[ws-manager-mk2] Support public SSH keys #16413

Furisto · 2023-02-15T11:54:17Z

Description

Support public ssh keys

Related Issue(s)

n.a.

How to test

Create ssh keys with ssh-keygen -t ed25519
Add the ssh key in user settings
Start workspace
Check that the workspace CR sshPublicKeys property is set
Check that the gitpod.io/sshPublicKeys annotation is set on the workspace pod
Create second ssh key
Add the ssh key in user settings
Check that workspace CR and workspace pod have been updated

Release Notes

None

Documentation

Build Options:

/werft with-github-actions
Experimental feature to run the build with GitHub Actions (and not in Werft).
leeway-no-cache
leeway-target=components:all
/werft no-test
Run Leeway with --dont-test

Publish Options

/werft publish-to-npm
/werft publish-to-jb-marketplace

Installer Options

with-ee-license
with-slow-database
with-dedicated-emulation
with-ws-manager-mk2
workspace-feature-flags
Add desired feature flags to the end of the line above, space separated

Preview Environment Options:

/werft with-local-preview
If enabled this will build install/preview
/werft with-preview
/werft with-large-vm
/werft with-gce-vm
If enabled this will create the environment on GCE infra
/werft with-integration-tests=all
Valid options are all, workspace, webapp, ide, jetbrains, vscode, ssh

werft-gitpod-dev-com · 2023-02-15T11:54:52Z

started the job as gitpod-build-fo-adv-3.2 because the annotations in the pull request description changed
(with .werft/ from main)

Furisto · 2023-02-15T12:46:47Z

/werft run with-preview with-wsman-mk2 with-large-vm with-gce-vm

👍 started the job as gitpod-build-fo-adv-3.5
(with .werft/ from main)

WVerlaek

testing in a preview env, but can't connect with VSCode Desktop, keep getting prompted for a password like this: https://www.gitpod.io/blog/vscode-desktop-ssh-updates#ssh-gateway-access-using-the-owner-token

The workspace spec and pod annotations do contain the public ssh key, is there anything else I need to set before I can connect with ssh?

WVerlaek · 2023-02-17T10:09:51Z

components/ws-manager-mk2/controllers/workspace_controller.go

+	case workspace.Spec.SshPublicKeys != pod.Annotations[kubernetes.WorkspaceSSHPublicKeys]:
+		pod.Annotations[kubernetes.WorkspaceSSHPublicKeys] = workspace.Spec.SshPublicKeys
+		err := r.Client.Update(ctx, pod)
+		if err != nil {
+			return ctrl.Result{Requeue: true}, err
+		}
+


could you add a test for this in workspace_controller_test?

Furisto · 2023-02-17T12:32:02Z

testing in a preview env, but can't connect with VSCode Desktop, keep getting prompted for a password like this: https://www.gitpod.io/blog/vscode-desktop-ssh-updates#ssh-gateway-access-using-the-owner-token

The workspace spec and pod annotations do contain the public ssh key, is there anything else I need to set before I can connect with ssh?

Good question, maybe @iQQBot knows the answer?

iQQBot · 2023-02-17T15:03:02Z

/werft run

👍 started the job as gitpod-build-fo-adv-3.6
(with .werft/ from main)

iQQBot · 2023-02-17T15:08:11Z

components/ws-manager-mk2/service/manager.go

@@ -653,6 +695,21 @@ func setEnvironment(envs []*wsmanapi.EnvironmentVariable) []corev1.EnvVar {
 	return envVars
 }

+func setSshPublicKeys(keys []string) (string, error) {
+	if len(keys) != 0 {


keep the same name SSH everywhere?

iQQBot · 2023-02-17T15:09:48Z

@Furisto Could you rebase to main? because the build is failed and I can't access the preview environment

Furisto · 2023-02-17T15:17:22Z

/werft run with-preview with-wsman-mk2 with-large-vm with-gce-vm

👍 started the job as gitpod-build-fo-adv-3.8
(with .werft/ from main)

Furisto · 2023-02-17T15:29:34Z

/werft run with-preview with-wsman-mk2 with-large-vm with-gce-vm recreate-vm

👍 started the job as gitpod-build-fo-adv-3.9
(with .werft/ from main)

iQQBot · 2023-02-17T16:43:49Z

/werft run with-preview with-wsman-mk2 with-large-vm with-gce-vm recreate-vm

👍 started the job as gitpod-build-fo-adv-3.10
(with .werft/ from main)

iQQBot · 2023-02-20T05:54:12Z

Good question, maybe @iQQBot knows the answer?

This implementation looks wrong. In mk2, we use CRD directly to store the public keys and we don't need to set it on annotation at all

we should put public keys in here

gitpod/components/ws-proxy/pkg/proxy/infoprovider.go

Lines 283 to 294 in edf97a9

    
           wsinfo := &WorkspaceInfo{ 
        
           	WorkspaceID:     ws.Spec.Ownership.WorkspaceID, 
        
           	InstanceID:      ws.Name, 
        
           	URL:             ws.Status.URL, 
        
           	IDEImage:        ws.Spec.Image.IDE.Web, 
        
           	SupervisorImage: ws.Spec.Image.IDE.Supervisor, 
        
           	IDEPublicPort:   getPortStr(ws.Status.URL), 
        
           	IPAddress:       podIP, 
        
           	Ports:           ports, 
        
           	Auth:            &wsapi.WorkspaceAuthentication{Admission: admission, OwnerToken: ws.Status.OwnerToken}, 
        
           	StartedAt:       ws.CreationTimestamp.Time, 
        
           }

iQQBot · 2023-02-20T05:55:19Z

components/ws-manager-api/go/crd/v1/workspace_types.go

@@ -45,6 +45,8 @@ type WorkspaceSpec struct {

 	// +kubebuilder:validation:MinItems=0
 	Ports []PortSpec `json:"ports"`
+
+	SshPublicKeys string `json:"sshPublicKey,omitempty"`


why using string? it can by array, we don't need base64 for it, we using base64 because annotation only support string.

werft-gitpod-dev-com · 2023-02-21T13:07:55Z

started the job as gitpod-build-fo-adv-3.12 because the annotations in the pull request description changed
(with .werft/ from main)

Furisto · 2023-02-21T14:13:12Z

/werft run with-preview with-wsman-mk2 with-large-vm with-gce-vm recreate-vm

👍 started the job as gitpod-build-fo-adv-3.13
(with .werft/ from main)

Furisto · 2023-02-21T14:20:18Z

/werft run with-preview with-wsman-mk2 with-large-vm with-gce-vm recreate-vm

👍 started the job as gitpod-build-fo-adv-3.14
(with .werft/ from main)

Furisto · 2023-02-21T14:27:59Z

/werft run with-preview with-wsman-mk2 with-large-vm

👍 started the job as gitpod-build-fo-adv-3.15
(with .werft/ from main)

Furisto · 2023-02-21T16:24:49Z

/werft run with-preview with-wsman-mk2 with-large-vm with-gce-vm recreate-vm

👍 started the job as gitpod-build-fo-adv-3.16
(with .werft/ from main)

WVerlaek · 2023-02-23T11:45:26Z

components/ws-manager-mk2/config/crd/bases/workspace.gitpod.io_workspaces.yaml

+              sshPublicKey:
+                format: byte
+                type: string


looks like this needs to be regenerated, with the type being an array now

iQQBot · 2023-02-23T17:40:48Z

components/ws-manager-api/go/crd/v1/workspace_types.go

@@ -45,6 +45,8 @@ type WorkspaceSpec struct {

 	// +kubebuilder:validation:MinItems=0
 	Ports []PortSpec `json:"ports"`
+
+	SshPublicKeys []byte `json:"sshPublicKeys,omitempty"`


why use []byte here? is it possible to directly use api.SSHPublicKeys or []string, in CRDs we should keep it readable... these things are not secret

kylos101 · 2023-03-06T14:04:44Z

@Furisto is this PR stalled? Should it flip back to draft?

WVerlaek · 2023-03-13T13:05:52Z

/werft run -a with-preview=true -a with-wsman-mk2=true -a with-gce-vm=true

👍 started the job as gitpod-build-fo-adv-3.18
(with .werft/ from main)

WVerlaek

lgtm, tested in preview env:

was able to connect over SSH with VS Code Desktop
updating a key propagated to running workspace

Furisto added team: workspace Issue belongs to the Workspace team feature: ws-manager-mk2 labels Feb 15, 2023

Furisto self-assigned this Feb 15, 2023

roboquat added do-not-merge/work-in-progress do-not-merge/release-note-label-needed size/M labels Feb 15, 2023

roboquat added release-note-none and removed do-not-merge/release-note-label-needed labels Feb 15, 2023

Furisto marked this pull request as ready for review February 15, 2023 12:47

Furisto requested a review from a team February 15, 2023 12:47

roboquat removed the do-not-merge/work-in-progress label Feb 15, 2023

Furisto mentioned this pull request Feb 15, 2023

[ws-manager-mk2] Fix workspace container detection #16418

Merged

15 tasks

WVerlaek reviewed Feb 17, 2023

View reviewed changes

iQQBot reviewed Feb 17, 2023

View reviewed changes

Furisto force-pushed the fo/adv-3 branch from 9dec31c to 6ece8e6 Compare February 17, 2023 15:14

iQQBot reviewed Feb 20, 2023

View reviewed changes

Furisto force-pushed the fo/adv-3 branch from 6ece8e6 to e0adf54 Compare February 21, 2023 12:54

WVerlaek reviewed Feb 23, 2023

View reviewed changes

iQQBot reviewed Feb 23, 2023

View reviewed changes

[ws-manager-mk2] Support public SSH keys

d2f59fd

Furisto force-pushed the fo/adv-3 branch from e0adf54 to d2f59fd Compare March 7, 2023 12:56

kylos101 requested review from iQQBot and WVerlaek March 10, 2023 13:46

WVerlaek approved these changes Mar 13, 2023

View reviewed changes

roboquat merged commit 2c259c4 into main Mar 13, 2023

roboquat deleted the fo/adv-3 branch March 13, 2023 13:50

roboquat added deployed: workspace Workspace team change is running in production deployed Change is completely running in production labels Mar 28, 2023

[ws-manager-mk2] Support public SSH keys #16413

[ws-manager-mk2] Support public SSH keys #16413

Uh oh!

Conversation

Furisto commented Feb 15, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issue(s)

How to test

Release Notes

Documentation

Build Options:

Preview Environment Options:

Uh oh!

werft-gitpod-dev-com bot commented Feb 15, 2023

Uh oh!

Furisto commented Feb 15, 2023 • edited by werft-gitpod-dev-com bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

WVerlaek left a comment

Choose a reason for hiding this comment

Uh oh!

WVerlaek Feb 17, 2023

Choose a reason for hiding this comment

Uh oh!

Furisto commented Feb 17, 2023

Uh oh!

iQQBot commented Feb 17, 2023 • edited by werft-gitpod-dev-com bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

iQQBot Feb 17, 2023

Choose a reason for hiding this comment

Uh oh!

iQQBot commented Feb 17, 2023

Uh oh!

Furisto commented Feb 17, 2023 • edited by werft-gitpod-dev-com bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Furisto commented Feb 17, 2023 • edited by werft-gitpod-dev-com bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

iQQBot commented Feb 17, 2023 • edited by werft-gitpod-dev-com bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

iQQBot commented Feb 20, 2023

Uh oh!

iQQBot Feb 20, 2023

Choose a reason for hiding this comment

Uh oh!

werft-gitpod-dev-com bot commented Feb 21, 2023

Uh oh!

Furisto commented Feb 21, 2023 • edited by werft-gitpod-dev-com bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Furisto commented Feb 21, 2023 • edited by werft-gitpod-dev-com bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Furisto commented Feb 21, 2023 • edited by werft-gitpod-dev-com bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Furisto commented Feb 21, 2023 • edited by werft-gitpod-dev-com bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

WVerlaek Feb 23, 2023

Choose a reason for hiding this comment

Uh oh!

iQQBot Feb 23, 2023

Choose a reason for hiding this comment

Uh oh!

kylos101 commented Mar 6, 2023

Uh oh!

WVerlaek commented Mar 13, 2023 • edited by werft-gitpod-dev-com bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

WVerlaek left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Furisto commented Feb 15, 2023 •

edited

Loading

Furisto commented Feb 15, 2023 •

edited by werft-gitpod-dev-com bot

Loading

iQQBot commented Feb 17, 2023 •

edited by werft-gitpod-dev-com bot

Loading

Furisto commented Feb 17, 2023 •

edited by werft-gitpod-dev-com bot

Loading

Furisto commented Feb 17, 2023 •

edited by werft-gitpod-dev-com bot

Loading

iQQBot commented Feb 17, 2023 •

edited by werft-gitpod-dev-com bot

Loading

Furisto commented Feb 21, 2023 •

edited by werft-gitpod-dev-com bot

Loading

Furisto commented Feb 21, 2023 •

edited by werft-gitpod-dev-com bot

Loading

Furisto commented Feb 21, 2023 •

edited by werft-gitpod-dev-com bot

Loading

Furisto commented Feb 21, 2023 •

edited by werft-gitpod-dev-com bot

Loading

WVerlaek commented Mar 13, 2023 •

edited by werft-gitpod-dev-com bot

Loading