Config Drift Monitor should alert on unexpected SSH key changes

[cheesesashimi]

- What I did

The Config Drift Monitor should listen for mutations to the SSH key files. Additionally, in the case of RHCOS 8 -> RHCOS 9, it should alert if an SSH key was written to the old path.

- How to verify it

1. Run the Config Drift Monitor unit test suite.
2. Launch a cluster and mutate the SSH key file (/home/core/.ssh/authorized_keys for RHCOS 8, /home/core/.ssh/authorized_keys.d/ignition for RHCOS 9). The node should drift.
3. Put an SSH key in the incorrect place.

- Description for the changelog
Config Drift Monitor watches for mutations to SSH key files

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cheesesashimi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [cheesesashimi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sinnykumari]

@cheesesashimi Looks like this will also solve, https://issues.redhat.com/browse/MCO-435. Does that sounds correct?

[cheesesashimi]

@cheesesashimi Looks like this will also solve, https://issues.redhat.com/browse/MCO-435. Does that sounds correct?

Yes, this should fix that one as well.

[cheesesashimi]

/test unit
/test verify
/test e2e-gcp-op
/test e2e-gcp-op-single-node

[cheesesashimi]

/test unit
/test verify

[cheesesashimi]

/test unit
/test verify

[cheesesashimi]

/test unit
/test verify

[cheesesashimi]

/test unit
/test verify
/test e2e-gcp-op

[cheesesashimi]

/test unit
/test verify
/test e2e-gcp-op

[cheesesashimi]

/test unit
/test verify
/test e2e-gcp-op

[cheesesashimi]

/test unit
/test verify
/test e2e-gcp-op

[cheesesashimi]

/test unit
/test verify
/test e2e-gcp-op

[openshift-merge-robot]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[cheesesashimi]

I plan to pare this PR down in both scope and complexity by breaking up the refactoring into separate PRs so that this can be focused solely on what's needed to make Config Drift Monitor aware of SSH keys.

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[openshift-bot]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

[openshift-ci]

@cheesesashimi: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-op-single-node	0dbd157ebf9193e0c483885e825ee2780db53c1e	link	false	/test e2e-gcp-op-single-node
ci/prow/e2e-gcp-op	06263b4	link	true	/test e2e-gcp-op
ci/prow/e2e-hypershift	06263b4	link	true	/test e2e-hypershift

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[openshift-bot]

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

[openshift-ci]

@openshift-bot: Closed this PR.

Details

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.