Cloud-init
-
Cloud Stack Conference talk.
-
Distribution image containing pre-installed Cloud Init
-
Script configurable installation options
|
|
main.tf |
myinit.sh |
|---|---|
resource "hcloud_server" "nginxServer" {
name = "hello"
image = "debian-12"
server_type = "cx22"
user_data = file("myinit.sh")
} |
|
No. 12
Automatic Nginx installation
|
Q: |
Use a Terraform
TipYou may test your script beforehand on an existing server.
This may save unnecessary Terraform
|
resource "hcloud_server" "web" { name = var.server_name ... user_data = file("userData.yml") } |
|
# main.tf resource "local_file" "user_data" { content = templatefile("tpl/userData.yml", { loginUser = "devops" }) filename = "gen/userData.yml" } resource "hcloud_server" "helloServer" { ... # Will become gen/userData.yml user_data = local_file.user_data.content } |
# tpl/userData.yml ... users: - name: ${loginUser} ... |
# tpl/userData.yml ... users: - name: devops ... |
-
# cloud-init schema --system --annotate
... apt: # E1 - debconf_selections: openssh-server openssh-server/password-authentication boolean false openssh-server openssh-server/permit-root-login boolean false ... # Errors: ------------- # E1: [{'debconf_selections': 'openssh-server ....boolean false'}] is not of type 'object' -
# cloud-init schema --config-file /var/lib/cloud/instance/user-data.txt
Valid cloud-config: /var/lib/cloud/instance/user-data.txt
resource "tls_private_key" "host" { algorithm = "ED25519" } ... resource "local_file" "user_data" { content = templatefile("tpl/userData.yml", { host_ed25519_private = tls_private_key.host.private_key_openssh host_ed25519_public = ... }) filename = "gen/user_data.yml" } |
...
ssh_keys:
ed25519_private: |
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUA...
-----END OPENSSH PRIVATE KEY----- |
# E1: File gen/user_data.yml is not valid YAML.
in "<unicode string>", line 19, column 1:
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUA ... |
# main.tf resource "local_file" "user_data" { content = templatefile("tpl/userData.yml", { host_ed25519_private = indent(4, tls....host.private_key_openssh) ...}) filename = "gen/user_data.yml" } |
# gen/usr_data.yml ssh_keys: ed25519_private: | ␣␣␣␣-----BEGIN OPENSSH PRIVATE KEY----- ␣␣␣␣b3BlbnNzaC1 ... ␣␣␣␣... ␣␣␣␣... ␣␣␣␣-----END OPENSSH PRIVATE KEY----- |
# gen/usr_data.yml ssh_keys: ed25519_private: | ␣␣␣␣-----BEGIN OPENSSH PRIVATE KEY----- ␣␣␣␣␣␣b3BlbnNzaC1 ... ␣␣␣␣␣␣... ␣␣␣␣␣␣... ␣␣␣␣␣␣-----END OPENSSH PRIVATE KEY----- |
# /etc/ssh/ssh_host_ed25519_key ... ssh_keys: ed25519_private: | -----BEGIN OPENSSH PRIVATE KEY----- ␣␣b3BlbnNzaC1 ... ␣␣... ␣␣... ␣␣-----END OPENSSH PRIVATE KEY----- |
resource "local_file" "user_data" {
content = templatefile("tpl/userData.yml", {
host_ed25519_private = tls_private_key.host.private_key_openssh
host_ed25519_public = tls_private_key.host.public_key_openssh
devopsUsername = hcloud_ssh_key.loginUser.name
...#cloud-config
${yamlencode(
{
...
ssh_keys = {
ed25519_private = host_ed25519_private
ed25519_public = host_ed25519_public
} ...
}
)}
users:
- name: ${devopsUsername} ... root@hello:~# journalctl -f May 06 04:41:20 hello cloud-init[898]: Cloud-init v. 22.4.2 finished at Mon, 06 May 2024 04:41:20 +0000. Datasource DataSourceHetzner. Up 11.78 seconds ... May 06 04:46:16 hello sshd[927]: Invalid user abc from 43.163.218.130 port 33408 May 06 04:46:17 hello sshd[927]: Received disconnect from 43.163.218.130 port 33408:11: Bye Bye [preauth] May 06 04:46:17 hello sshd[927]: Disconnected from invalid user abc 43.163.218.130 port 33408 [preauth] ... May 06 04:50:54 hello sshd[930]: fatal: Timeout before authentication for 27.128.243.225 port 59866 ... May 06 04:52:45 hello sshd[933]: Invalid user cos from 43.163.218.130 port 59776 ... May 06 04:53:04 hello sshd[935]: Invalid user admin from 194.169.175.35 port 51128 May 06 04:53:49 hello sshd[937]: User root from 43.163.218.130 not allowed because not listed in AllowUsers May 06 04:53:49 hello sshd[937]: Disconnected from invalid user root 43.163.218.130 port 50592 [preauth]
No. 13
Working on Cloud-init
|
Q: |
We continue our exercise series Incrementally creating a base system by adding a Cloud-init configuration:
|
known_hosts entry on
re-creating server Problem of repeated terraform
apply:
$ ssh root@128.140.108.60
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!known_hosts ... resource "local_file" "known_hosts" { content = join(" " ,[ hcloud_server.helloServer.ipv4_address , tls_private_key.host.public_key_openssh ] ) filename = "gen/known_hosts" file_permission = "644" }
157.180.68.60 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5...XXgAC3eaueHMQ8ePtbnw
main.tf |
tpl/ssh.sh |
|---|---|
resource "local_file" "ssh_script" { content = templatefile("tpl/ssh.sh", { ip=hcloud_server.hello.ipv4_address }) filename = "bin/ssh" file_permission = "755" depends_on = [local_file.known_hosts] } |
#!/usr/bin/env bash
GEN_DIR=$(dirname "$0")/../gen
ssh -o UserKnownHostsFile= \
"$GEN_DIR/known_hosts" devops@${ip} "$@" |
No. 14
Solving the ~/.ssh/known_hosts quirk
|
Q: |
Extend Working on Cloud-init
generating both a Avoiding ssh host key issues on login we
require the creation of a 157.180.78.16 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJDd+x7b80BM97rTU4RCM/CP+K7u4QAqx8ulDdXm9JDv We assume this file being generated at
#!/usr/bin/env bash
GEN_DIR=$(dirname "$0")/../gen
ssh -o UserKnownHostsFile="$GEN_DIR/known_hosts" devops@157.180.78.16 "$@"
# end of scriptThis way invoking ./bin/ssh will instruct the
ssh client to read
For generating this script we start from a corresponding
#!/usr/bin/env bash GEN_DIR=$(dirname "$0")/../gen ssh -o UserKnownHostsFile="$GEN_DIR/known_hosts" ${devopsUsername}@${ip} "$@" # end of script We then let Terraform use this template replacing ${devopsUsername} and ${ip} by your deployment's actual values. As shown in Figure 1047, “Parent module vs. sub module context ” point to your child
module's local resource "local_file" "ssh_script" { content = templatefile("${path.module}/tpl/ssh.sh", { ... } Likewise create a #!/usr/bin/env bash GEN_DIR=$(dirname "$0")/../gen if [ $# -lt 2 ]; then echo usage: .../bin/scp ... devops@157.180.78.16 ... else scp -o UserKnownHostsFile="$GEN_DIR/known_hosts" $@ fi # end of script Since copying objects requires at least a source and a
destination parameter this script checks for the presence of at
least two extra user supplied values by means of |
#cloud-config
chpasswd:
list: |
root:bingo9wingo
expire: False#cloud-config
write_files:
- content:
${base64encode(private_key_pem)}
encoding: base64
path: /etc/nginx/snippets/cert/private.pemNote
Congrats to paultyng
