Skip to content

Commit

Permalink
Add disableSSHCAUser and disableSSHCAHost attributes to GCP provision…
Browse files Browse the repository at this point in the history 
…er (#1305)

* Add disableSSHCAUser and disableSSHCAHost attributes to GCP provisioner
  • Loading branch information
@dopey
dopey authored Oct 29, 2024
1 parent 4dfc345 commit ebeca4f
Show file tree
Hide file tree
Showing 5 changed files with 72 additions and 3 deletions.
33 changes: 33 additions & 0 deletions command/ca/provisioner/add.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,7 @@ IID (AWS/GCP/Azure)
[**--azure-audience**=<name>] [**--azure-subscription-id**=<id>]
[**--azure-object-id**=<id>] [**--instance-age**=<duration>] [**--iid-roots**=<file>]
[**--disable-custom-sans**] [**--disable-trust-on-first-use**]
[**--disable-ssh-ca-user**] [**--disable-ssh-ca-host**]
[**--admin-cert**=<file>] [**--admin-key**=<file>]
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
Expand Down Expand Up @@ -172,6 +173,8 @@ SCEP
instanceAgeFlag,
disableCustomSANsFlag,
disableTOFUFlag,
disableSSHCAUserFlag,
disableSSHCAHostFlag,

// Claims
x509TemplateFlag,
Expand Down Expand Up @@ -744,6 +747,13 @@ func createOIDCDetails(ctx *cli.Context) (*linkedca.ProvisionerDetails, error) {
}

func createAWSDetails(ctx *cli.Context) (*linkedca.ProvisionerDetails, error) {
if ctx.IsSet("disable-ssh-ca-user") {
return nil, errors.New("flag disable-ssh-ca-user is not supported for AWS IID provisioners")
}
if ctx.IsSet("disable-ssh-ca-host") {
return nil, errors.New("flag disable-ssh-ca-host is not supported for AWS IID provisioners")
}

d, err := parseInstanceAge(ctx)
if err != nil {
return nil, err
Expand All @@ -764,6 +774,13 @@ func createAWSDetails(ctx *cli.Context) (*linkedca.ProvisionerDetails, error) {
}

func createAzureDetails(ctx *cli.Context) (*linkedca.ProvisionerDetails, error) {
if ctx.IsSet("disable-ssh-ca-user") {
return nil, errors.New("flag disable-ssh-ca-user is not supported for Azure IID provisioners")
}
if ctx.IsSet("disable-ssh-ca-host") {
return nil, errors.New("flag disable-ssh-ca-host is not supported for Azure IID provisioners")
}

tenantID := ctx.String("azure-tenant")
if tenantID == "" {
return nil, errs.RequiredWithFlagValue(ctx, "type", ctx.String("type"), "azure-tenant")
Expand All @@ -790,13 +807,29 @@ func createGCPDetails(ctx *cli.Context) (*linkedca.ProvisionerDetails, error) {
return nil, err
}

var (
disableSSHCAUser *bool
disableSSHCAHost *bool
)

if ctx.IsSet("disable-ssh-ca-user") {
boolVal := ctx.Bool("disable-ssh-ca-user")
disableSSHCAUser = &boolVal
}
if ctx.IsSet("disable-ssh-ca-host") {
boolVal := ctx.Bool("disable-ssh-ca-host")
disableSSHCAHost = &boolVal
}

return &linkedca.ProvisionerDetails{
Data: &linkedca.ProvisionerDetails_GCP{
GCP: &linkedca.GCPProvisioner{
ServiceAccounts: ctx.StringSlice("gcp-service-account"),
ProjectIds: ctx.StringSlice("gcp-project"),
DisableCustomSans: ctx.Bool("disable-custom-sans"),
DisableTrustOnFirstUse: ctx.Bool("disable-trust-on-first-use"),
DisableSshCaUser: disableSSHCAUser,
DisableSshCaHost: disableSSHCAHost,
InstanceAge: d,
},
},
Expand Down
10 changes: 10 additions & 0 deletions command/ca/provisioner/provisioner.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -542,6 +542,16 @@ with the same instance will be accepted. By default only the first request
will be accepted.`,
}

disableSSHCAUserFlag = cli.BoolFlag{
Name: "disable-ssh-ca-user",
Usage: `Disable ability to sign SSH user certificates`,
}

disableSSHCAHostFlag = cli.BoolFlag{
Name: "disable-ssh-ca-host",
Usage: `Disable ability to sign SSH host certificates`,
}

// Nebula provisioner flags
nebulaRootFlag = cli.StringFlag{
Name: "nebula-root",
Expand Down
26 changes: 26 additions & 0 deletions command/ca/provisioner/update.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,7 @@ IID (AWS/GCP/Azure)
[**--azure-audience**=<name>] [**--azure-subscription-id**=<id>]
[**--azure-object-id**=<id>] [**--instance-age**=<duration>]
[**--disable-custom-sans**] [**--disable-trust-on-first-use**]
[**--disable-ssh-ca-user**] [**--disable-ssh-ca-host**]
[**--admin-cert**=<file>] [**--admin-key**=<file>]
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
Expand Down Expand Up @@ -176,6 +177,8 @@ SCEP
instanceAgeFlag,
disableCustomSANsFlag,
disableTOFUFlag,
disableSSHCAUserFlag,
disableSSHCAHostFlag,

// Claims
x509TemplateFlag,
Expand Down Expand Up @@ -826,6 +829,13 @@ func updateOIDCDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
}

func updateAWSDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
if ctx.IsSet("disable-ssh-ca-user") {
return errors.New("flag disable-ssh-ca-user is not supported for AWS IID provisioners")
}
if ctx.IsSet("disable-ssh-ca-host") {
return errors.New("flag disable-ssh-ca-host is not supported for AWS IID provisioners")
}

data, ok := p.Details.GetData().(*linkedca.ProvisionerDetails_AWS)
if !ok {
return errors.New("error casting details to AWS type")
Expand Down Expand Up @@ -855,6 +865,13 @@ func updateAWSDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
}

func updateAzureDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
if ctx.IsSet("disable-ssh-ca-user") {
return errors.New("flag disable-ssh-ca-user is not supported for Azure IID provisioners")
}
if ctx.IsSet("disable-ssh-ca-host") {
return errors.New("flag disable-ssh-ca-host is not supported for Azure IID provisioners")
}

data, ok := p.Details.GetData().(*linkedca.ProvisionerDetails_Azure)
if !ok {
return errors.New("error casting details to Azure type")
Expand Down Expand Up @@ -914,6 +931,14 @@ func updateGCPDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
if ctx.IsSet("disable-trust-on-first-use") {
details.DisableTrustOnFirstUse = ctx.Bool("disable-trust-on-first-use")
}
if ctx.IsSet("disable-ssh-ca-user") {
boolVal := ctx.Bool("disable-ssh-ca-user")
details.DisableSshCaUser = &boolVal
}
if ctx.IsSet("disable-ssh-ca-host") {
boolVal := ctx.Bool("disable-ssh-ca-host")
details.DisableSshCaHost = &boolVal
}
if ctx.IsSet("remove-gcp-service-account") {
details.ServiceAccounts = removeElements(details.ServiceAccounts, ctx.StringSlice("remove-gcp-service-account"))
}
Expand All @@ -926,6 +951,7 @@ func updateGCPDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
if ctx.IsSet("gcp-project") {
details.ProjectIds = append(details.ProjectIds, ctx.StringSlice("gcp-project")...)
}

return nil
}

Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ require (
github.com/urfave/cli v1.22.16
go.mozilla.org/pkcs7 v0.9.0
go.step.sm/crypto v0.54.0
go.step.sm/linkedca v0.22.1
go.step.sm/linkedca v0.22.2
golang.org/x/crypto v0.28.0
golang.org/x/sys v0.26.0
golang.org/x/term v0.25.0
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Original file line number Diff line number Diff line change
Expand Up @@ -391,8 +391,8 @@ go.step.sm/cli-utils v0.9.0 h1:55jYcsQbnArNqepZyAwcato6Zy2MoZDRkWW+jF+aPfQ=
go.step.sm/cli-utils v0.9.0/go.mod h1:Y/CRoWl1FVR9j+7PnAewufAwKmBOTzR6l9+7EYGAnp8=
go.step.sm/crypto v0.54.0 h1:V8p+12Ld0NRA/RBMYoKXA0dWmVKZSdCwP56IwzweT9g=
go.step.sm/crypto v0.54.0/go.mod h1:vQJyTngfZDW+UyZdFzOMCY/txWDAmcwViEUC7Gn4YfU=
go.step.sm/linkedca v0.22.1 h1:GvprpH9P4Sv9U+eZ3bxDgRSSpW14cFDYpe1kS6yWLkw=
go.step.sm/linkedca v0.22.1/go.mod h1:dOKdF4HSn73YUEkfS5/FECngZmBtj2Il5DTKWXY4S6Y=
go.step.sm/linkedca v0.22.2 h1:zmFIyDC77gFHo6FLQJ8OIXYpLYDIsgDWaYqtYs6A9/Q=
go.step.sm/linkedca v0.22.2/go.mod h1:ESY8r5VfhJA8ZVzI6hXIQcEX9LwaY3aoPnT+Hb9jpbw=
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
Expand Down

0 comments on commit ebeca4f

Please sign in to comment.