-
-
Notifications
You must be signed in to change notification settings - Fork 381
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Transparently use ssh-agent on linux/darwin #312
Conversation
May be worth enabling in Windows for users with pre-configured ssh-agents. |
Attempt to create the ssh connection using a pre-existing ssh-agent first, this will allow users with pre-configured agents, yubikeys etc on Linux and Darwin to establish ssh connections without resorting to private keys. If this first connection attempt fails we fall through to the existing key based auth flow. Note that Windows is not supported in this PR as yubikeys do not currently use the ssh-agent. Signed-off-by: John McCabe <[email protected]>
Have you got instructions for trying this out with a Yubikey? What's the additional latency when an SSH agent isn't in use and the initial attempt fails? Could the existing behaviour run if and only if Could the new behaviour run when a flag is passed? Alex |
@jsiebens PTAL also |
|
Looks good to me. In the hashi-up project, the SSH_AUTH_SOCK is used by default, without a fallback but rather displaying an error message when no identities are loaded in the agent. Implementing a fallback like this will not break the existing behaviour of k3sup. Trying the ssh-agent first will solve a couple of issues, like #311 #255 #99 |
What I am trying to say is that if |
Is this still WIP, or does it cover the Join command now? @johnmccabe |
Signed-off-by: John McCabe <[email protected]>
Support for join added, verified with both a simple cluster and a multi-master HA setup. Simple Cluster
Multi-master Cluster
|
Note that I've not attempted to refactor the SSH flows to avoid overloading the PR. There is definitely some scope for tidying the existing structure and reducing the duplication somewhat. |
Just some additional testing to complete here and it should be good. Adding the support for Krypton would be trivial (see #318). |
Signed-off-by: John McCabe <[email protected]>
Tweaked error handing and tested the existing key based behaviour. Install with key
Join with key
|
Thanks for the tweet John. This fell off my radar for some reason. |
|
The release is ready here: https://github.com/alexellis/k3sup/releases/tag/0.11.0 |
Description
This fixes #311.
Attempt to create the ssh connection using a pre-existing ssh-agent first, this will allow users with pre-configured agents, yubikeys etc on Linux and Darwin to establish ssh connections without resorting to private keys.
If this first connection attempt fails we fall through to the existing key based auth flow.
Note that Windows is not supported in this PR as yubikeys do not currently use the ssh-agent.
NOTE this does not include an update to the join command or docs pending an OK on the install implementation.
Motivation and Context
How Has This Been Tested?
Types of changes
Checklist:
git commit -s