status)
-  - [Usage](#usage)
-  - [Provide secrets without SSH access](#provide-secrets-without-ssh-access)
-- [Other Cosmian Products base on Cosmian VM](#other-cosmian-products-base-on-cosmian-vm)
+  * [Marketplace Image content](#marketplace-image-content)
+  * [Configuration file](#configuration-file)
+  * [First Cosmian VM launch](#first-cosmian-vm-launch)
+  * [Handle Cosmian VM status](#handle-cosmian-vm-status)
+  * [Usage](#usage)
+  * [Provide secrets without SSH access](#provide-secrets-without-ssh-access)
+- [Other Cosmian Products based on Cosmian VM](#other-cosmian-products-based-on-cosmian-vm)
 
 <!-- tocstop -->
 
@@ -279,11 +279,12 @@ The `restart` subcommand can restart the application identified in `service_name
 cosmian_vm --url https://my_app.dev app restart
 ```
 
-## Other Cosmian Products base on Cosmian VM
+## Other Cosmian Products based on Cosmian VM
 
-| Cosmian VM | Cosmian KMS | Cosmian AI Runner |
-| ---------- | ----------- | ----------------- |
-| 1.2.2      | 4.16.0      | 0.3.0             |
-| 1.2.1      | 4.16.0      | 0.3.0             |
-| 1.2.0      | 4.16.0      | -                 |
-| 1.1.2      | 4.15.0      | -                 |
+| Base image | Cosmian VM | Cosmian KMS | Cosmian AI Runner |
+| ---------- | ---------- | ----------- | ----------------- |
+| 0.1.5      | 1.2.3      | 4.16.0      | 0.3.0             |
+| 0.1.4      | 1.2.2      | 4.16.0      | 0.3.0             |
+| 0.1.3      | 1.2.1      | 4.16.0      | 0.3.0             |
+|            | 1.2.0      | 4.16.0      | -                 |
+|            | 1.1.2      | 4.15.0      | -                 |
diff --git a/ansible/README.md b/ansible/README.md
@@ -4,6 +4,12 @@
 
 ### Changelog
 
+## [0.1.5] - 2024-06-15
+
+- Clean RHEL/Ubuntu after builds: ([#140](https://github.com/Cosmian/cosmian_vm/pull/140))
+  - clean all authorized_keys
+  - clean users
+
 ## [0.1.4] - 2024-06-12
 
 - RHEL:
@@ -102,8 +108,8 @@ export USERNAME=cosmian
 export HOST=35.204.83.49
 # Be sure to install deps: `pip install -r python_modules.txt` on your localhost
 cd ansible
-ansible-playbook cosmian-vm-playbook.yml -i ${HOST}, -u $USERNAME -e cosmian_vm_version=1.2.2
-ansible-playbook kms-playbook.yml -i ${HOST}, -u $USERNAME -e cosmian_vm_version=1.2.2 -e cosmian_kms_version=4.16.0
+ansible-playbook cosmian-vm-playbook.yml -i ${HOST}, -u $USERNAME -e cosmian_vm_version=1.2.3
+ansible-playbook kms-playbook.yml -i ${HOST}, -u $USERNAME -e cosmian_vm_version=1.2.3 -e cosmian_kms_version=4.16.0
 ```
 
 The machine has been configured
diff --git a/ansible/ai-runner-packer-playbook.yml b/ansible/ai-runner-packer-playbook.yml
@@ -7,3 +7,5 @@
   become: true
   roles:
     - ai_runner
+    - role: cleanup
+      tags: role-cleanup
diff --git a/ansible/base-image-packer-playbook.yml b/ansible/base-image-packer-playbook.yml
@@ -3,13 +3,14 @@
   hosts: all
   become: true
   roles:
-    - role: configure_ima
-      tags: configure_ima
+    - role: upgrade
+      tags: role-upgrade
     - tpm
     - instance_configs # GCP only
     - intel
-    - upgrade
     - no_updates
+    - role: configure_ima
+      tags: role-configure-ima
 
 - name: Reboot after GRUB changes, Linux updates and TPM support installation
   hosts: all
@@ -43,3 +44,10 @@
         - name: Display Security updates
           ansible.builtin.debug:
             var: dnf_security_update
+
+- name: Clean base image
+  hosts: all
+  become: true
+  roles:
+    - role: cleanup
+      tags: role-cleanup
diff --git a/ansible/cosmian-vm-packer-playbook.yml b/ansible/cosmian-vm-packer-playbook.yml
@@ -6,3 +6,5 @@
     - check_cpu
     - role: cosmian_vm_agent
       tags: role_cosmian_vm_agent
+    - role: cleanup
+      tags: role-cleanup
diff --git a/ansible/group_vars/all.yml b/ansible/group_vars/all.yml
@@ -1,5 +1,5 @@
 ---
-cosmian_vm_version: 1.2.2
+cosmian_vm_version: 1.2.3
 cosmian_kms_version: 4.16.0
 cosmian_ai_runner_version: 0.3.0
 

diff --git a/ansible/kms-packer-playbook.yml b/ansible/kms-packer-playbook.yml
@@ -7,3 +7,5 @@
   become: true
   roles:
     - kms
+    - role: cleanup
+      tags: role-cleanup
-Original file line number
+Diff line change
@@ Expand Up / @@ -54,6 +54,7 @@ jobs: @@
           - name: Packer build image
             env:
+              PACKER_GITHUB_API_TOKEN: ${{ secrets.PACKER_GITHUB_TOKEN }}
               IMAGE_NAME: ${{ steps.env.outputs.IMAGE_NAME }}
             run: |
               set -ex
@@ Expand Down @@