* [pve-devel] [PATCH qemu-server] cloud-init: don't regenerate ssh hosts key on config change when vm is running
@ 2021-01-13 9:01 Alexandre Derumier
2021-01-13 11:26 ` Mira Limbeck
2021-01-13 16:40 ` Gilles Pietri
0 siblings, 2 replies; 6+ messages in thread
From: Alexandre Derumier @ 2021-01-13 9:01 UTC (permalink / raw)
To: pve-devel
Currently, we always regenerate sshkeys on any config change.
It should be done only before the first vm start, but currently can't known that.
So, this patch only do it when vm is running.
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---
PVE/QemuServer/Cloudinit.pm | 2 ++
1 file changed, 2 insertions(+)
diff --git a/PVE/QemuServer/Cloudinit.pm b/PVE/QemuServer/Cloudinit.pm
index 52a4203..dd643c1 100644
--- a/PVE/QemuServer/Cloudinit.pm
+++ b/PVE/QemuServer/Cloudinit.pm
@@ -135,6 +135,8 @@ sub cloudinit_userdata {
$content .= " - $k\n";
}
}
+ $content .= "ssh_deletekeys: false\n" if PVE::QemuServer::check_running($vmid);
+
$content .= "chpasswd:\n";
$content .= " expire: False\n";
--
2.20.1
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [pve-devel] [PATCH qemu-server] cloud-init: don't regenerate ssh hosts key on config change when vm is running
2021-01-13 9:01 [pve-devel] [PATCH qemu-server] cloud-init: don't regenerate ssh hosts key on config change when vm is running Alexandre Derumier
@ 2021-01-13 11:26 ` Mira Limbeck
2021-01-14 15:20 ` aderumier
2021-01-13 16:40 ` Gilles Pietri
1 sibling, 1 reply; 6+ messages in thread
From: Mira Limbeck @ 2021-01-13 11:26 UTC (permalink / raw)
To: pve-devel
We could add vendor data and put the ssh keys there:
https://cloudinit.readthedocs.io/en/latest/topics/vendordata.html
On 1/13/21 10:01 AM, Alexandre Derumier wrote:
> Currently, we always regenerate sshkeys on any config change.
>
> It should be done only before the first vm start, but currently can't known that.
>
> So, this patch only do it when vm is running.
>
> Signed-off-by: Alexandre Derumier<aderumier@odiso.com>
> ---
> PVE/QemuServer/Cloudinit.pm | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/PVE/QemuServer/Cloudinit.pm b/PVE/QemuServer/Cloudinit.pm
> index 52a4203..dd643c1 100644
> --- a/PVE/QemuServer/Cloudinit.pm
> +++ b/PVE/QemuServer/Cloudinit.pm
> @@ -135,6 +135,8 @@ sub cloudinit_userdata {
> $content .= " - $k\n";
> }
> }
> + $content .= "ssh_deletekeys: false\n" if PVE::QemuServer::check_running($vmid);
> +
> $content .= "chpasswd:\n";
> $content .= " expire: False\n";
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [pve-devel] [PATCH qemu-server] cloud-init: don't regenerate ssh hosts key on config change when vm is running
2021-01-13 11:26 ` Mira Limbeck
@ 2021-01-14 15:20 ` aderumier
2021-01-15 11:08 ` aderumier
0 siblings, 1 reply; 6+ messages in thread
From: aderumier @ 2021-01-14 15:20 UTC (permalink / raw)
To: Proxmox VE development discussion
>>We could add vendor data and put the ssh keys there:
>>>
>>> https://cloudinit.readthedocs.io/en/latest/topics/vendordata.html
>>>
technically, it's possible to add host ssh keys with
ssh_keys:
rsa_private: |
-----BEGIN RSA PRIVATE KEY-----
MIIBxwIBAAJhAKD0YSHy73nUgysO13XsJmd4fHiFyQ+00R7VVu2iV9Qco
...
-----END RSA PRIVATE KEY-----
rsa_public: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAGEAoPRhIfLvedSDKw7Xd
I had asked about it some months ago,but Dietmar didn't want it
https://lists.proxmox.com/pipermail/pve-devel/2020-June/044104.html
"
----- Mail original -----
De: "dietmar" <dietmar at proxmox.com>
À: "pve-devel" <pve-devel at pve.proxmox.com>
Envoyé: Jeudi 25 Juin 2020 11:00:10
Objet: Re: [pve-devel] cloudinit: generate server ssh keys on proxmox
side ?
> Maybe could we generate them once at proxmox side ?
-1
Copying private keys is bad .
"
I wasn't aware about ssh_deletekeys at this time,
but it seem a better way to manage this.(keep sshkey generation inside
the vm, but do it only once)
Le mercredi 13 janvier 2021 à 12:26 +0100, Mira Limbeck a écrit :
> We could add vendor data and put the ssh keys there:
>
> https://cloudinit.readthedocs.io/en/latest/topics/vendordata.html
>
>
> On 1/13/21 10:01 AM, Alexandre Derumier wrote:
> > Currently, we always regenerate sshkeys on any config change.
> >
> > It should be done only before the first vm start, but currently
> > can't known that.
> >
> > So, this patch only do it when vm is running.
> >
> > Signed-off-by: Alexandre Derumier<aderumier@odiso.com>
> > ---
> > PVE/QemuServer/Cloudinit.pm | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/PVE/QemuServer/Cloudinit.pm
> > b/PVE/QemuServer/Cloudinit.pm
> > index 52a4203..dd643c1 100644
> > --- a/PVE/QemuServer/Cloudinit.pm
> > +++ b/PVE/QemuServer/Cloudinit.pm
> > @@ -135,6 +135,8 @@ sub cloudinit_userdata {
> > $content .= " - $k\n";
> > }
> > }
> > + $content .= "ssh_deletekeys: false\n" if
> > PVE::QemuServer::check_running($vmid);
> > +
> > $content .= "chpasswd:\n";
> > $content .= " expire: False\n";
> >
>
>
> _______________________________________________
> pve-devel mailing list
> pve-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [pve-devel] [PATCH qemu-server] cloud-init: don't regenerate ssh hosts key on config change when vm is running
2021-01-14 15:20 ` aderumier
@ 2021-01-15 11:08 ` aderumier
0 siblings, 0 replies; 6+ messages in thread
From: aderumier @ 2021-01-15 11:08 UTC (permalink / raw)
To: Proxmox VE development discussion
I have sent another patch,
with a config option
(Like this, user can define behaviour)
Le jeudi 14 janvier 2021 à 16:20 +0100, aderumier@odiso.com a écrit :
> > > We could add vendor data and put the ssh keys there:
> > > >
> > > > https://cloudinit.readthedocs.io/en/latest/topics/vendordata.html
> > > >
> technically, it's possible to add host ssh keys with
>
>
> ssh_keys:
> rsa_private: |
> -----BEGIN RSA PRIVATE KEY-----
> MIIBxwIBAAJhAKD0YSHy73nUgysO13XsJmd4fHiFyQ+00R7VVu2iV9Qco
> ...
> -----END RSA PRIVATE KEY-----
> rsa_public: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAGEAoPRhIfLvedSDKw7Xd
>
>
> I had asked about it some months ago,but Dietmar didn't want it
> https://lists.proxmox.com/pipermail/pve-devel/2020-June/044104.html
> "
> ----- Mail original -----
> De: "dietmar" <dietmar at proxmox.com>
> À: "pve-devel" <pve-devel at pve.proxmox.com>
> Envoyé: Jeudi 25 Juin 2020 11:00:10
> Objet: Re: [pve-devel] cloudinit: generate server ssh keys on proxmox
> side ?
>
> > Maybe could we generate them once at proxmox side ?
>
> -1
>
> Copying private keys is bad .
> "
>
>
>
> I wasn't aware about ssh_deletekeys at this time,
> but it seem a better way to manage this.(keep sshkey generation
> inside
> the vm, but do it only once)
>
>
>
> Le mercredi 13 janvier 2021 à 12:26 +0100, Mira Limbeck a écrit :
> > We could add vendor data and put the ssh keys there:
> >
> > https://cloudinit.readthedocs.io/en/latest/topics/vendordata.html
> >
> >
> > On 1/13/21 10:01 AM, Alexandre Derumier wrote:
> > > Currently, we always regenerate sshkeys on any config change.
> > >
> > > It should be done only before the first vm start, but currently
> > > can't known that.
> > >
> > > So, this patch only do it when vm is running.
> > >
> > > Signed-off-by: Alexandre Derumier<aderumier@odiso.com>
> > > ---
> > > PVE/QemuServer/Cloudinit.pm | 2 ++
> > > 1 file changed, 2 insertions(+)
> > >
> > > diff --git a/PVE/QemuServer/Cloudinit.pm
> > > b/PVE/QemuServer/Cloudinit.pm
> > > index 52a4203..dd643c1 100644
> > > --- a/PVE/QemuServer/Cloudinit.pm
> > > +++ b/PVE/QemuServer/Cloudinit.pm
> > > @@ -135,6 +135,8 @@ sub cloudinit_userdata {
> > > $content .= " - $k\n";
> > > }
> > > }
> > > + $content .= "ssh_deletekeys: false\n" if
> > > PVE::QemuServer::check_running($vmid);
> > > +
> > > $content .= "chpasswd:\n";
> > > $content .= " expire: False\n";
> > >
> >
> >
> > _______________________________________________
> > pve-devel mailing list
> > pve-devel@lists.proxmox.com
> > https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
> >
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [pve-devel] [PATCH qemu-server] cloud-init: don't regenerate ssh hosts key on config change when vm is running
2021-01-13 9:01 [pve-devel] [PATCH qemu-server] cloud-init: don't regenerate ssh hosts key on config change when vm is running Alexandre Derumier
2021-01-13 11:26 ` Mira Limbeck
@ 2021-01-13 16:40 ` Gilles Pietri
2021-01-14 8:45 ` aderumier
1 sibling, 1 reply; 6+ messages in thread
From: Gilles Pietri @ 2021-01-13 16:40 UTC (permalink / raw)
To: pve-devel
Le 13/01/2021 à 10:01, Alexandre Derumier a écrit :
> Currently, we always regenerate sshkeys on any config change.
>
> It should be done only before the first vm start, but currently can't known that.
>
> So, this patch only do it when vm is running.
Hi,
There is something indeed annoying with that module, as I always end up
adding ssh_deletekeys: false in a provisionned server, but I like that
it does it the first time indeed…
Maybe we could let it be configurable though!
Gilou
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [pve-devel] [PATCH qemu-server] cloud-init: don't regenerate ssh hosts key on config change when vm is running
2021-01-13 16:40 ` Gilles Pietri
@ 2021-01-14 8:45 ` aderumier
0 siblings, 0 replies; 6+ messages in thread
From: aderumier @ 2021-01-14 8:45 UTC (permalink / raw)
To: Proxmox VE development discussion
> Hi,
>
> There is something indeed annoying with that module, as I always end
> up
> adding ssh_deletekeys: false in a provisionned server, but I like
> that
> it does it the first time indeed…
>
> Maybe we could let it be configurable though!
Yes, I don't known too much how to handle it at first boot only.
Maybe when we create a template, we could add an option like:
ssh_deleteys:true."
then remove it from vm config when vm start ? (and add in gui an option
to reset it to true manually ?)
i'm looking to use cloud-init to online change too, currently I'm able
to it with this udev rules
/etc/udev/rules.d/90-cloudinit.rules
ACTION=="change", SUBSYSTEM=="block", KERNEL=="sr[0-9]*",
ENV{ID_FS_LABEL}=="config-2", RUN+="/usr/local/bin/cloudinit-reload.sh"
/usr/local/bin/cloudinit-reload.sh
---------------------------------------------
#!/bin/bash
if test -f /tmp/cloudinitreload.lock; then
rm /run/cloud-init/.instance-id
rm /run/cloud-init/network-config-ready
systemctl restart cloud-init-local.service
systemctl restart cloud-init.service
systemctl reload networking
rm /tmp/cloudinitreload.lock
exit 1
fi
touch /tmp/cloudinitreload.lock
Le mercredi 13 janvier 2021 à 17:40 +0100, Gilles Pietri a écrit :
> Le 13/01/2021 à 10:01, Alexandre Derumier a écrit :
> > Currently, we always regenerate sshkeys on any config change.
> >
> > It should be done only before the first vm start, but currently
> > can't known that.
> >
> > So, this patch only do it when vm is running.
>
> Hi,
>
> There is something indeed annoying with that module, as I always end
> up
> adding ssh_deletekeys: false in a provisionned server, but I like
> that
> it does it the first time indeed…
>
> Maybe we could let it be configurable though!
>
> Gilou
>
> _______________________________________________
> pve-devel mailing list
> pve-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-01-15 11:08 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-13 9:01 [pve-devel] [PATCH qemu-server] cloud-init: don't regenerate ssh hosts key on config change when vm is running Alexandre Derumier
2021-01-13 11:26 ` Mira Limbeck
2021-01-14 15:20 ` aderumier
2021-01-15 11:08 ` aderumier
2021-01-13 16:40 ` Gilles Pietri
2021-01-14 8:45 ` aderumier
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox