[WIP] Platform/oci golden vm by rstarmer · Pull Request #13 · artificialwisdomai/origin

rstarmer · 2023-05-14T15:54:17Z

adds cloud-init (needed for ssh key additions)
removes packer user password
adds serial interface grub config
checks for persistent network (mac) and removes it
minor tweaks to packer build (shutdown path)

@sdake

add cloud-init to support auto-import of ssh keys add setup script to remove injected password add ssh-keys from @sdake and @rstarmer for packer user add draft script to upload built image to Oracle

rstarmer · 2023-05-14T15:55:30Z

Fixes #11 and #12

sdake

No problem merging this now, once the --delete problem is fixed. I do think we should be using Ansible as a provisioner (rather than bash). I'll submit a few PRs for this.

sdake · 2023-05-14T18:04:01Z

platform/golden/scripts/serial.sh

+mkdir /home/packer/.ssh
+chmod 700 /home/packer/.ssh
+curl -sLo - https://github.com/sdake.keys >> /home/packer/.ssh/authorized_keys
+curl -sLo - https://github.com/rstarmer.keys >> /home/packer/.ssh/authorized_keys


I am not really sure how we should handle dynamic secret management. For now, I have started a wiki entry so we know where our secrets are stored or consumed in our repo.

I think we can enable this as a provisioning step. If we're goign to use Ansible, then it would likely be easier to add an ansible provisioner that loads the right keys at build time, or even better at image deploy time so that there is nothing static in the base/golden image.

Right. I think some things should be dynamic, and the rest should be baked (with packer). Dynamically loaded credentials make sense, far more sense then static.

But, I spent like 5+ years working with people at Red Hat that battled and battled over this credential issue. My recommendation - tech debt it for now, we will sort out the workflow later.

Another way to introduce SSH credentials is via the kernel command line.

sdake · 2023-05-14T18:07:13Z

platform/golden/scripts/serial.sh

+cat > /tmp/fixes.sh <<EOF
+#!/bin/bash
+set -x
+echo 'GRUB_CMDLINE_LINUX="console=ttyS0"' >> /etc/default/grub


better to put in /etc/default/grub.d. I will submit an update.

This may not even work, still trying to get a testable environment for dev (I think I can do this in OCI now, but I haven't yet managed to get a connection through the UI or via oci cli yet).

sdake · 2023-05-14T18:15:45Z

platform/golden/scripts/serial.sh

+
+echo 'packer ALL=(ALL) NOPASSWD:ALL'>> /etc/sudoers.d/91-packer
+
+passwd -d packer


I had to read the man page, and I was still not sure what --delete does. So, I tried it, and the result was

sdake@beast08 ~ [1]> sudo passwd -d sdake passwd: password expiry information changed.

in this case, it appears to have expired my password, which I guess is reasonable.

Is the goal your really after to remove the ability to login with the password (but with ssh?)

In that case, I think you want

passwd --lock packer

from man page:

-l, --lock Lock the password of the named account. This option disables a password by changing it to a value which matches no possible encrypted value (it adds a ´!´ at the beginning of the password). Note that this does not disable the account. The user may still be able to login using another authentication token (e.g. an SSH key). To disable the account, administrators should use usermod --expiredate 1 (this set the account's expire date to Jan 2, 1970). Users with a locked password are not allowed to change their password.

@rstarmer this needs a change to resolve. I recommend --lock.

Yes, that makes sense. I looked at the passwd/shadow files, and it "erases" the password, which would presumably make it impossible to login via a password, but would not expressly prohibit setting a password. And with passwordless Sudo, you could potentially set a password via su anyway.

this is important, but not worth slowing down the PR. Can you file a tech debt bug?

platform/golden/scripts/serial.sh

sdake · 2023-05-14T18:20:08Z

platform/golden/upload-image.sh

@@ -0,0 +1,28 @@
+cd build


comments here and there would be cool - not. really sure what this does without a deep dive into the man pages..

platform/golden/cfg/preseed-debian-11.cfg

sdake · 2023-05-14T18:23:11Z

platform/golden/bullseye.pkr.hcl

  hard_drive_interface = "virtio"
  rtc_time_base        = "UTC"
-  shutdown_command     = "echo '${var.ssh_password}' | sudo -S shutdown -P now"
+  shutdown_command     = "echo '${var.ssh_password}' | sudo -S /usr/sbin/shutdown -P now"


/usr/sbin not in the root path? Doesn't matter for the purposes of merging the PR, just seems odd. :)

@rstarmer can you respond on these questions? I am trying to learn along the way (this feels wrong, which means /etc/environment may not be right).

This was to resolve an issue with running shutdown, and I'm not sure why the environment worked initially, and then didn't. I'll do a bit more debugging, and I agree, I've not seen a single example where the full path to shutdown was required.

all good then. Perhaps a debt tech bug would help us keep track of it for new developer low hanging fruit.

WORK_REQUEST_ID needed to have ""s stripped Work Request matches SUCCEEDED not SUCCESS

The provisioners need not be this finegrained, just that tasks are.

@sdake

add cloud-init to support auto-import of ssh keys add setup script to remove injected password add ssh-keys from @sdake and @rstarmer for packer user add draft script to upload built image to Oracle

WORK_REQUEST_ID needed to have ""s stripped Work Request matches SUCCEEDED not SUCCESS

…alwisdom-origin into platform/oci-golden-vm

sdake · 2023-05-15T06:58:32Z

@rstarmer was this rdy for review?

cheers,
-steve

sdake · 2023-05-15T15:35:21Z

platform/golden/bullseye.pkr.hcl

  hard_drive_interface = "virtio"
  rtc_time_base        = "UTC"
-  shutdown_command     = "echo '${var.ssh_password}' | sudo -S shutdown -P now"
+  shutdown_command     = "echo '${var.ssh_password}' | sudo -S /usr/sbin/shutdown -P now"


@rstarmer can you respond on these questions? I am trying to learn along the way (this feels wrong, which means /etc/environment may not be right).

sdake · 2023-05-15T15:35:52Z

platform/golden/provisioners/00_create_manifest/debian.yml

@@ -0,0 +1,7 @@
+- hosts: all


strange, I think this shouldn't be here.

sdake · 2023-05-15T15:36:05Z

platform/golden/provisioners/00_create_manifest/roles/packages/tasks/main.yml

@@ -0,0 +1,10 @@
+ - name: "Get installed packages"


try removing.

sdake · 2023-05-15T15:36:23Z

platform/golden/provisioners/00_create_manifest/roles/packages/vars/main.yml

@@ -0,0 +1,157 @@
+---


this looks like a rebase gone wrong. Probably as a result of my force push error to main...

sdake · 2023-05-15T15:37:09Z

platform/golden/scripts/serial.sh

+
+echo 'packer ALL=(ALL) NOPASSWD:ALL'>> /etc/sudoers.d/91-packer
+
+passwd -d packer


@rstarmer this needs a change to resolve. I recommend --lock.

sdake

pasword needs --lock I believe.

sdake

line 106 may be broken. (after reading the virtualbox provisioner and vbox source code for hours), I believe this is correct. This uses the natnetwork created by vbox/start.sh to expose an ssh port, that can then be used by the ssh connector.

  vboxmanage = [
    [ "modifyvm", "{{.Name}}", "--recording", "on" ],
    [ "modifyvm", "{{.Name}}", "--nic1", "natnetwork" ]
  ]

sdake · 2023-05-16T05:59:03Z

platform/golden/bullseye.pkr.hcl

  hard_drive_interface = "virtio"
  rtc_time_base        = "UTC"
-  shutdown_command     = "echo '${var.ssh_password}' | sudo -S shutdown -P now"
+  shutdown_command     = "echo '${var.ssh_password}' | sudo -S /usr/sbin/shutdown -P now"


all good then. Perhaps a debt tech bug would help us keep track of it for new developer low hanging fruit.

platform/golden/scripts/serial.sh

sdake · 2023-05-16T06:00:41Z

platform/golden/scripts/serial.sh

+
+echo 'packer ALL=(ALL) NOPASSWD:ALL'>> /etc/sudoers.d/91-packer
+
+passwd -d packer


this is important, but not worth slowing down the PR. Can you file a tech debt bug?

sdake · 2023-05-16T06:01:39Z

platform/golden/scripts/serial.sh

+mkdir /home/packer/.ssh
+chmod 700 /home/packer/.ssh
+curl -sLo - https://github.com/sdake.keys >> /home/packer/.ssh/authorized_keys
+curl -sLo - https://github.com/rstarmer.keys >> /home/packer/.ssh/authorized_keys


Right. I think some things should be dynamic, and the rest should be baked (with packer). Dynamically loaded credentials make sense, far more sense then static.

But, I spent like 5+ years working with people at Red Hat that battled and battled over this credential issue. My recommendation - tech debt it for now, we will sort out the workflow later.

Another way to introduce SSH credentials is via the kernel command line.

rstarmer and others added 3 commits May 9, 2023 12:15

Some initial notes.

1284a9b

Update golden image

d9814c5

add cloud-init to support auto-import of ssh keys add setup script to remove injected password add ssh-keys from @sdake and @rstarmer for packer user add draft script to upload built image to Oracle

upload script now waits for import

8cb633d

rstarmer requested a review from sdake as a code owner May 14, 2023 15:54

cla-bot bot added the CLA CLA signed? label May 14, 2023

sdake reviewed May 14, 2023

View reviewed changes

rstarmer and others added 9 commits May 14, 2023 15:17

fix errors in upload script

004e2d7

WORK_REQUEST_ID needed to have ""s stripped Work Request matches SUCCEEDED not SUCCESS

update upload script to finish on SUCCEEDED

c1f921a

Initial example of creating a provisioner.

9f8cfd7

The provisioners need not be this finegrained, just that tasks are.

Some initial notes.

319915f

Update golden image

d5b0fb3

add cloud-init to support auto-import of ssh keys add setup script to remove injected password add ssh-keys from @sdake and @rstarmer for packer user add draft script to upload built image to Oracle

upload script now waits for import

8153627

fix errors in upload script

a6cd531

WORK_REQUEST_ID needed to have ""s stripped Work Request matches SUCCEEDED not SUCCESS

update upload script to finish on SUCCEEDED

b910f9d

Merge branch 'platform/oci-golden-vm' of github.com:rstarmer/artifici…

3df3392

…alwisdom-origin into platform/oci-golden-vm

sdake requested changes May 15, 2023

View reviewed changes

rstarmer changed the title ~~Platform/oci golden vm~~ WIP: Platform/oci golden vm May 15, 2023

rstarmer changed the title ~~WIP: Platform/oci golden vm~~ [WIP] Platform/oci golden vm May 15, 2023

sdake reviewed May 16, 2023

View reviewed changes

rstarmer closed this May 16, 2023


		echo 'packer ALL=(ALL) NOPASSWD:ALL'>> /etc/sudoers.d/91-packer

		passwd -d packer

Conversation

rstarmer commented May 14, 2023

Uh oh!

rstarmer commented May 14, 2023

Uh oh!

sdake left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sdake commented May 15, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sdake left a comment

Choose a reason for hiding this comment

Uh oh!

sdake left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants