root / doc / design-ssh-setup.rst @ ded769c1
History | View | Annotate | Download (3 kB)
1 | f98efa98 | Michael Hanselmann | Design for setting up SSH |
---|---|---|---|
2 | f98efa98 | Michael Hanselmann | ===================================== |
3 | f98efa98 | Michael Hanselmann | |
4 | f98efa98 | Michael Hanselmann | .. contents:: :depth: 3 |
5 | f98efa98 | Michael Hanselmann | |
6 | f98efa98 | Michael Hanselmann | |
7 | f98efa98 | Michael Hanselmann | Current state and shortcomings |
8 | f98efa98 | Michael Hanselmann | ------------------------------ |
9 | f98efa98 | Michael Hanselmann | |
10 | f98efa98 | Michael Hanselmann | Before a node can be added to a cluster, its SSH daemon must be |
11 | f98efa98 | Michael Hanselmann | re-configured to use the cluster-wide SSH host key. Ganeti 2.3.0 changed |
12 | f98efa98 | Michael Hanselmann | the way this is done by moving all related code to a separate script, |
13 | f98efa98 | Michael Hanselmann | ``tools/setup-ssh``, using Paramiko. Before all such configuration was |
14 | f98efa98 | Michael Hanselmann | done from ``lib/bootstrap.py`` using the system's own SSH client and a |
15 | f98efa98 | Michael Hanselmann | shell script given to said client through parameters. |
16 | f98efa98 | Michael Hanselmann | |
17 | f98efa98 | Michael Hanselmann | Both solutions controlled all actions on the connecting machine; the |
18 | f98efa98 | Michael Hanselmann | newly added node was merely executing commands. This implies and |
19 | f98efa98 | Michael Hanselmann | requires a tight coupling and equality between nodes (e.g. paths to |
20 | f98efa98 | Michael Hanselmann | files being the same). Most of the logic and error handling is also done |
21 | f98efa98 | Michael Hanselmann | on the connecting machine. |
22 | f98efa98 | Michael Hanselmann | |
23 | f98efa98 | Michael Hanselmann | |
24 | f98efa98 | Michael Hanselmann | Proposed changes |
25 | f98efa98 | Michael Hanselmann | ---------------- |
26 | f98efa98 | Michael Hanselmann | |
27 | f98efa98 | Michael Hanselmann | The main goal is to move more logic to the newly added node. Instead of |
28 | f98efa98 | Michael Hanselmann | having a relatively large script executed on the master node, most of it |
29 | f98efa98 | Michael Hanselmann | is moved over to the added node. |
30 | f98efa98 | Michael Hanselmann | |
31 | f98efa98 | Michael Hanselmann | A new script named ``prepare-node-join`` is added. It receives a JSON |
32 | f98efa98 | Michael Hanselmann | data structure (defined :ref:`below <prepare-node-join-json>`) on its |
33 | f98efa98 | Michael Hanselmann | standard input. Once the data has been successfully decoded, it proceeds |
34 | f4afc16e | Michael Hanselmann | to configure the local node's SSH daemon and root's SSH settings, after |
35 | f4afc16e | Michael Hanselmann | which the SSH daemon is restarted. |
36 | f98efa98 | Michael Hanselmann | |
37 | f98efa98 | Michael Hanselmann | All the master node has to do to add a new node is to gather all |
38 | f98efa98 | Michael Hanselmann | required data, build the data structure, and invoke the script on the |
39 | f98efa98 | Michael Hanselmann | node to be added. This will enable us to once again use the system's own |
40 | f98efa98 | Michael Hanselmann | SSH client and to drop the dependency on Paramiko for Ganeti itself |
41 | f98efa98 | Michael Hanselmann | (``ganeti-listrunner`` is going to continue using Paramiko). |
42 | f98efa98 | Michael Hanselmann | |
43 | f98efa98 | Michael Hanselmann | Eventually ``setup-ssh`` can be removed. |
44 | f98efa98 | Michael Hanselmann | |
45 | f98efa98 | Michael Hanselmann | .. _prepare-node-join-json: |
46 | f98efa98 | Michael Hanselmann | |
47 | f98efa98 | Michael Hanselmann | JSON structure |
48 | f98efa98 | Michael Hanselmann | ~~~~~~~~~~~~~~ |
49 | f98efa98 | Michael Hanselmann | |
50 | f4afc16e | Michael Hanselmann | The data is given in an object containing the keys described below. |
51 | f4afc16e | Michael Hanselmann | Unless specified otherwise, all entries are optional. |
52 | f98efa98 | Michael Hanselmann | |
53 | f4afc16e | Michael Hanselmann | ``cluster_name`` |
54 | f4afc16e | Michael Hanselmann | Required string with the cluster name. If a local cluster name is |
55 | f4afc16e | Michael Hanselmann | found, the join process is aborted unless the passed cluster name |
56 | f4afc16e | Michael Hanselmann | matches the local name. |
57 | f4afc16e | Michael Hanselmann | ``node_daemon_certificate`` |
58 | f4afc16e | Michael Hanselmann | Public part of cluster's node daemon certificate in PEM format. If a |
59 | f4afc16e | Michael Hanselmann | local node certificate and key is found, the join process is aborted |
60 | f4afc16e | Michael Hanselmann | unless this passed public part can be verified with the local key. |
61 | f98efa98 | Michael Hanselmann | ``ssh_host_key`` |
62 | f98efa98 | Michael Hanselmann | List containing public and private parts of SSH host key. See below |
63 | f98efa98 | Michael Hanselmann | for definition. |
64 | f98efa98 | Michael Hanselmann | ``ssh_root_key`` |
65 | f98efa98 | Michael Hanselmann | List containing public and private parts of root's key for SSH |
66 | f98efa98 | Michael Hanselmann | authorization. See below for definition. |
67 | f98efa98 | Michael Hanselmann | |
68 | f98efa98 | Michael Hanselmann | Lists of SSH keys use a tuple with three values. The first describes the |
69 | f98efa98 | Michael Hanselmann | key variant (``rsa`` or ``dsa``). The second and third are the public |
70 | f98efa98 | Michael Hanselmann | and private part of the key. Example: |
71 | f98efa98 | Michael Hanselmann | |
72 | f98efa98 | Michael Hanselmann | .. highlight:: javascript |
73 | f98efa98 | Michael Hanselmann | |
74 | f98efa98 | Michael Hanselmann | :: |
75 | f98efa98 | Michael Hanselmann | |
76 | f98efa98 | Michael Hanselmann | [ |
77 | f98efa98 | Michael Hanselmann | ("rsa", "AAAA...", "-----BEGIN RSA PRIVATE KEY-----..."), |
78 | f98efa98 | Michael Hanselmann | ("dsa", "AAAA...", "-----BEGIN DSA PRIVATE KEY-----..."), |
79 | f98efa98 | Michael Hanselmann | ] |
80 | f98efa98 | Michael Hanselmann | |
81 | f98efa98 | Michael Hanselmann | .. vim: set textwidth=72 : |
82 | f98efa98 | Michael Hanselmann | .. Local Variables: |
83 | f98efa98 | Michael Hanselmann | .. mode: rst |
84 | f98efa98 | Michael Hanselmann | .. fill-column: 72 |
85 | f98efa98 | Michael Hanselmann | .. End: |