Fixes #38499 - Introduce SSH cert support

[adamlazik1]

No description provided.

[adamlazik1]

Only drafting stage, depends on:

• Fixes #38478 - Introduce SSH CA certificate support foreman_remote_execution#977
• Refs #38478 - Introduce SSH CA certificate support smart_proxy_remote_execution_ssh#126

[ekohl]

I'm not sure you can always rely on being able to restart services. For example, I'm wondering about cloud-init.

[adamlazik1]

I am not too familiar with cloud-init. Are you referring to the fact that cloud-init may change service configuration or may manipulate with services while it runs? I tried to make the service restart a bit more robust, please tell me if it works or if I need to take some different precautions with regards to cloud-init .

[adamlazik1]

I will keep this in draft because there will be four PRs in total that should get merged at roughly the same time, but I do believe that this is now ready for review.

[adamruzicka]

What would happen if this fired from within cloud-init?

foreman/app/views/unattended/provisioning_templates/cloud_init/cloud_init_default.erb

Line 62 in a3962df

<%= indent(2) { snippet 'remote_execution_ssh_keys' } %>

[adamlazik1]

It took me a while to get my provisioning setup working, but I found out that while the command does not hang and appears to be executed, the sshd service is not restarted. Same thing happens when I do not include the cloud-init line altegether. Currently I am looking into other possible ways to restart the service within cloud-init.

[adamlazik1]

I don't know how I have done it before but after several days of trying different stuff I am unable to replicate cloud-init malfunction which I had before on the current version of the PR. The sshd service is now correctly restarted and ssh certs work out of the box. I see there is only one runcmd in our cloud-init template, so if I am not mistaken, no race conditions should be able to occur, correct?

[adamlazik1]

Currently, this PR does not support configuring cert authentication on hosts that exist before the feature is enabled the smart proxy. Should I create a job template that could do this? It would have to be run before the ssh cert authentication is enabled on smart proxy.

[adamlazik1]

Switching back to draft since the feature got postponed to 3.16

[lhellebr]

I have been able to verify the SSH CA cert feature as a complex of the following 4 PRs:
theforeman/smart_proxy_remote_execution_ssh#126
#10571
theforeman/foreman_remote_execution#977
theforeman/puppet-foreman_proxy#867

Including the following use cases:
SSH REX
Ansible REX
Pull mode REX
Cockpit

Including hosts created by:
Global registration
Provisioning

Including scenarios:
SSH CA on Satellite side
SSH CA on host side
SSH CA on both sides

Both positive scenarios and negative scenarios, that is incorrect CA, incorrect cert, incorrect principal.

=> ACK to this PR

[adamruzicka]

@adamlazik1 does this still need to be a draft?

[adamlazik1]

/packit build