Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add disableSSHCAUser and disableSSHCAHost attributes to GCP provisioner #1305

Merged
merged 5 commits into from
Oct 29, 2024
Merged

Add disableSSHCAUser and disableSSHCAHost attributes to GCP provisioner #1305

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
dfb4907
Add disableSSHCAUser and disableSSHCAHost attributes to GCP provisioner
dopey Oct 28, 2024
93eb7d2
Add --disable-ssh-ca-user and --disable-ssh-ca-host flags ...
dopey Oct 28, 2024
6b13f45
Bump linkedca 0.22.2
dopey Oct 28, 2024
79f96f0
Friendly errors using --disable-ssh-ca-* with Azure or AWS provisioner
dopey Oct 29, 2024
dba3d16
Merge branch 'master' into max/disableSSHCA
dopey Oct 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions command/ca/provisioner/add.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,7 @@ IID (AWS/GCP/Azure)
[**--azure-audience**=<name>] [**--azure-subscription-id**=<id>]
[**--azure-object-id**=<id>] [**--instance-age**=<duration>] [**--iid-roots**=<file>]
[**--disable-custom-sans**] [**--disable-trust-on-first-use**]
[**--disable-ssh-ca-user**] [**--disable-ssh-ca-host**]
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This flag is only supported in GCP right now. Should we split this into two usages or return an "unsupported" error if AWS or Azure is used? Returning an error makes more sense to me because we might want to add this functionality to Azure and AWS, too.

[**--admin-cert**=<file>] [**--admin-key**=<file>]
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
Expand Down Expand Up @@ -172,6 +173,8 @@ SCEP
instanceAgeFlag,
disableCustomSANsFlag,
disableTOFUFlag,
disableSSHCAUserFlag,
disableSSHCAHostFlag,

// Claims
x509TemplateFlag,
Expand Down Expand Up @@ -790,13 +793,29 @@ func createGCPDetails(ctx *cli.Context) (*linkedca.ProvisionerDetails, error) {
return nil, err
}

var (
disableSSHCAUser *bool
disableSSHCAHost *bool
)

if ctx.IsSet("disable-ssh-ca-user") {
boolVal := ctx.Bool("disable-ssh-ca-user")
disableSSHCAUser = &boolVal
}
if ctx.IsSet("disable-ssh-ca-host") {
boolVal := ctx.Bool("disable-ssh-ca-host")
disableSSHCAHost = &boolVal
}

return &linkedca.ProvisionerDetails{
Data: &linkedca.ProvisionerDetails_GCP{
GCP: &linkedca.GCPProvisioner{
ServiceAccounts: ctx.StringSlice("gcp-service-account"),
ProjectIds: ctx.StringSlice("gcp-project"),
DisableCustomSans: ctx.Bool("disable-custom-sans"),
DisableTrustOnFirstUse: ctx.Bool("disable-trust-on-first-use"),
DisableSshCaUser: disableSSHCAUser,
DisableSshCaHost: disableSSHCAHost,
InstanceAge: d,
},
},
Expand Down
10 changes: 10 additions & 0 deletions command/ca/provisioner/provisioner.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -542,6 +542,16 @@ with the same instance will be accepted. By default only the first request
will be accepted.`,
}

disableSSHCAUserFlag = cli.BoolFlag{
Name: "disable-ssh-ca-user",
Usage: `Disable ability to sign SSH user certificates`,
}

disableSSHCAHostFlag = cli.BoolFlag{
Name: "disable-ssh-ca-host",
Usage: `Disable ability to sign SSH host certificates`,
}

// Nebula provisioner flags
nebulaRootFlag = cli.StringFlag{
Name: "nebula-root",
Expand Down
12 changes: 12 additions & 0 deletions command/ca/provisioner/update.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,7 @@ IID (AWS/GCP/Azure)
[**--azure-audience**=<name>] [**--azure-subscription-id**=<id>]
[**--azure-object-id**=<id>] [**--instance-age**=<duration>]
[**--disable-custom-sans**] [**--disable-trust-on-first-use**]
[**--disable-ssh-ca-user**] [**--disable-ssh-ca-host**]
[**--admin-cert**=<file>] [**--admin-key**=<file>]
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
Expand Down Expand Up @@ -176,6 +177,8 @@ SCEP
instanceAgeFlag,
disableCustomSANsFlag,
disableTOFUFlag,
disableSSHCAUserFlag,
disableSSHCAHostFlag,

// Claims
x509TemplateFlag,
Expand Down Expand Up @@ -914,6 +917,14 @@ func updateGCPDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
if ctx.IsSet("disable-trust-on-first-use") {
details.DisableTrustOnFirstUse = ctx.Bool("disable-trust-on-first-use")
}
if ctx.IsSet("disable-ssh-ca-user") {
boolVal := ctx.Bool("disable-ssh-ca-user")
details.DisableSshCaUser = &boolVal
}
if ctx.IsSet("disable-ssh-ca-host") {
boolVal := ctx.Bool("disable-ssh-ca-host")
details.DisableSshCaHost = &boolVal
}
if ctx.IsSet("remove-gcp-service-account") {
details.ServiceAccounts = removeElements(details.ServiceAccounts, ctx.StringSlice("remove-gcp-service-account"))
}
Expand All @@ -926,6 +937,7 @@ func updateGCPDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
if ctx.IsSet("gcp-project") {
details.ProjectIds = append(details.ProjectIds, ctx.StringSlice("gcp-project")...)
}

return nil
}

Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ require (
github.com/urfave/cli v1.22.16
go.mozilla.org/pkcs7 v0.9.0
go.step.sm/crypto v0.54.0
go.step.sm/linkedca v0.22.1
go.step.sm/linkedca v0.22.2
golang.org/x/crypto v0.28.0
golang.org/x/sys v0.26.0
golang.org/x/term v0.25.0
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -391,8 +391,8 @@ go.step.sm/cli-utils v0.9.0 h1:55jYcsQbnArNqepZyAwcato6Zy2MoZDRkWW+jF+aPfQ=
go.step.sm/cli-utils v0.9.0/go.mod h1:Y/CRoWl1FVR9j+7PnAewufAwKmBOTzR6l9+7EYGAnp8=
go.step.sm/crypto v0.54.0 h1:V8p+12Ld0NRA/RBMYoKXA0dWmVKZSdCwP56IwzweT9g=
go.step.sm/crypto v0.54.0/go.mod h1:vQJyTngfZDW+UyZdFzOMCY/txWDAmcwViEUC7Gn4YfU=
go.step.sm/linkedca v0.22.1 h1:GvprpH9P4Sv9U+eZ3bxDgRSSpW14cFDYpe1kS6yWLkw=
go.step.sm/linkedca v0.22.1/go.mod h1:dOKdF4HSn73YUEkfS5/FECngZmBtj2Il5DTKWXY4S6Y=
go.step.sm/linkedca v0.22.2 h1:zmFIyDC77gFHo6FLQJ8OIXYpLYDIsgDWaYqtYs6A9/Q=
go.step.sm/linkedca v0.22.2/go.mod h1:ESY8r5VfhJA8ZVzI6hXIQcEX9LwaY3aoPnT+Hb9jpbw=
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
Expand Down