Skip to content

Commit 3dc5d12

Browse files
bryopsidabryopsida
authored
Add ability to seed trusted public keys (#119)
* ✨ Add ability to set trusted public keys at install * ✨ Working pub key auth from install
1 parent 73612a2 commit 3dc5d12

File tree

8 files changed

+103
-10
lines changed

8 files changed

+103
-10
lines changed

‎Dockerfile‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM ubuntu:kinetic-20230624
1+
FROM ubuntu:jammy
22
ARG COMMIT=""
33
ENV COMMIT_SHA=${COMMIT}
44
ENV DEBIAN_FRONTEND=noninteractive
@@ -8,7 +8,7 @@ RUN echo "LANG=en_US.UTF-8" >> /etc/environment
88

99

1010
RUN apt-get update && \
11-
apt-get install -y curl dropbear-bin sudo gcc g++ make python3 zsh vim wget htop nano openssh-client gnupg2 ca-certificates apt-transport-https ncdu tcpdump tldr bat && \
11+
apt-get install -y curl dropbear-bin sudo gcc g++ make python3 zsh vim wget htop nano openssh-client gnupg2 ca-certificates apt-transport-https ncdu tcpdump tldr bat unzip zip && \
1212
apt-get install -y --no-install-recommends git
1313

1414
# Helm
@@ -25,8 +25,8 @@ RUN apt-get update && \
2525
apt-get update && \
2626
apt-get install -y kubectl
2727

28-
29-
RUN curl -sL https://deb.nodesource.com/setup_16.x -o nodesource_setup.sh && \
28+
# Node global
29+
RUN curl -sL https://deb.nodesource.com/setup_20.x -o nodesource_setup.sh && \
3030
chmod +x nodesource_setup.sh && \
3131
./nodesource_setup.sh && \
3232
apt-get update &&\

‎Entrypoint.sh‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,37 @@ sudo mkdir -p /etc/dropbear
55
sudo chmod 700 /etc/dropbear
66
sudo chown -R developer:developer /etc/dropbear
77
touch /etc/dropbear/authorized_keys
8-
chmod 600 /etc/dropbear/authorized_keys
8+
chmod 600 /etc/dropbear/authorized_keys
9+
10+
if [ -e /authorized-keys ] ; then
11+
echo "Trusted Authorized keys exists, setting contents of /etc/dropbear/authorized_keys"
12+
cat /authorized-keys > /etc/dropbear/authorized_keys
13+
fi
14+
915
sudo chown -R developer:developer /home/developer
1016

1117
# setup home directory links/permissions etc
1218
# this occurs on every container startup and is meant to be idempotent without overwriting existing files
1319
/usr/local/bin/prepare_home.sh
1420

21+
ohmyzshEnabled=${OH_MY_ZSH_INSTALL_ENABLED:-"false"}
22+
if [[ $ohmyzshEnabled == "true" ]]; then
23+
sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"
24+
fi
25+
26+
nvmEnabled=${NVM_INSTALL_ENABLED:-"false"}
27+
if [[ $nvmEnabled == "true" ]]; then
28+
echo "NVM Install Enabled, ensuring nvm is installed for user"
29+
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
30+
fi
31+
32+
sdkManEnabled=${SDK_MAN_INSTALL_ENABLED:-"false"}
33+
if [[ $sdkManEnabled == "true" ]]; then
34+
echo "SDK Man Install Enabled, ensuring sdk man is installed for user"
35+
curl -s "https://get.sdkman.io" | bash
36+
fi
37+
38+
1539
passwordLoginEnabled=${PASSWORD_LOGIN_ENABLED:-"false"}
1640
if [[ $passwordLoginEnabled == "true" ]]; then
1741
# Create a random password for developer and echo it to the console

‎PrepareHome.sh‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,18 @@ if [ -e ~/.ssh/authorized_keys ] ; then
99
else
1010
echo "Creating authorized_keys link..."
1111
ln -s /etc/dropbear/authorized_keys ~/.ssh/authorized_keys
12-
fi
12+
fi
13+
14+
# seed .bashrc
15+
if [ -e ~/.bashrc ] ; then
16+
echo "bash profile already exists, skipping..."
17+
else
18+
cp /etc/skel/.bashrc ~/
19+
fi
20+
21+
# ~ folder should be 0755
22+
chmod 0755 ~
23+
# ~/.ssh should be 0700
24+
chmod 0700 ~/.ssh
25+
# ~/.ssh/authorized_keys should be 0600
26+
chmod 0600 ~/.ssh/authorized_keys

‎charts/k8s-dev-pod/Chart.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ apiVersion: v2
22
name: k8s-dev-pod
33
description: A Helm chart for deploying a dev environment inside a K8S cluster that is compatible with Visual Studio Code remote targets
44
type: application
5-
version: 0.2.0
6-
appVersion: "0.1.0"
5+
version: 0.3.0
76
maintainers:
87
- name: Bryopsida

‎charts/k8s-dev-pod/README.md‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# k8s-dev-pod
22

3-
![Version: 0.2.0](https://img.shields.io/badge/Version-0.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.1.0](https://img.shields.io/badge/AppVersion-0.1.0-informational?style=flat-square)
3+
![Version: 0.3.0](https://img.shields.io/badge/Version-0.3.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
44

55
A Helm chart for deploying a dev environment inside a K8S cluster that is compatible with Visual Studio Code remote targets
66

@@ -14,18 +14,25 @@ A Helm chart for deploying a dev environment inside a K8S cluster that is compat
1414

1515
| Key | Type | Default | Description |
1616
|-----|------|---------|-------------|
17+
| authorizedKeys | string | `nil` | A set of authorized public keys that will be trusted for logging in as developer, when specified this will overwrite the /etc/dropbear/authorized_keys contents with the value specified here on every pod-restart |
18+
| existingAuthorizedKeySecretName | string | `nil` | secret that is not managed by helm that holds the authorized keys property, when a value is specified this overrides using the authorizedKys |
19+
| existingAuthorizedKeySecretProperty | string | `"public-keys"` | property on the existing secret holding the authorized keys value |
1720
| homeSize | int | `20` | |
1821
| image.pullPolicy | string | `"Always"` | |
1922
| image.repo | string | `"ghcr.io/bryopsida/k8s-dev-pod"` | |
2023
| image.tag | string | `"main"` | |
2124
| ingressEnabled | bool | `false` | |
2225
| ingressPort | int | `3022` | |
26+
| nvmInstallEnabled | bool | `true` | |
27+
| nvmVersion | string | `"v0.39.7"` | |
28+
| ohMyZshInstallEnabled | bool | `true` | |
2329
| passwordLoginEnabled | bool | `true` | |
30+
| sdkManInstallEnabled | bool | `true` | |
2431
| tailscale.authKey | string | `nil` | |
2532
| tailscale.enabled | bool | `false` | |
2633
| tailscale.image.pullPolicy | string | `"Always"` | |
2734
| tailscale.image.repo | string | `"ghcr.io/tailscale/tailscale"` | |
2835
| tailscale.image.tag | string | `"latest"` | |
2936

3037
----------------------------------------------
31-
Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)
38+
Autogenerated from chart metadata using [helm-docs v1.12.0](https://github.com/norwoodj/helm-docs/releases/v1.12.0)

‎charts/k8s-dev-pod/templates/authorized-keys.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{{- if and .Values.authorizedKeys (not .Values.existingAuthorizedKeySecretName) }}
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: {{ .Release.Name }}-authorized-keys
6+
labels:
7+
{{- include "k8s-dev-pod.labels" . | nindent 4 }}
8+
data:
9+
public-keys: {{ .Values.authorizedKeys | b64enc }}
10+
{{- end }}

‎charts/k8s-dev-pod/templates/deployment.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,15 @@ spec:
3131
- name: dropbear
3232
persistentVolumeClaim:
3333
claimName: {{ .Release.Name }}-dropbear
34+
{{- if and .Values.authorizedKeys (not .Values.existingAuthorizedKeySecretName) }}
35+
- name: authorized-keys
36+
secret:
37+
secretName: {{ .Release.Name }}-authorized-keys
38+
{{- else if .Values.existingAuthorizedKeySecretName }}
39+
- name: authorized-keys
40+
secret:
41+
secretName: {{ .Values.existingAuthorizedKeySecretName }}
42+
{{- end }}
3443
{{- if .Values.volumes }}
3544
{{- toYaml .Values.volumes | nindent 8 }}
3645
{{- end }}
@@ -46,6 +55,14 @@ spec:
4655
env:
4756
- name: PASSWORD_LOGIN_ENABLED
4857
value: "{{ .Values.passwordLoginEnabled }}"
58+
- name: NVM_INSTALL_ENABLED
59+
value: "{{ .Values.nvmInstallEnabled }}"
60+
- name: NVM_VERSION
61+
value: "{{ .Values.nvmVersion }}"
62+
- name: SDK_MAN_INSTALL_ENABLED
63+
value: "{{ .Values.sdkManInstallEnabled }}"
64+
- name: OH_MY_ZSH_INSTALL_ENABLED
65+
value: "{{ .Values.ohMyZshInstallEnabled }}"
4966
{{- if .Values.env }}
5067
{{- toYaml .Values.env | nindent 12 }}
5168
{{- end }}
@@ -62,6 +79,15 @@ spec:
6279
- name: dropbear
6380
mountPath: /etc/dropbear
6481
readOnly: false
82+
{{- if or .Values.authorizedKeys .Values.existingAuthorizedKeySecretName }}
83+
- name: authorized-keys
84+
mountPath: /authorized-keys
85+
{{- if .Values.existingAuthorizedKeySecretName }}
86+
subPath: public-keys
87+
{{- else }}
88+
subPath: {{ .Values.existingAuthorizedKeySecretProperty }}
89+
{{- end }}
90+
{{- end }}
6591
{{- if .Values.volumeMounts }}
6692
{{- toYaml .Values.volumeMounts | nindent 12 }}
6793
{{- end }}

‎charts/k8s-dev-pod/values.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,23 @@ homeSize: 20
66
ingressEnabled: false
77
ingressPort: 3022
88
passwordLoginEnabled: true
9+
# -- secret that is not managed by helm that holds the authorized keys property, when a value is specified this overrides using the authorizedKys
10+
existingAuthorizedKeySecretName: ~
11+
# existingAuthorizedKeySecretName: dev-pod-authorized-keys
12+
# -- property on the existing secret holding the authorized keys value
13+
existingAuthorizedKeySecretProperty: public-keys
14+
# -- A set of authorized public keys that will be trusted for logging in as developer, when specified this will overwrite the /etc/dropbear/authorized_keys contents with the value specified here on every pod-restart
15+
authorizedKeys: ~
16+
# authorizedKeys: |
17+
# ssh-<key alg> <pub key> <client hostname>
918
tailscale:
1019
enabled: false
1120
image:
1221
repo: ghcr.io/tailscale/tailscale
1322
tag: latest
1423
pullPolicy: Always
1524
authKey: ~
25+
nvmInstallEnabled: true
26+
nvmVersion: v0.39.7
27+
sdkManInstallEnabled: true
28+
ohMyZshInstallEnabled: true

0 commit comments

Comments
 (0)