mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 16:04:31 +00:00
Enable fallback to RSA for SSH key generation and streamline keypair handling.
- Add a fallback mechanism to RSA when ed25519 key generation fails in `install.py`. - Update SSH key generation logic to avoid ed25519-specific messaging. - Simplify comments and logic in `init_openbao.sh` by removing ed25519 assumptions. - Compact XML formatting for port-mappings.
This commit is contained in:
chrisfu
parent
a7cb5b5fca
commit
a720ad9d4f
@ -1,64 +1,7 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<portMappings>
|
||||
<!--
|
||||
Each <mapping/> defines one port-forward.
|
||||
- id: unique key used for pid/log filenames
|
||||
- namespace: k8s namespace
|
||||
- target: kubectl-forward target (svc/<name>, deploy/<name>, pod/<name>, etc.)
|
||||
- address: usually 127.0.0.1 for local-only exposure
|
||||
- hostPort: host port to bind
|
||||
- servicePort: pod/service port inside cluster
|
||||
- protocol: TCP (kubectl port-forward is TCP)
|
||||
- description: free text
|
||||
-->
|
||||
|
||||
<!-- Kubernetes Dashboard (common install: namespace kubernetes-dashboard, service kubernetes-dashboard on 443) -->
|
||||
<mapping id="dashboard"
|
||||
namespace="kubernetes-dashboard"
|
||||
target="svc/kubernetes-dashboard-kong-proxy"
|
||||
address="127.0.0.1"
|
||||
hostPort="8443"
|
||||
servicePort="443"
|
||||
protocol="TCP"
|
||||
description="Kubernetes Dashboard (https://127.0.0.1:8443)"/>
|
||||
|
||||
<!-- Prometheus (common: monitoring namespace; service name varies by stack) -->
|
||||
<mapping id="prometheus"
|
||||
namespace="${NAMESPACE}"
|
||||
target="svc/prometheus-community-kube-prometheus"
|
||||
address="127.0.0.1"
|
||||
hostPort="9090"
|
||||
servicePort="9090"
|
||||
protocol="TCP"
|
||||
description="Prometheus UI (http://127.0.0.1:9090)"/>
|
||||
|
||||
<!-- Grafana (common: monitoring namespace; service grafana on 3000) -->
|
||||
<mapping id="grafana"
|
||||
namespace="${NAMESPACE}"
|
||||
target="svc/prometheus-community-grafana"
|
||||
address="127.0.0.1"
|
||||
hostPort="3000"
|
||||
servicePort="80"
|
||||
protocol="TCP"
|
||||
description="Grafana UI (http://127.0.0.1:3000)"/>
|
||||
|
||||
<!-- PostgreSQL (service name varies; remote port usually 5432) -->
|
||||
<mapping id="postgres"
|
||||
namespace="${NAMESPACE}"
|
||||
target="svc/prole-db-rw"
|
||||
address="0.0.0.0"
|
||||
hostPort="5432"
|
||||
servicePort="5432"
|
||||
protocol="TCP"
|
||||
description="PostgreSQL (127.0.0.1:5432)"/>
|
||||
|
||||
<!-- OpenBao (Vault-compatible) API -->
|
||||
<mapping id="openbao"
|
||||
namespace="${NAMESPACE}"
|
||||
target="svc/openbao"
|
||||
address="127.0.0.1"
|
||||
hostPort="18200"
|
||||
servicePort="8200"
|
||||
protocol="TCP"
|
||||
description="OpenBao (http://127.0.0.1:18200)"/>
|
||||
</portMappings>
|
||||
<portMappings> <mapping id="dashboard" namespace="kubernetes-dashboard" target="svc/kubernetes-dashboard-kong-proxy" address="127.0.0.1" hostPort="8443" servicePort="443" protocol="TCP" description="Kubernetes Dashboard (https://127.0.0.1:8443)"/>
|
||||
<mapping id="prometheus" namespace="${NAMESPACE}" target="svc/prometheus-community-kube-prometheus" address="127.0.0.1" hostPort="9090" servicePort="9090" protocol="TCP" description="Prometheus UI (http://127.0.0.1:9090)"/>
|
||||
<mapping id="grafana" namespace="${NAMESPACE}" target="svc/prometheus-community-grafana" address="127.0.0.1" hostPort="3000" servicePort="80" protocol="TCP" description="Grafana UI (http://127.0.0.1:3000)"/>
|
||||
<mapping id="postgres" namespace="${NAMESPACE}" target="svc/prole-db-rw" address="0.0.0.0" hostPort="5432" servicePort="5432" protocol="TCP" description="PostgreSQL (127.0.0.1:5432)"/>
|
||||
<mapping id="openbao" namespace="${NAMESPACE}" target="svc/openbao" address="127.0.0.1" hostPort="18200" servicePort="8200" protocol="TCP" description="OpenBao (http://127.0.0.1:18200)"/>
|
||||
</portMappings>
|
||||
@ -4,7 +4,7 @@ set -euo pipefail
|
||||
|
||||
# init_openbao.sh
|
||||
# Purpose:
|
||||
# - Deploy OpenBao to Kubernetes (dev mode) and store admin ed25519 key pair
|
||||
# - Deploy OpenBao to Kubernetes (dev mode) and store admin key pair
|
||||
# Generate and apply a Kerberos krb5.conf ConfigMap for an external realm
|
||||
# - Local Docker helpers for OpenBao (optional)
|
||||
|
||||
@ -81,11 +81,15 @@ ensure_docker() {
|
||||
}
|
||||
|
||||
ensure_admin_keypair() {
|
||||
# Ensure admin ed25519 keypair exists and a root token is available
|
||||
# Ensure admin keypair exists and a root token is available
|
||||
mkdir -p "$SECRETS_DIR"
|
||||
if [[ ! -f "$admin_key_priv" || ! -f "$admin_key_pub" ]]; then
|
||||
echo "Generating admin ed25519 keypair in $SECRETS_DIR ..."
|
||||
openssl genpkey -algorithm ED25519 -out "$admin_key_priv"
|
||||
echo "Generating admin keypair in $SECRETS_DIR ..."
|
||||
# Attempt ed25519, fallback to rsa if not available
|
||||
if ! openssl genpkey -algorithm ED25519 -out "$admin_key_priv" 2>/dev/null; then
|
||||
echo "ED25519 not supported by openssl, falling back to RSA 4096..."
|
||||
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out "$admin_key_priv"
|
||||
fi
|
||||
openssl pkey -in "$admin_key_priv" -pubout -out "$admin_key_pub"
|
||||
chmod 0600 "$admin_key_priv"
|
||||
fi
|
||||
@ -429,7 +433,7 @@ cmd_status() {
|
||||
|
||||
# Secrets and tokens
|
||||
if [[ -f "$admin_key_priv" && -f "$admin_key_pub" ]]; then
|
||||
echo "[OK] Admin ed25519 keypair present in $SECRETS_DIR"
|
||||
echo "[OK] Admin keypair present in $SECRETS_DIR"
|
||||
else
|
||||
echo "[MISSING] Admin keypair files in $SECRETS_DIR"
|
||||
ok=1
|
||||
|
||||
22
install.py
22
install.py
@ -1252,6 +1252,7 @@ class ProleInstaller:
|
||||
def worker():
|
||||
self.safe_after(lambda: self._db_set_buttons_state('disabled'))
|
||||
self.safe_after(lambda: self._db_set_status(f"Recreating SSH key for {ns}...", '#1d1d1f'))
|
||||
# We prefer ed25519, but fallback to rsa if not available
|
||||
key_path = Path.home() / ".ssh" / "id_prole_ed25519"
|
||||
pub_path = Path.home() / ".ssh" / "id_prole_ed25519.pub"
|
||||
try:
|
||||
@ -1264,6 +1265,11 @@ class ProleInstaller:
|
||||
|
||||
cmd = ["ssh-keygen", "-t", "ed25519", "-N", "", "-f", str(key_path), "-C", self.db_username.get().strip()]
|
||||
rc, out = self._run_cmd_capture(cmd)
|
||||
if rc != 0:
|
||||
self._db_log(f"ed25519 generation failed, falling back to rsa: {out}")
|
||||
cmd = ["ssh-keygen", "-t", "rsa", "-b", "4096", "-N", "", "-f", str(key_path), "-C", self.db_username.get().strip()]
|
||||
rc, out = self._run_cmd_capture(cmd)
|
||||
|
||||
self._db_log(out)
|
||||
if rc != 0:
|
||||
self.safe_after(lambda: self._db_set_status("Failed to recreate SSH key. See logs/db-actions.log.", '#ff3b30'))
|
||||
@ -2224,7 +2230,7 @@ class ProleInstaller:
|
||||
# ---------------- Initialize Screen Handlers ----------------
|
||||
|
||||
def _generate_ssh_key_with_overlay(self):
|
||||
"""Generate ed25519 SSH key pair using a standard screen layout."""
|
||||
"""Generate SSH key pair using a standard screen layout."""
|
||||
self._clear_canvas_page()
|
||||
|
||||
# Letterhead at top right
|
||||
@ -2236,7 +2242,7 @@ class ProleInstaller:
|
||||
font=('SF Pro Text', 18), anchor='ne')
|
||||
|
||||
self._render_title('Generate SSH Key', y=150)
|
||||
self._render_paragraph('Generating ed25519 SSH key pair for secure database access.', y=200)
|
||||
self._render_paragraph('Generating SSH key pair for secure database access.', y=200)
|
||||
|
||||
# Output Console - standardized to match Docker Build screen
|
||||
console = self._create_console_output(y=260, title="SSH Output", width=900, height=520)
|
||||
@ -2266,6 +2272,18 @@ class ProleInstaller:
|
||||
if line:
|
||||
console.write(line)
|
||||
|
||||
if proc.returncode != 0:
|
||||
console.write(f"\ned25519 generation failed, falling back to rsa (code {proc.returncode})\n")
|
||||
cmd = ["ssh-keygen", "-t", "rsa", "-b", "4096", "-N", "", "-f", str(key_path), "-C", self.db_username.get()]
|
||||
console.write(f"Running: {' '.join(cmd)}\n\n")
|
||||
proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
|
||||
while True:
|
||||
line = proc.stdout.readline()
|
||||
if not line and proc.poll() is not None:
|
||||
break
|
||||
if line:
|
||||
console.write(line)
|
||||
|
||||
if proc.returncode == 0:
|
||||
console.write("\nSSH key generated successfully.\n")
|
||||
self.safe_after(lambda: self.bg_canvas.itemconfig(status_label, text="SSH key generated successfully.", fill='#34c759') if self.bg_canvas.winfo_exists() else None)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user