Conversation
|
Depends on: theforeman/smart_proxy_remote_execution_ssh#126 |
adamlazik1
force-pushed
the
ssh-cert-support
branch
5 times, most recently
from
702e256 to
18db7e9
Compare
|
This is now ready for review. |
manifests/plugin/ansible.pp
Outdated
| } | ||
| $known_hosts_file_option = $foreman_proxy::plugin::remote_execution::script::ssh_host_ca_public_key ? { | ||
| undef => '', | ||
| default => "-o UserKnownHostsFile=${foreman_proxy::plugin::remote_execution::script::ssh_identity_dir}/known_hosts -o UserKnownHostsFile=${foreman_proxy::plugin::remote_execution::script::ssh_ca_known_hosts_file}", |
There was a problem hiding this comment.
Same issue as in remote execution. If we have host CA cert available, should we enforce StrictHostKeyChecking?
|
/packit build |
|
@adamlazik1 could you rebase this please on latest master, so that Packit starts working? |
|
No config file for packit (e.g. For more info, please check out the documentation or contact the Packit team. You can also use our CLI command |
adamlazik1
force-pushed
the
ssh-cert-support
branch
from
18db7e9 to
3759635
Compare
|
/packit build |
adamlazik1
force-pushed
the
ssh-cert-support
branch
2 times, most recently
from
f6c78c1 to
5e673ed
Compare
|
Updated ansible ssh args to enforce strict host key checking if host CA is provided. |
|
/packit build |
|
Account lhellebr has no write access nor is author of PR! |
|
/packit build |
adamlazik1
force-pushed
the
ssh-cert-support
branch
from
5e673ed to
3bdd6b6
Compare
|
Switching back to draft since the feature got postponed to 3.16 |
adamlazik1
force-pushed
the
ssh-cert-support
branch
from
3bdd6b6 to
a9906b3
Compare
|
/packit build |
|
Account lhellebr has no write access nor is author of PR! |
|
/packit build |
|
@adamlazik1 could you please rebase and then undraft? |
adamlazik1
force-pushed
the
ssh-cert-support
branch
2 times, most recently
from
b95fb9a to
d614cca
Compare
adamlazik1
force-pushed
the
ssh-cert-support
branch
2 times, most recently
from
8164f9a to
844a7ae
Compare
|
/packit build |
adamlazik1
force-pushed
the
ssh-cert-support
branch
2 times, most recently
from
d7986ca to
b96bcac
Compare
|
/packit build |
|
Account lhellebr has no write access nor is author of PR! |
|
/packit build |
| $ca_keys_content = file($ssh_host_ca_public_keys_file) | ||
| $ca_keys_lines = split($ca_keys_content, "\n").filter |$line| { $line =~ /\S/ } | ||
| $ca_known_hosts_content = $ca_keys_lines.map |$line| { "@cert-authority * ${line}" }.join("\n") |
There was a problem hiding this comment.
personal preference:
Maybe having this as a template would be easier to read?
There was a problem hiding this comment.
I am going to try this out.
There was a problem hiding this comment.
Appears to work in the current form. Is this what you had in mind @adamruzicka?
|
/packit build |
adamlazik1
force-pushed
the
ssh-cert-support
branch
from
4d5a801 to
b39d987
Compare
ekohl
left a comment
ekohl
left a comment
There was a problem hiding this comment.
Debian is failing:
ruby-smart-proxy-dynflow : Depends: ruby-dynflow (< 2.0.0) but 2.0.0-1+debian12 is to be installed
E: Unable to correct problems, you have held broken packages.
theforeman/smart_proxy_dynflow@3434e2a is already released in 1.0.0 but this isn't packaged yet. Since it's a relevant area I'd like to get those packaged up and released so the tests can be green. Other than that the PR looks good.
It's packaged now: |
adamlazik1
force-pushed
the
ssh-cert-support
branch
3 times, most recently
from
985cdab to
2b1d464
Compare
adamlazik1
force-pushed
the
ssh-cert-support
branch
from
2b1d464 to
5f770b5
Compare
|
@ekohl The tests are green again. PR ready for merge ✌️ |
|
5 participants
No description provided.