Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ed25519 SSH Key support #14

Merged
merged 8 commits into from
Sep 20, 2024
Merged

Add ed25519 SSH Key support #14

merged 8 commits into from
Sep 20, 2024

Conversation

jkroepke
Copy link
Member

RSA keys are problematic in newer linux distros and should be avoided if possible.

Azure supports the usage of ED25519 keys which should be always prefer over RSA keys.

Ref: https://azure.microsoft.com/en-us/updates/v2/ssh-key-support-for-linux-vms

Signed-off-by: Jan-Otto Kröpke <joe@cloudeteer.de>
Copy link
Member

@rswrz rswrz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this improvement. Please refer to our Terraform Module Style Guide.

Also, please run terraform-docs . to update the README.md file.

variables.tf Outdated Show resolved Hide resolved
variables.tf Show resolved Hide resolved
Signed-off-by: Jan-Otto Kröpke <joe@cloudeteer.de>
@jkroepke jkroepke requested a review from rswrz September 19, 2024 13:57
Signed-off-by: Roman Schwarz <rs@cloudeteer.de>
Signed-off-by: Roman Schwarz <rs@cloudeteer.de>
Copy link
Member

@rswrz rswrz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The azurerm provider at v3 does not support ssh-ed25519 SSH keys.

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.111"
    }
}

variables {
  authentication_type = "SSH"
}
$ terraform init -test-directory=tests/remote
Initializing the backend...
Initializing modules...
- test.tests.remote.main.setup_tests in tests/remote
Initializing provider plugins...
- Finding hashicorp/random versions matching ">= 3.0.0, ~> 3.0"...
- Finding hashicorp/tls versions matching ">= 4.0.0, ~> 4.0"...
- Finding azure/azapi versions matching ">= 1.14.0, ~> 1.14"...
- Finding hashicorp/azurerm versions matching ">= 3.111.0, ~> 3.111"...
- Installing hashicorp/random v3.6.3...
- Installed hashicorp/random v3.6.3 (signed by HashiCorp)
- Installing hashicorp/tls v4.0.6...
- Installed hashicorp/tls v4.0.6 (signed by HashiCorp)
- Installing azure/azapi v1.15.0...
- Installed azure/azapi v1.15.0 (signed by a HashiCorp partner, key ID 6F0B91BDE98478CF)
- Installing hashicorp/azurerm v3.116.0...
- Installed hashicorp/azurerm v3.116.0 (signed by HashiCorp)

$ terraform test -test-directory=tests/remote
tests/remote/main.tftest.hcl... in progress
  run "setup_tests"... pass
  run "deploy_module_linux_ssh"... fail

│ Error: - the provided ssh-ed25519 SSH key is not supported. Only RSA SSH keys are supported by Azure

│   with azurerm_linux_virtual_machine.this[0],
│   on r-vm.tf line 7, in resource "azurerm_linux_virtual_machine" "this":
│    7: resource "azurerm_linux_virtual_machine" "this" {


tests/remote/main.tftest.hcl... tearing down

The time has come (pretty fast ;)) that we need to raise the minimum version to v4.1.

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.1"
    }
}

variables {
  authentication_type = "SSH"
}
$ terraform init -test-directory=tests/remote
Initializing the backend...
Initializing modules...
- test.tests.remote.main.setup_tests in tests/remote
Initializing provider plugins...
- Finding hashicorp/random versions matching ">= 3.0.0, ~> 3.0"...
- Finding hashicorp/tls versions matching ">= 4.0.0, ~> 4.0"...
- Finding azure/azapi versions matching ">= 1.14.0, ~> 1.14"...
- Finding hashicorp/azurerm versions matching ">= 3.111.0, ~> 4.1"...
- Installing hashicorp/random v3.6.3...
- Installed hashicorp/random v3.6.3 (signed by HashiCorp)
- Installing hashicorp/tls v4.0.6...
- Installed hashicorp/tls v4.0.6 (signed by HashiCorp)
- Installing azure/azapi v1.15.0...
- Installed azure/azapi v1.15.0 (signed by a HashiCorp partner, key ID 6F0B91BDE98478CF)
- Installing hashicorp/azurerm v4.2.0...
- Installed hashicorp/azurerm v4.2.0 (signed by HashiCorp)

$ terraform test -test-directory=tests/remote
tests/remote/main.tftest.hcl... in progress
  run "setup_tests"... pass
  run "deploy_module_linux_ssh"... pass
tests/remote/main.tftest.hcl... tearing down
tests/remote/main.tftest.hcl... pass

Success! 2 passed, 0 failed.

We could keep the default key algorithm at RSA and stick with v3, but I think it is absolutely fine to go with v4 from here.

@rswrz rswrz changed the title SSH: support ed25519 keys Add ed25519 SSH Key support Sep 19, 2024
@rswrz rswrz self-requested a review September 19, 2024 20:29
variables.tf Outdated Show resolved Hide resolved
Signed-off-by: Roman Schwarz <rs@cloudeteer.de>
Signed-off-by: Roman Schwarz <rs@cloudeteer.de>
Signed-off-by: Roman Schwarz <rs@cloudeteer.de>
rswrz
rswrz previously approved these changes Sep 19, 2024
Signed-off-by: Roman Schwarz <rs@cloudeteer.de>
@rswrz
Copy link
Member

rswrz commented Sep 20, 2024

The remote test is slow and somehow broken. I improved it in #20 and merged this changed here. Hopefully, now the test runs successfully.

@rswrz rswrz merged commit ebd71a4 into main Sep 20, 2024
11 checks passed
@rswrz rswrz deleted the ed25519 branch September 20, 2024 07:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
No open projects
Development

Successfully merging this pull request may close these issues.

2 participants