3

I have a Juju Charm for specific cluster service. In manual deployments, the password-less SSH access for the cluster administrator is enabled between the control-system nodes and the other nodes in the cluster. I'd like my Juju Charm to automate that process.

In simple terms :

  • The service is deployed across nodes
  • Each node has a user account created for the service-owner
  • 1 or more of those nodes will have the control system packages
  • The goal is passwordless ssh access to ALL nodes for the service-owner on that small sub-set of nodes

I was thinking about shoving the public key into a relation property for the peer relation between the nodes ... and just reading it from the other end. But the mechanics of relation-relation-changed are such that I'm already seeing that routine called n-factorial times for an n-node cluster. I'd rather not add more complexity there if I can avoid it.

1
  • 1
    WHy don't you use an Acess Control System Like LDAP?
    – vfbsilva
    Aug 8, 2013 at 13:17

1 Answer 1

3
+125

I'll give you my thought's on syncing keys between equal peers (for your control nodes) but this could be used as is for all your nodes AFAICT.

in the relation relation changed hook script:

#if there is no pubkey corresponding to this nodes ID, export this relation
ThisUnitID=$(echo $JUJU_UNIT_NAME | awk -F/ '{print $2}')
if [ -z $(relation-get pub_key"$ThisUnitID" ]; then
    relation-set pub_key"$ThisUnitID" "$ThisPubKey"
fi

#get everyone's pub key
MEMBERS=$(relation-list)
for member in $MEMBERS; do
    memberID=$(echo $member | awk -F/ '{print $2}')
    custom_save_pub_key $(relation-get pub_key"$memberID" )
done

If I understand juju correctly, this will be called once in every node when a new node is added, this will allow the new node to get everyone else's pub key. But as the new node also changes the relation, it will result in all the other nodes running this again to pull the updated list of keys... very hackish to depend on a side effect but it was very concise..

good luck.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .