Skip to content

Commit 9997d04

Browse files
pascal-sochackipascal-sochacki
committed
add ssh key auth
1 parent d8c3e60 commit 9997d04

3 files changed

Lines changed: 119 additions & 29 deletions

File tree

‎README.md‎

Lines changed: 47 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,47 @@
1-
fleeting-plugin-openstack
2-
=========================
1+
# fleeting-plugin-openstack
32

43
GitLab fleeting plugin for OpenStack.
54

65
https://docs.gitlab.com/runner/executors/docker_autoscaler.html
76

8-
9-
Plugin Configuration
10-
--------------------
7+
## Plugin Configuration
118

129
The following parameters are supported:
1310

14-
| Parameter | Type | Description |
15-
|-----------------------|--------|-------------|
16-
| `cloud` | string | Name of the cloud config from clouds.yaml to use |
17-
| `clouds_config` | string | Optional. Path to clouds.yaml |
18-
| `name` | string | Name of the Auto Scaling Group |
19-
| `boot_time` | string | Optional. Maximum wait time for instance to boot up. During that time plugin check Cloud-Init signatures. |
20-
| `server_spec` | object | Server spec used to create instances. See: [Compute API](https://docs.openstack.org/api-ref/compute/#create-server) |
21-
11+
| Parameter | Type | Description |
12+
| --------------- | ------ | ------------------------------------------------------------------------------------------------------------------- |
13+
| `cloud` | string | Name of the cloud config from clouds.yaml to use |
14+
| `clouds_config` | string | Optional. Path to clouds.yaml |
15+
| `name` | string | Name of the Auto Scaling Group |
16+
| `boot_time` | string | Optional. Maximum wait time for instance to boot up. During that time plugin check Cloud-Init signatures. |
17+
| `server_spec` | object | Server spec used to create instances. See: [Compute API](https://docs.openstack.org/api-ref/compute/#create-server) |
2218

2319
### Default connector config
2420

25-
| Parameter | Default |
26-
|--------------------------|----------|
27-
| `os` | `linux` |
28-
| `protocol` | `ssh` |
29-
| `username` | `unset` |
30-
| `use_static_credentials` | `true` |
21+
| Parameter | Default |
22+
| ------------------------ | ------- |
23+
| `os` | `linux` |
24+
| `protocol` | `ssh` |
25+
| `username` | `unset` |
26+
| `use_static_credentials` | `true` |
27+
28+
### SSH Key Authentication
29+
30+
The plugin supports two methods for SSH key authentication:
31+
32+
1. **OpenStack Keypairs (Traditional)**: Pre-register SSH keys in OpenStack and reference them via `key_name` in `server_spec`
33+
2. **Cloud-Init User Data**: Embed SSH public keys directly in the instance's user data using cloud-init's `ssh_authorized_keys`
34+
35+
When using SSH keys via user data:
3136

37+
- Set `use_static_credentials = false` in `connector_config`
38+
- Provide `key_path` pointing to your private key file
39+
- Do NOT specify `key_name` in `server_spec`
40+
- Add your public key to `user_data` using cloud-init's `ssh_authorized_keys` directive
3241

33-
OpenStack setup
34-
---------------
42+
See `example_config_userdata_ssh.toml` for a complete example.
43+
44+
## OpenStack setup
3545

3646
1. You should create a special user (recommended) and project (optional),
3747
then export clouds.yaml with credentials for that cloud.
@@ -43,12 +53,14 @@ OpenStack setup
4353
3. You should upload a special image with gitlab-runner and container runtime installed in it.
4454
For example we use [Fedora 38 with Podman](https://mirror.sardinasystems.com/images/Fedora-Cloud-Gitlab-Runner-38-1.6.x86_64.qcow2).
4555

46-
4. You should generate SSH keypair which will be used my manager instance to connect to workers.
47-
Public key must be added to Nova from the user.
56+
4. **SSH Key Setup (Choose one method)**:
57+
- **Method A (Cloud-Init)**: Generate an SSH keypair for the manager instance. The public key will be embedded in user data via cloud-init's `ssh_authorized_keys`. No OpenStack keypair registration needed.
58+
- **Method B (OpenStack Keypairs)**: Generate an SSH keypair and register the public key in Nova/OpenStack, then reference it via `key_name` in the server spec.
59+
60+
## Example runner config
4861

62+
### Example 1: Using OpenStack Keypairs (Traditional)
4963

50-
Example runner config
51-
---------------------
5264
```
5365
concurrent = 16
5466
check_interval = 0
@@ -138,3 +150,13 @@ idle_time = "30m0s"
138150
scale_factor = 0.0
139151
scale_factor_limit = 0
140152
```
153+
154+
### Example 2: Using SSH Keys via Cloud-Init User Data
155+
156+
See [`example_config_userdata_ssh.toml`](./example_config_userdata_ssh.toml) for a complete example that embeds SSH public keys in user data without requiring OpenStack keypair registration.
157+
158+
Key differences:
159+
160+
- Set `use_static_credentials = false`
161+
- Omit `key_name` from `server_spec`
162+
- Add `ssh_authorized_keys` to `user_data`

‎example_config_userdata_ssh.toml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
[[runners]]
2+
name = "openstack fleeting plugin with SSH keys via user data"
3+
url = "https://gitlab.com"
4+
token = "<TOKEN>"
5+
shell = "sh"
6+
executor = "docker-autoscaler"
7+
8+
[runners.autoscaler]
9+
plugin = "fleeting-plugin-openstack"
10+
max_instances = 5
11+
capacity_per_instance = 1
12+
13+
[runners.autoscaler.plugin_config]
14+
cloud = "mycloud"
15+
# clouds_config = "/path/to/clouds.yaml"
16+
name = "gitlab-runners"
17+
boot_time = "5m"
18+
19+
[runners.autoscaler.plugin_config.server_spec]
20+
name = "gitlab-runner-%d"
21+
description = "GitLab CI runner instance"
22+
tags = ["GitLab", "CI"]
23+
imageRef = "<IMAGE_ID>" # Ubuntu, Fedora, etc.
24+
flavorRef = "<FLAVOR_ID>" # Instance size
25+
networks = [ { uuid = "<NETWORK_UUID>" } ] # Network configuration
26+
security_groups = [ "<SECURITY_GROUP>" ] # Allow SSH access
27+
# NOTE: Do NOT specify key_name when using SSH keys via user data
28+
# key_name = "" # Leave empty or omit entirely
29+
30+
# Add SSH public key via cloud-init user data
31+
user_data = '''#cloud-config
32+
package_update: true
33+
package_upgrade: true
34+
35+
# Add your SSH public key here
36+
ssh_authorized_keys:
37+
- <PUBLIC_SSH_KEY>
38+
39+
# Optional: Additional configuration
40+
write_files:
41+
- path: /tmp/init_complete.txt
42+
content: |
43+
Instance initialized successfully with cloud-init
44+
45+
runcmd:
46+
- [ "touch", "/tmp/cloud_init_complete" ]
47+
# For Podman/Docker setups:
48+
# - systemctl --now enable podman.socket
49+
# - sudo -u <username> systemctl --user --now enable podman.socket
50+
'''
51+
52+
[runners.autoscaler.connector_config]
53+
username = "ubuntu" # Or "fedora", "centos", etc. depending on image
54+
key_path = "/etc/gitlab-runner/keys/id_rsa" # Path to PRIVATE SSH key
55+
use_static_credentials = false # IMPORTANT: Set to false for SSH key auth
56+
os = "linux"
57+
arch = "amd64"
58+
protocol = "ssh"
59+
protocol_port = 22
60+
use_external_addr = true
61+
keepalive = "30s"
62+
timeout = "5m"
63+
64+
[[runners.autoscaler.policy]]
65+
idle_count = 1
66+
idle_time = "20m"

‎provider.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -84,10 +84,6 @@ func (g *InstanceGroup) Init(ctx context.Context, log hclog.Logger, settings pro
8484

8585
g.computeClient = cli
8686

87-
if !settings.ConnectorConfig.UseStaticCredentials {
88-
return provider.ProviderInfo{}, fmt.Errorf("Only static credentials supported")
89-
}
90-
9187
if g.BootTimeS != "" {
9288
g.BootTime, err = time.ParseDuration(g.BootTimeS)
9389
if err != nil {
@@ -316,6 +312,12 @@ func (g *InstanceGroup) ConnectInfo(ctx context.Context, instanceID string) (pro
316312

317313
// g.log.Debug("Info", "info", info)
318314

315+
// When not using static credentials, SSH key authentication is handled
316+
// via OpenStack keypairs (key_name in server_spec). Skip connection test.
317+
if !info.UseStaticCredentials {
318+
return info, nil
319+
}
320+
319321
inp := bytes.NewBuffer(nil)
320322
combinedOut := bytes.NewBuffer(nil)
321323

0 commit comments

Comments
 (0)