Fixes #38478 - Introduce SSH CA certificate support #977
Conversation
|
Only drafting stage. |
adamlazik1
force-pushed
the
ssh-cert-support
branch
7 times, most recently
from
2727578 to
f691cbc
Compare
adamlazik1
force-pushed
the
ssh-cert-support
branch
from
f691cbc to
2785acd
Compare
|
I will keep this in draft because there will be four PRs in total that should get merged at roughly the same time, but I do believe that this is now ready for review. |
| rescue | ||
| Rails.logger.info("Unable to fetch CA public key. Using public key authentication instead.") |
There was a problem hiding this comment.
So if the proxy doesn't have the ca_pubkey endpoint, the get will raise and we'll get this warning. If the proxy has that endpoint, but doesn't have a ca_pubkey configured, the get will silently return an empty string, right?
There was a problem hiding this comment.
Right. Looking at it now I don't know why I made it like this, the message makes little sense. I updated it to reflect the behavior of the pubkey api call.
app/models/concerns/foreman_remote_execution/smart_proxy_extensions.rb
Outdated
Show resolved
Hide resolved
adamlazik1
force-pushed
the
ssh-cert-support
branch
from
2785acd to
3299a3e
Compare
adamlazik1
force-pushed
the
ssh-cert-support
branch
from
9093a40 to
7707987
Compare
app/models/concerns/foreman_remote_execution/host_extensions.rb
Outdated
Show resolved
Hide resolved
adamlazik1
force-pushed
the
ssh-cert-support
branch
from
7707987 to
a4914f8
Compare
adamlazik1
force-pushed
the
ssh-cert-support
branch
from
a4914f8 to
3a29a7b
Compare
adamlazik1
force-pushed
the
ssh-cert-support
branch
from
3a29a7b to
96ae1a6
Compare
|
Switching back to draft since the feature got postponed to 3.16 |
adamlazik1
force-pushed
the
ssh-cert-support
branch
from
96ae1a6 to
7d39bd4
Compare
adamlazik1
force-pushed
the
ssh-cert-support
branch
from
7d39bd4 to
25a85f5
Compare
adamlazik1
force-pushed
the
ssh-cert-support
branch
from
25a85f5 to
1e30bac
Compare
adamlazik1
force-pushed
the
ssh-cert-support
branch
from
1e30bac to
335d991
Compare
adamlazik1
force-pushed
the
ssh-cert-support
branch
from
335d991 to
e8c9049
Compare
lhellebr
left a comment
lhellebr
left a comment
There was a problem hiding this comment.
I have been able to verify the SSH CA cert feature as a complex of the following 4 PRs:
theforeman/smart_proxy_remote_execution_ssh#126
theforeman/foreman#10571
#977
theforeman/puppet-foreman_proxy#867
Including the following use cases:
SSH REX
Ansible REX
Pull mode REX
Cockpit
Including hosts created by:
Global registration
Provisioning
Including scenarios:
SSH CA on Satellite side
SSH CA on host side
SSH CA on both sides
Both positive scenarios and negative scenarios, that is incorrect CA, incorrect cert, incorrect principal.
=> ACK to this PR
3 participants
No description provided.