Add in Ephemeral SSH Support (#53)

This gives us an emergency backdoor for support, because you can't turn back time and suddenely magic SSH into existence when stuff does go wrong.
unikorn-cloud · Aug 30, 2024 · c84ca03 · c84ca03
1 parent 52c3ac6
commit c84ca03
Show file tree

Hide file tree

Showing 17 changed files with 233 additions and 112 deletions.
diff --git a/Makefile b/Makefile
@@ -64,7 +64,7 @@ FLAGS=-trimpath -ldflags '-X $(MODULE)/pkg/constants.Version=$(VERSION) -X $(MOD
 LINT_VERSION=v1.59.1
 
 # Defines the version of the CRD generation tools to use.
-CONTROLLER_TOOLS_VERSION=v0.14.0
+CONTROLLER_TOOLS_VERSION=v0.16.1
 
 # Defines the version of code generator tools to use.
 # This should be kept in sync with the Kubenetes library versions defined in go.mod.

diff --git a/charts/region/crds/region.unikorn-cloud.org_identities.yaml b/charts/region/crds/region.unikorn-cloud.org_identities.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.1
   name: identities.region.unikorn-cloud.org
 spec:
   group: region.unikorn-cloud.org

diff --git a/charts/region/crds/region.unikorn-cloud.org_openstackidentities.yaml b/charts/region/crds/region.unikorn-cloud.org_openstackidentities.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.1
   name: openstackidentities.region.unikorn-cloud.org
 spec:
   group: region.unikorn-cloud.org
@@ -73,6 +73,14 @@ spec:
                 description: ServerGroupID is the ID of the server group created for
                   the identity.
                 type: string
+              sshKeyName:
+                description: SSHKeyName is the ssh key that may be injected into clusters
+                  by consuming services.
+                type: string
+              sshPrivateKey:
+                description: SSHPrivateKey is a PEM encoded private key.
+                format: byte
+                type: string
               userID:
                 description: UserID is the ID of the user created for the identity.
                 type: string

diff --git a/charts/region/crds/region.unikorn-cloud.org_openstackphysicalnetworks.yaml b/charts/region/crds/region.unikorn-cloud.org_openstackphysicalnetworks.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.1
   name: openstackphysicalnetworks.region.unikorn-cloud.org
 spec:
   group: region.unikorn-cloud.org

diff --git a/charts/region/crds/region.unikorn-cloud.org_physicalnetworks.yaml b/charts/region/crds/region.unikorn-cloud.org_physicalnetworks.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.1
   name: physicalnetworks.region.unikorn-cloud.org
 spec:
   group: region.unikorn-cloud.org

diff --git a/charts/region/crds/region.unikorn-cloud.org_regions.yaml b/charts/region/crds/region.unikorn-cloud.org_regions.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.1
   name: regions.region.unikorn-cloud.org
 spec:
   group: region.unikorn-cloud.org

diff --git a/charts/region/crds/region.unikorn-cloud.org_vlanallocations.yaml b/charts/region/crds/region.unikorn-cloud.org_vlanallocations.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.1
   name: vlanallocations.region.unikorn-cloud.org
 spec:
   group: region.unikorn-cloud.org

diff --git a/go.mod b/go.mod
@@ -14,6 +14,7 @@ require (
 	go.opentelemetry.io/otel v1.29.0
 	go.opentelemetry.io/otel/sdk v1.29.0
 	go.opentelemetry.io/otel/trace v1.29.0
+	golang.org/x/crypto v0.26.0
 	k8s.io/api v0.31.0
 	k8s.io/apimachinery v0.31.0
 	sigs.k8s.io/controller-runtime v0.19.0
@@ -73,7 +74,6 @@ require (
 	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
-	golang.org/x/crypto v0.26.0 // indirect
 	golang.org/x/exp v0.0.0-20240823005443-9b4947da3948 // indirect
 	golang.org/x/net v0.28.0 // indirect
 	golang.org/x/oauth2 v0.22.0 // indirect

diff --git a/pkg/apis/unikorn/v1alpha1/types.go b/pkg/apis/unikorn/v1alpha1/types.go
@@ -344,6 +344,10 @@ type OpenstackIdentitySpec struct {
 	ApplicationCredentialSecret *string `json:"applicationCredentialSecret,omitempty"`
 	// ServerGroupID is the ID of the server group created for the identity.
 	ServerGroupID *string `json:"serverGroupID,omitempty"`
+	// SSHKeyName is the ssh key that may be injected into clusters by consuming services.
+	SSHKeyName *string `json:"sshKeyName,omitempty"`
+	// SSHPrivateKey is a PEM encoded private key.
+	SSHPrivateKey []byte `json:"sshPrivateKey,omitempty"`
 }
 
 type OpenstackIdentityStatus struct{}

diff --git a/pkg/apis/unikorn/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/unikorn/v1alpha1/zz_generated.deepcopy.go
diff --git a/pkg/handler/handler.go b/pkg/handler/handler.go
@@ -344,6 +344,7 @@ func (h *Handler) convertIdentity(ctx context.Context, in *unikornv1.Identity) *
 				UserId:        openstackIdentity.Spec.UserID,
 				ProjectId:     openstackIdentity.Spec.ProjectID,
 				ServerGroupId: openstackIdentity.Spec.ServerGroupID,
+				SshKeyName:    openstackIdentity.Spec.SSHKeyName,
 			}
 
 			if openstackIdentity.Spec.CloudConfig != nil {