SSH known_hosts config

Fetch the host public keys from each node, combine them all and write to the
system-wide ssh known hosts. The alternative of disabling host key
 verification is vulnerable to a MITM attack.

Change-Id: Ib572b5910720b1991812256e68c975f7fbe2239c
(cherry picked from commit 7d3552a105ad5aa62cad0998c11df5ec6bd06ed6)

6 files changed, 223 insertions, 1 deletions

diff --git a/puppet/blockstorage-role.yaml b/puppet/blockstorage-role.yaml
index 51f9abac..16fb4b90 100644
--- a/puppet/blockstorage-role.yaml
+++ b/puppet/blockstorage-role.yaml
@@ -457,6 +457,12 @@ resources:
         update_identifier:
           get_param: UpdateIdentifier
 
+  SshHostPubKey:
+    type: OS::TripleO::Ssh::HostPubKey
+    depends_on: BlockStorageDeployment
+    properties:
+        server: {get_resource: BlockStorage}
+
 outputs:
   ip_address:
     description: IP address of the server in the ctlplane network
@@ -504,6 +510,37 @@ outputs:
           MANAGEMENTHOST: {get_attr: [NetHostMap, value, management, short]}
           CTLPLANEIP: {get_attr: [BlockStorage, networks, ctlplane, 0]}
           CTLPLANEHOST: {get_attr: [NetHostMap, value, ctlplane, short]}
+  known_hosts_entry:
+    description: Entry for ssh known hosts
+    value:
+      str_replace:
+        template: "PRIMARYIP,PRIMARYHOST.DOMAIN,PRIMARYHOST,\
+EXTERNALIP,EXTERNALHOST.DOMAIN,EXTERNALHOST,\
+INTERNAL_APIIP,INTERNAL_APIHOST.DOMAIN,INTERNAL_APIHOST,\
+STORAGEIP,STORAGEHOST.DOMAIN,STORAGEHOST,\
+STORAGE_MGMTIP,STORAGE_MGMTHOST.DOMAIN,STORAGE_MGMTHOST,\
+TENANTIP,TENANTHOST.DOMAIN,TENANTHOST,\
+MANAGEMENTIP,MANAGEMENTHOST.DOMAIN,MANAGEMENTHOST,\
+CTLPLANEIP,CTLPLANEHOST.DOMAIN,CTLPLANEHOST HOSTSSHPUBKEY"
+        params:
+          PRIMARYIP: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, BlockStorageHostnameResolveNetwork]}]}
+          DOMAIN: {get_param: CloudDomain}
+          PRIMARYHOST: {get_attr: [BlockStorage, name]}
+          EXTERNALIP: {get_attr: [ExternalPort, ip_address]}
+          EXTERNALHOST: {get_attr: [NetHostMap, value, external, short]}
+          INTERNAL_APIIP: {get_attr: [InternalApiPort, ip_address]}
+          INTERNAL_APIHOST: {get_attr: [NetHostMap, value, internal_api, short]}
+          STORAGEIP: {get_attr: [StoragePort, ip_address]}
+          STORAGEHOST: {get_attr: [NetHostMap, value, storage, short]}
+          STORAGE_MGMTIP: {get_attr: [StorageMgmtPort, ip_address]}
+          STORAGE_MGMTHOST: {get_attr: [NetHostMap, value, storage_mgmt, short]}
+          TENANTIP: {get_attr: [TenantPort, ip_address]}
+          TENANTHOST: {get_attr: [NetHostMap, value, tenant, short]}
+          MANAGEMENTIP: {get_attr: [ManagementPort, ip_address]}
+          MANAGEMENTHOST: {get_attr: [NetHostMap, value, management, short]}
+          CTLPLANEIP: {get_attr: [BlockStorage, networks, ctlplane, 0]}
+          CTLPLANEHOST: {get_attr: [NetHostMap, value, ctlplane, short]}
+          HOSTSSHPUBKEY: {get_attr: [SshHostPubKey, ecdsa]}
   nova_server_resource:
     description: Heat resource handle for the block storage server
     value:
diff --git a/puppet/cephstorage-role.yaml b/puppet/cephstorage-role.yaml
index d7d7f478..4b022452 100644
--- a/puppet/cephstorage-role.yaml
+++ b/puppet/cephstorage-role.yaml
@@ -468,6 +468,12 @@ resources:
         update_identifier:
           get_param: UpdateIdentifier
 
+  SshHostPubKey:
+    type: OS::TripleO::Ssh::HostPubKey
+    depends_on: CephStorageDeployment
+    properties:
+        server: {get_resource: CephStorage}
+
 outputs:
   ip_address:
     description: IP address of the server in the ctlplane network
@@ -515,6 +521,37 @@ outputs:
           MANAGEMENTHOST: {get_attr: [NetHostMap, value, management, short]}
           CTLPLANEIP: {get_attr: [CephStorage, networks, ctlplane, 0]}
           CTLPLANEHOST: {get_attr: [NetHostMap, value, ctlplane, short]}
+  known_hosts_entry:
+    description: Entry for ssh known hosts
+    value:
+      str_replace:
+        template: "PRIMARYIP,PRIMARYHOST.DOMAIN,PRIMARYHOST,\
+EXTERNALIP,EXTERNALHOST.DOMAIN,EXTERNALHOST,\
+INTERNAL_APIIP,INTERNAL_APIHOST.DOMAIN,INTERNAL_APIHOST,\
+STORAGEIP,STORAGEHOST.DOMAIN,STORAGEHOST,\
+STORAGE_MGMTIP,STORAGE_MGMTHOST.DOMAIN,STORAGE_MGMTHOST,\
+TENANTIP,TENANTHOST.DOMAIN,TENANTHOST,\
+MANAGEMENTIP,MANAGEMENTHOST.DOMAIN,MANAGEMENTHOST,\
+CTLPLANEIP,CTLPLANEHOST.DOMAIN,CTLPLANEHOST HOSTSSHPUBKEY"
+        params:
+          PRIMARYIP: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, CephStorageHostnameResolveNetwork]}]}
+          DOMAIN: {get_param: CloudDomain}
+          PRIMARYHOST: {get_attr: [CephStorage, name]}
+          EXTERNALIP: {get_attr: [ExternalPort, ip_address]}
+          EXTERNALHOST: {get_attr: [NetHostMap, value, external, short]}
+          INTERNAL_APIIP: {get_attr: [InternalApiPort, ip_address]}
+          INTERNAL_APIHOST: {get_attr: [NetHostMap, value, internal_api, short]}
+          STORAGEIP: {get_attr: [StoragePort, ip_address]}
+          STORAGEHOST: {get_attr: [NetHostMap, value, storage, short]}
+          STORAGE_MGMTIP: {get_attr: [StorageMgmtPort, ip_address]}
+          STORAGE_MGMTHOST: {get_attr: [NetHostMap, value, storage_mgmt, short]}
+          TENANTIP: {get_attr: [TenantPort, ip_address]}
+          TENANTHOST: {get_attr: [NetHostMap, value, tenant, short]}
+          MANAGEMENTIP: {get_attr: [ManagementPort, ip_address]}
+          MANAGEMENTHOST: {get_attr: [NetHostMap, value, management, short]}
+          CTLPLANEIP: {get_attr: [CephStorage, networks, ctlplane, 0]}
+          CTLPLANEHOST: {get_attr: [NetHostMap, value, ctlplane, short]}
+          HOSTSSHPUBKEY: {get_attr: [SshHostPubKey, ecdsa]}
   nova_server_resource:
     description: Heat resource handle for the ceph storage server
     value:
diff --git a/puppet/compute-role.yaml b/puppet/compute-role.yaml
index ebdd762d..37331f37 100644
--- a/puppet/compute-role.yaml
+++ b/puppet/compute-role.yaml
@@ -492,6 +492,12 @@ resources:
         update_identifier:
           get_param: UpdateIdentifier
 
+  SshHostPubKey:
+    type: OS::TripleO::Ssh::HostPubKey
+    depends_on: NovaComputeDeployment
+    properties:
+        server: {get_resource: NovaCompute}
+
 outputs:
   ip_address:
     description: IP address of the server in the ctlplane network
@@ -559,7 +565,38 @@ outputs:
           MANAGEMENTHOST: {get_attr: [NetHostMap, value, management, short]}
           CTLPLANEIP: {get_attr: [NovaCompute, networks, ctlplane, 0]}
           CTLPLANEHOST: {get_attr: [NetHostMap, value, ctlplane, short]}
+  known_hosts_entry:
+    description: Entry for ssh known hosts
+    value:
+      str_replace:
+        template: "PRIMARYIP,PRIMARYHOST.DOMAIN,PRIMARYHOST,\
+EXTERNALIP,EXTERNALHOST.DOMAIN,EXTERNALHOST,\
+INTERNAL_APIIP,INTERNAL_APIHOST.DOMAIN,INTERNAL_APIHOST,\
+STORAGEIP,STORAGEHOST.DOMAIN,STORAGEHOST,\
+STORAGE_MGMTIP,STORAGE_MGMTHOST.DOMAIN,STORAGE_MGMTHOST,\
+TENANTIP,TENANTHOST.DOMAIN,TENANTHOST,\
+MANAGEMENTIP,MANAGEMENTHOST.DOMAIN,MANAGEMENTHOST,\
+CTLPLANEIP,CTLPLANEHOST.DOMAIN,CTLPLANEHOST HOSTSSHPUBKEY"
+        params:
+          PRIMARYIP: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, ComputeHostnameResolveNetwork]}]}
+          DOMAIN: {get_param: CloudDomain}
+          PRIMARYHOST: {get_attr: [NovaCompute, name]}
+          EXTERNALIP: {get_attr: [ExternalPort, ip_address]}
+          EXTERNALHOST: {get_attr: [NetHostMap, value, external, short]}
+          INTERNAL_APIIP: {get_attr: [InternalApiPort, ip_address]}
+          INTERNAL_APIHOST: {get_attr: [NetHostMap, value, internal_api, short]}
+          STORAGEIP: {get_attr: [StoragePort, ip_address]}
+          STORAGEHOST: {get_attr: [NetHostMap, value, storage, short]}
+          STORAGE_MGMTIP: {get_attr: [StorageMgmtPort, ip_address]}
+          STORAGE_MGMTHOST: {get_attr: [NetHostMap, value, storage_mgmt, short]}
+          TENANTIP: {get_attr: [TenantPort, ip_address]}
+          TENANTHOST: {get_attr: [NetHostMap, value, tenant, short]}
+          MANAGEMENTIP: {get_attr: [ManagementPort, ip_address]}
+          MANAGEMENTHOST: {get_attr: [NetHostMap, value, management, short]}
+          CTLPLANEIP: {get_attr: [NovaCompute, networks, ctlplane, 0]}
+          CTLPLANEHOST: {get_attr: [NetHostMap, value, ctlplane, short]}
+          HOSTSSHPUBKEY: {get_attr: [SshHostPubKey, ecdsa]}
   nova_server_resource:
     description: Heat resource handle for the Nova compute server
     value:
-      {get_resource: NovaCompute}
+      {get_resource: NovaCompute}
\ No newline at end of file
diff --git a/puppet/controller-role.yaml b/puppet/controller-role.yaml
index 2f4f583c..4099a3aa 100644
--- a/puppet/controller-role.yaml
+++ b/puppet/controller-role.yaml
@@ -532,6 +532,12 @@ resources:
         update_identifier:
           get_param: UpdateIdentifier
 
+  SshHostPubKey:
+    type: OS::TripleO::Ssh::HostPubKey
+    depends_on: ControllerDeployment
+    properties:
+        server: {get_resource: Controller}
+
 outputs:
   ip_address:
     description: IP address of the server in the ctlplane network
@@ -599,6 +605,37 @@ outputs:
           MANAGEMENTHOST: {get_attr: [NetHostMap, value, management, short]}
           CTLPLANEIP: {get_attr: [Controller, networks, ctlplane, 0]}
           CTLPLANEHOST: {get_attr: [NetHostMap, value, ctlplane, short]}
+  known_hosts_entry:
+    description: Entry for ssh known hosts
+    value:
+      str_replace:
+        template: "PRIMARYIP,PRIMARYHOST.DOMAIN,PRIMARYHOST,\
+EXTERNALIP,EXTERNALHOST.DOMAIN,EXTERNALHOST,\
+INTERNAL_APIIP,INTERNAL_APIHOST.DOMAIN,INTERNAL_APIHOST,\
+STORAGEIP,STORAGEHOST.DOMAIN,STORAGEHOST,\
+STORAGE_MGMTIP,STORAGE_MGMTHOST.DOMAIN,STORAGE_MGMTHOST,\
+TENANTIP,TENANTHOST.DOMAIN,TENANTHOST,\
+MANAGEMENTIP,MANAGEMENTHOST.DOMAIN,MANAGEMENTHOST,\
+CTLPLANEIP,CTLPLANEHOST.DOMAIN,CTLPLANEHOST HOSTSSHPUBKEY"
+        params:
+          PRIMARYIP: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, ControllerHostnameResolveNetwork]}]}
+          DOMAIN: {get_param: CloudDomain}
+          PRIMARYHOST: {get_attr: [Controller, name]}
+          EXTERNALIP: {get_attr: [ExternalPort, ip_address]}
+          EXTERNALHOST: {get_attr: [NetHostMap, value, external, short]}
+          INTERNAL_APIIP: {get_attr: [InternalApiPort, ip_address]}
+          INTERNAL_APIHOST: {get_attr: [NetHostMap, value, internal_api, short]}
+          STORAGEIP: {get_attr: [StoragePort, ip_address]}
+          STORAGEHOST: {get_attr: [NetHostMap, value, storage, short]}
+          STORAGE_MGMTIP: {get_attr: [StorageMgmtPort, ip_address]}
+          STORAGE_MGMTHOST: {get_attr: [NetHostMap, value, storage_mgmt, short]}
+          TENANTIP: {get_attr: [TenantPort, ip_address]}
+          TENANTHOST: {get_attr: [NetHostMap, value, tenant, short]}
+          MANAGEMENTIP: {get_attr: [ManagementPort, ip_address]}
+          MANAGEMENTHOST: {get_attr: [NetHostMap, value, management, short]}
+          CTLPLANEIP: {get_attr: [Controller, networks, ctlplane, 0]}
+          CTLPLANEHOST: {get_attr: [NetHostMap, value, ctlplane, short]}
+          HOSTSSHPUBKEY: {get_attr: [SshHostPubKey, ecdsa]}
   nova_server_resource:
     description: Heat resource handle for the Nova compute server
     value:
diff --git a/puppet/objectstorage-role.yaml b/puppet/objectstorage-role.yaml
index 6ee06d78..a329d13f 100644
--- a/puppet/objectstorage-role.yaml
+++ b/puppet/objectstorage-role.yaml
@@ -455,6 +455,12 @@ resources:
         update_identifier:
           get_param: UpdateIdentifier
 
+  SshHostPubKey:
+    type: OS::TripleO::Ssh::HostPubKey
+    depends_on: SwiftStorageHieraDeploy
+    properties:
+        server: {get_resource: SwiftStorage}
+
 outputs:
   ip_address:
     description: IP address of the server in the ctlplane network
@@ -502,6 +508,37 @@ outputs:
           MANAGEMENTHOST: {get_attr: [NetHostMap, value, management, short]}
           CTLPLANEIP: {get_attr: [SwiftStorage, networks, ctlplane, 0]}
           CTLPLANEHOST: {get_attr: [NetHostMap, value, ctlplane, short]}
+  known_hosts_entry:
+    description: Entry for ssh known hosts
+    value:
+      str_replace:
+        template: "PRIMARYIP,PRIMARYHOST.DOMAIN,PRIMARYHOST,\
+EXTERNALIP,EXTERNALHOST.DOMAIN,EXTERNALHOST,\
+INTERNAL_APIIP,INTERNAL_APIHOST.DOMAIN,INTERNAL_APIHOST,\
+STORAGEIP,STORAGEHOST.DOMAIN,STORAGEHOST,\
+STORAGE_MGMTIP,STORAGE_MGMTHOST.DOMAIN,STORAGE_MGMTHOST,\
+TENANTIP,TENANTHOST.DOMAIN,TENANTHOST,\
+MANAGEMENTIP,MANAGEMENTHOST.DOMAIN,MANAGEMENTHOST,\
+CTLPLANEIP,CTLPLANEHOST.DOMAIN,CTLPLANEHOST HOSTSSHPUBKEY"
+        params:
+          PRIMARYIP: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, ObjectStorageHostnameResolveNetwork]}]}
+          DOMAIN: {get_param: CloudDomain}
+          PRIMARYHOST: {get_attr: [SwiftStorage, name]}
+          EXTERNALIP: {get_attr: [ExternalPort, ip_address]}
+          EXTERNALHOST: {get_attr: [NetHostMap, value, external, short]}
+          INTERNAL_APIIP: {get_attr: [InternalApiPort, ip_address]}
+          INTERNAL_APIHOST: {get_attr: [NetHostMap, value, internal_api, short]}
+          STORAGEIP: {get_attr: [StoragePort, ip_address]}
+          STORAGEHOST: {get_attr: [NetHostMap, value, storage, short]}
+          STORAGE_MGMTIP: {get_attr: [StorageMgmtPort, ip_address]}
+          STORAGE_MGMTHOST: {get_attr: [NetHostMap, value, storage_mgmt, short]}
+          TENANTIP: {get_attr: [TenantPort, ip_address]}
+          TENANTHOST: {get_attr: [NetHostMap, value, tenant, short]}
+          MANAGEMENTIP: {get_attr: [ManagementPort, ip_address]}
+          MANAGEMENTHOST: {get_attr: [NetHostMap, value, management, short]}
+          CTLPLANEIP: {get_attr: [SwiftStorage, networks, ctlplane, 0]}
+          CTLPLANEHOST: {get_attr: [NetHostMap, value, ctlplane, short]}
+          HOSTSSHPUBKEY: {get_attr: [SshHostPubKey, ecdsa]}
   nova_server_resource:
     description: Heat resource handle for the swift storage server
     value:
diff --git a/puppet/role.role.j2.yaml b/puppet/role.role.j2.yaml
index 1f68f41f..8f1f3142 100644
--- a/puppet/role.role.j2.yaml
+++ b/puppet/role.role.j2.yaml
@@ -489,6 +489,12 @@ resources:
         update_identifier:
           get_param: UpdateIdentifier
 
+  SshHostPubKey:
+    type: OS::TripleO::Ssh::HostPubKey
+    depends_on: {{role}}Deployment
+    properties:
+        server: {get_resource: {{role}}}
+
 outputs:
   ip_address:
     description: IP address of the server in the ctlplane network
@@ -536,6 +542,37 @@ outputs:
           MANAGEMENTHOST: {get_attr: [NetHostMap, value, management, short]}
           CTLPLANEIP: {get_attr: [{{role}}, networks, ctlplane, 0]}
           CTLPLANEHOST: {get_attr: [NetHostMap, value, ctlplane, short]}
+  known_hosts_entry:
+    description: Entry for ssh known hosts
+    value:
+      str_replace:
+        template: "PRIMARYIP,PRIMARYHOST.DOMAIN,PRIMARYHOST,\
+EXTERNALIP,EXTERNALHOST.DOMAIN,EXTERNALHOST,\
+INTERNAL_APIIP,INTERNAL_APIHOST.DOMAIN,INTERNAL_APIHOST,\
+STORAGEIP,STORAGEHOST.DOMAIN,STORAGEHOST,\
+STORAGE_MGMTIP,STORAGE_MGMTHOST.DOMAIN,STORAGE_MGMTHOST,\
+TENANTIP,TENANTHOST.DOMAIN,TENANTHOST,\
+MANAGEMENTIP,MANAGEMENTHOST.DOMAIN,MANAGEMENTHOST,\
+CTLPLANEIP,CTLPLANEHOST.DOMAIN,CTLPLANEHOST HOSTSSHPUBKEY"
+        params:
+          PRIMARYIP: {get_attr: [NetIpMap, net_ip_map, {get_param: [ServiceNetMap, {{role}}HostnameResolveNetwork]}]}
+          DOMAIN: {get_param: CloudDomain}
+          PRIMARYHOST: {get_attr: [{{role}}, name]}
+          EXTERNALIP: {get_attr: [ExternalPort, ip_address]}
+          EXTERNALHOST: {get_attr: [NetHostMap, value, external, short]}
+          INTERNAL_APIIP: {get_attr: [InternalApiPort, ip_address]}
+          INTERNAL_APIHOST: {get_attr: [NetHostMap, value, internal_api, short]}
+          STORAGEIP: {get_attr: [StoragePort, ip_address]}
+          STORAGEHOST: {get_attr: [NetHostMap, value, storage, short]}
+          STORAGE_MGMTIP: {get_attr: [StorageMgmtPort, ip_address]}
+          STORAGE_MGMTHOST: {get_attr: [NetHostMap, value, storage_mgmt, short]}
+          TENANTIP: {get_attr: [TenantPort, ip_address]}
+          TENANTHOST: {get_attr: [NetHostMap, value, tenant, short]}
+          MANAGEMENTIP: {get_attr: [ManagementPort, ip_address]}
+          MANAGEMENTHOST: {get_attr: [NetHostMap, value, management, short]}
+          CTLPLANEIP: {get_attr: [{{role}}, networks, ctlplane, 0]}
+          CTLPLANEHOST: {get_attr: [NetHostMap, value, ctlplane, short]}
+          HOSTSSHPUBKEY: {get_attr: [SshHostPubKey, ecdsa]}
   nova_server_resource:
     description: Heat resource handle for {{role}} server
     value: