From 1049ecd993b53872e6bedac83e927cf17bbe4c9b Mon Sep 17 00:00:00 2001
From: Krish Moodbidri <krish94@uab.edu>
Date: Thu, 14 Nov 2024 15:24:00 -0600
Subject: [PATCH] feat(ssh_host_keys): add role for managing SSH host keys
- Ensure the `/tmp/ssh_keys` directory exists.
- Download SSH host keys from S3 and unpack them to `/etc/ssh`.
- Restart the SSH service to apply the new keys.
- Add necessary variables for S3 and AWS credentials in `groupvars/all`.
- Include `ssh_host_keys` role in `cluster.yml` playbook.
---
ansible/cluster.yml | 1 +
ansible/group_vars/all | 9 ++++++
ansible/roles/ssh_host_keys/tasks/main.yml | 33 ++++++++++++++++++++++
3 files changed, 43 insertions(+)
create mode 100644 ansible/roles/ssh_host_keys/tasks/main.yml
diff --git a/ansible/cluster.yml b/ansible/cluster.yml
index ef6c952..3197a11 100644
--- a/ansible/cluster.yml
+++ b/ansible/cluster.yml
@@ -7,3 +7,4 @@
- { name: 'nfs_mounts', tags: 'nfs_mounts' }
- { name: 'ldap_config', tags: 'ldap_config' }
- { name: 'slurm_client', tags: 'slurm_client', when: enable_slurm_client }
+ - { name: 'ssh_host_keys', tags: 'ssh_host_keys' }
diff --git a/ansible/group_vars/all b/ansible/group_vars/all
index e95c617..f1b531b 100644
--- a/ansible/group_vars/all
+++ b/ansible/group_vars/all
@@ -33,3 +33,12 @@
- /gpfs4
- /gpfs5
+#SSH Host Keys
+ s3_endpoint: ""
+ ssh_host_keys_s3_bucket: ""
+ ssh_host_keys_s3_object: ""
+
+# AWS credentials
+ lts_access_key: ""
+ lts_secret_key: ""
+
diff --git a/ansible/roles/ssh_host_keys/tasks/main.yml b/ansible/roles/ssh_host_keys/tasks/main.yml
new file mode 100644
index 0000000..cec0cb1
--- /dev/null
+++ b/ansible/roles/ssh_host_keys/tasks/main.yml
@@ -0,0 +1,33 @@
+---
+- name: Ensure destination directory exists only if not present
+ file:
+ path: /tmp/ssh_keys
+ state: directory
+ mode: '0755'
+ args:
+ creates: /tmp/ssh_keys
+
+- name: Download SSH host keys tar.gz from S3
+ aws_s3:
+ mode: get
+ s3_url: "{{ s3_endpoint }}"
+ bucket: "{{ ssh_host_keys_s3_bucket }}"
+ object: "{{ ssh_host_keys_s3_object }}"
+ dest: "/tmp/ssh_keys/{{ ssh_host_keys_s3_object }}"
+ aws_access_key: "{{ lts_access_key }}"
+ aws_secret_key: "{{ lts_secret_key }}"
+ vars:
+ ansible_python_interpreter: /usr/bin/python3
+
+- name: Unpack SSH host keys to /etc/ssh
+ unarchive:
+ src: "/tmp/ssh_keys/{{ ssh_host_keys_s3_object }}"
+ dest: "/etc/ssh"
+ remote_src: yes
+ become: true
+
+- name: Restart SSH service
+ ansible.builtin.service:
+ name: sshd
+ state: restarted
+ become: true
\ No newline at end of file
--
GitLab