diff options
author | 2017-03-24 14:35:09 +0000 | |
---|---|---|
committer | 2017-04-20 22:16:35 +0000 | |
commit | 68d7196d472b5195c19e871e960996e89a7bcb9c (patch) | |
tree | 83cd2872cf542106ea19a343d1c5217e18287f7d /puppet/controller-role.yaml | |
parent | 33e53fd87784914d010411ec85d040623e4c2617 (diff) |
SSH known_hosts config
Fetch the host public keys from each node, combine them all and write to the
system-wide ssh known hosts. The alternative of disabling host key
verification is vulnerable to a MITM attack.
Change-Id: Ib572b5910720b1991812256e68c975f7fbe2239c
(cherry picked from commit 7d3552a105ad5aa62cad0998c11df5ec6bd06ed6)
Diffstat (limited to 'puppet/controller-role.yaml')
-rw-r--r-- | puppet/controller-role.yaml | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/puppet/controller-role.yaml b/puppet/controller-role.yaml index 2f4f583c..4099a3aa 100644 --- a/puppet/controller-role.yaml +++ b/puppet/controller-role.yaml @@ -532,6 +532,12 @@ resources: update_identifier: get_param: UpdateIdentifier + SshHostPubKey: + type: OS::TripleO::Ssh::HostPubKey + depends_on: ControllerDeployment + properties: + server: {get_resource: Controller} + outputs: ip_address: description: IP address of the server in the ctlplane network @@ -599,6 +605,37 @@ outputs: MANAGEMENTHOST: {get_attr: [NetHostMap, value, management, short]} CTLPLANEIP: {get_attr: [Controller, networks, ctlplane, 0]} CTLPLANEHOST: {get_attr: [NetHostMap, value, ctlplane, short]} + known_hosts_entry: + description: Entry for ssh known hosts + value: + str_replace: + template: "PRIMARYIP,PRIMARYHOST.DOMAIN,PRIMARYHOST,\ +EXTERNALIP,EXTERNALHOST.DOMAIN,EXTERNALHOST,\ +INTERNAL_APIIP,INTERNAL_APIHOST.DOMAIN,INTERNAL_APIHOST,\ +STORAGEIP,STORAGEHOST.DOMAIN,STORAGEHOST,\ +STORAGE_MGMTIP,STORAGE_MGMTHOST.DOMAIN,STORAGE_MGMTHOST,\ +TENANTIP,TENANTHOST.DOMAIN,TENANTHOST,\ +MANAGEMENTIP,MANAGEMENTHOST.DOMAIN,MANAGEMENTHOST,\ +CTLPLANEIP,CTLPLANEHOST.DOMAIN,CTLPLANEHOST HOSTSSHPUBKEY" + params: + PRIMARYIP: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, ControllerHostnameResolveNetwork]}]} + DOMAIN: {get_param: CloudDomain} + PRIMARYHOST: {get_attr: [Controller, name]} + EXTERNALIP: {get_attr: [ExternalPort, ip_address]} + EXTERNALHOST: {get_attr: [NetHostMap, value, external, short]} + INTERNAL_APIIP: {get_attr: [InternalApiPort, ip_address]} + INTERNAL_APIHOST: {get_attr: [NetHostMap, value, internal_api, short]} + STORAGEIP: {get_attr: [StoragePort, ip_address]} + STORAGEHOST: {get_attr: [NetHostMap, value, storage, short]} + STORAGE_MGMTIP: {get_attr: [StorageMgmtPort, ip_address]} + STORAGE_MGMTHOST: {get_attr: [NetHostMap, value, storage_mgmt, short]} + TENANTIP: {get_attr: [TenantPort, ip_address]} + TENANTHOST: {get_attr: [NetHostMap, value, tenant, short]} + MANAGEMENTIP: {get_attr: [ManagementPort, ip_address]} + MANAGEMENTHOST: {get_attr: [NetHostMap, value, management, short]} + CTLPLANEIP: {get_attr: [Controller, networks, ctlplane, 0]} + CTLPLANEHOST: {get_attr: [NetHostMap, value, ctlplane, short]} + HOSTSSHPUBKEY: {get_attr: [SshHostPubKey, ecdsa]} nova_server_resource: description: Heat resource handle for the Nova compute server value: |