chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-27 10:04:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Enable fallback to RSA for SSH key generation and streamline keypair handling.

Browse Source 
- Add a fallback mechanism to RSA when ed25519 key generation fails in `install.py`.
- Update SSH key generation logic to avoid ed25519-specific messaging.
- Simplify comments and logic in `init_openbao.sh` by removing ed25519 assumptions.
- Compact XML formatting for port-mappings.
This commit is contained in:
chrisfu 2026-01-30 23:40:34 -08:00
parent a7cb5b5fca
commit a720ad9d4f
3 changed files with 35 additions and 70 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
conf/port-mappings.properties
View File

@ -1,64 +1,7 @@
<?xml version="1.0" encoding="UTF-8"?> <?xml version="1.0" encoding="UTF-8"?>
<portMappings> <portMappings> <mapping id="dashboard" namespace="kubernetes-dashboard" target="svc/kubernetes-dashboard-kong-proxy" address="127.0.0.1" hostPort="8443" servicePort="443" protocol="TCP" description="Kubernetes Dashboard (https://127.0.0.1:8443)"/>
<!-- <mapping id="prometheus" namespace="${NAMESPACE}" target="svc/prometheus-community-kube-prometheus" address="127.0.0.1" hostPort="9090" servicePort="9090" protocol="TCP" description="Prometheus UI (http://127.0.0.1:9090)"/>
Each <mapping/> defines one port-forward. <mapping id="grafana" namespace="${NAMESPACE}" target="svc/prometheus-community-grafana" address="127.0.0.1" hostPort="3000" servicePort="80" protocol="TCP" description="Grafana UI (http://127.0.0.1:3000)"/>
- id: unique key used for pid/log filenames <mapping id="postgres" namespace="${NAMESPACE}" target="svc/prole-db-rw" address="0.0.0.0" hostPort="5432" servicePort="5432" protocol="TCP" description="PostgreSQL (127.0.0.1:5432)"/>
- namespace: k8s namespace <mapping id="openbao" namespace="${NAMESPACE}" target="svc/openbao" address="127.0.0.1" hostPort="18200" servicePort="8200" protocol="TCP" description="OpenBao (http://127.0.0.1:18200)"/>
- target: kubectl-forward target (svc/<name>, deploy/<name>, pod/<name>, etc.)
- address: usually 127.0.0.1 for local-only exposure
- hostPort: host port to bind
- servicePort: pod/service port inside cluster
- protocol: TCP (kubectl port-forward is TCP)
- description: free text
-->
<!-- Kubernetes Dashboard (common install: namespace kubernetes-dashboard, service kubernetes-dashboard on 443) -->
<mapping id="dashboard"
namespace="kubernetes-dashboard"
target="svc/kubernetes-dashboard-kong-proxy"
address="127.0.0.1"
hostPort="8443"
servicePort="443"
protocol="TCP"
description="Kubernetes Dashboard (https://127.0.0.1:8443)"/>
<!-- Prometheus (common: monitoring namespace; service name varies by stack) -->
<mapping id="prometheus"
namespace="${NAMESPACE}"
target="svc/prometheus-community-kube-prometheus"
address="127.0.0.1"
hostPort="9090"
servicePort="9090"
protocol="TCP"
description="Prometheus UI (http://127.0.0.1:9090)"/>
<!-- Grafana (common: monitoring namespace; service grafana on 3000) -->
<mapping id="grafana"
namespace="${NAMESPACE}"
target="svc/prometheus-community-grafana"
address="127.0.0.1"
hostPort="3000"
servicePort="80"
protocol="TCP"
description="Grafana UI (http://127.0.0.1:3000)"/>
<!-- PostgreSQL (service name varies; remote port usually 5432) -->
<mapping id="postgres"
namespace="${NAMESPACE}"
target="svc/prole-db-rw"
address="0.0.0.0"
hostPort="5432"
servicePort="5432"
protocol="TCP"
description="PostgreSQL (127.0.0.1:5432)"/>
<!-- OpenBao (Vault-compatible) API -->
<mapping id="openbao"
namespace="${NAMESPACE}"
target="svc/openbao"
address="127.0.0.1"
hostPort="18200"
servicePort="8200"
protocol="TCP"
description="OpenBao (http://127.0.0.1:18200)"/>
</portMappings> </portMappings>

14
etc/init_openbao.sh
View File

@ -4,7 +4,7 @@ set -euo pipefail
# init_openbao.sh # init_openbao.sh
# Purpose: # Purpose:
# - Deploy OpenBao to Kubernetes (dev mode) and store admin ed25519 key pair # - Deploy OpenBao to Kubernetes (dev mode) and store admin key pair
# Generate and apply a Kerberos krb5.conf ConfigMap for an external realm # Generate and apply a Kerberos krb5.conf ConfigMap for an external realm
# - Local Docker helpers for OpenBao (optional) # - Local Docker helpers for OpenBao (optional)
@ -81,11 +81,15 @@ ensure_docker() {
} }
ensure_admin_keypair() { ensure_admin_keypair() {
# Ensure admin ed25519 keypair exists and a root token is available # Ensure admin keypair exists and a root token is available
mkdir -p "$SECRETS_DIR" mkdir -p "$SECRETS_DIR"
if [[ ! -f "$admin_key_priv" || ! -f "$admin_key_pub" ]]; then if [[ ! -f "$admin_key_priv" || ! -f "$admin_key_pub" ]]; then
echo "Generating admin ed25519 keypair in $SECRETS_DIR ..." echo "Generating admin keypair in $SECRETS_DIR ..."
openssl genpkey -algorithm ED25519 -out "$admin_key_priv" # Attempt ed25519, fallback to rsa if not available
if ! openssl genpkey -algorithm ED25519 -out "$admin_key_priv" 2>/dev/null; then
echo "ED25519 not supported by openssl, falling back to RSA 4096..."
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out "$admin_key_priv"
fi
openssl pkey -in "$admin_key_priv" -pubout -out "$admin_key_pub" openssl pkey -in "$admin_key_priv" -pubout -out "$admin_key_pub"
chmod 0600 "$admin_key_priv" chmod 0600 "$admin_key_priv"
fi fi
@ -429,7 +433,7 @@ cmd_status() {
# Secrets and tokens # Secrets and tokens
if [[ -f "$admin_key_priv" && -f "$admin_key_pub" ]]; then if [[ -f "$admin_key_priv" && -f "$admin_key_pub" ]]; then
echo "[OK] Admin ed25519 keypair present in $SECRETS_DIR" echo "[OK] Admin keypair present in $SECRETS_DIR"
else else
echo "[MISSING] Admin keypair files in $SECRETS_DIR" echo "[MISSING] Admin keypair files in $SECRETS_DIR"
ok=1 ok=1

22
install.py
View File

@ -1252,6 +1252,7 @@ class ProleInstaller:
def worker(): def worker():
self.safe_after(lambda: self._db_set_buttons_state('disabled')) self.safe_after(lambda: self._db_set_buttons_state('disabled'))
self.safe_after(lambda: self._db_set_status(f"Recreating SSH key for {ns}...", '#1d1d1f')) self.safe_after(lambda: self._db_set_status(f"Recreating SSH key for {ns}...", '#1d1d1f'))
# We prefer ed25519, but fallback to rsa if not available
key_path = Path.home() / ".ssh" / "id_prole_ed25519" key_path = Path.home() / ".ssh" / "id_prole_ed25519"
pub_path = Path.home() / ".ssh" / "id_prole_ed25519.pub" pub_path = Path.home() / ".ssh" / "id_prole_ed25519.pub"
try: try:
@ -1264,6 +1265,11 @@ class ProleInstaller:
cmd = ["ssh-keygen", "-t", "ed25519", "-N", "", "-f", str(key_path), "-C", self.db_username.get().strip()] cmd = ["ssh-keygen", "-t", "ed25519", "-N", "", "-f", str(key_path), "-C", self.db_username.get().strip()]
rc, out = self._run_cmd_capture(cmd) rc, out = self._run_cmd_capture(cmd)
if rc != 0:
self._db_log(f"ed25519 generation failed, falling back to rsa: {out}")
cmd = ["ssh-keygen", "-t", "rsa", "-b", "4096", "-N", "", "-f", str(key_path), "-C", self.db_username.get().strip()]
rc, out = self._run_cmd_capture(cmd)
self._db_log(out) self._db_log(out)
if rc != 0: if rc != 0:
self.safe_after(lambda: self._db_set_status("Failed to recreate SSH key. See logs/db-actions.log.", '#ff3b30')) self.safe_after(lambda: self._db_set_status("Failed to recreate SSH key. See logs/db-actions.log.", '#ff3b30'))
@ -2224,7 +2230,7 @@ class ProleInstaller:
# ---------------- Initialize Screen Handlers ---------------- # ---------------- Initialize Screen Handlers ----------------
def _generate_ssh_key_with_overlay(self): def _generate_ssh_key_with_overlay(self):
"""Generate ed25519 SSH key pair using a standard screen layout.""" """Generate SSH key pair using a standard screen layout."""
self._clear_canvas_page() self._clear_canvas_page()
# Letterhead at top right # Letterhead at top right
@ -2236,7 +2242,7 @@ class ProleInstaller:
font=('SF Pro Text', 18), anchor='ne') font=('SF Pro Text', 18), anchor='ne')
self._render_title('Generate SSH Key', y=150) self._render_title('Generate SSH Key', y=150)
self._render_paragraph('Generating ed25519 SSH key pair for secure database access.', y=200) self._render_paragraph('Generating SSH key pair for secure database access.', y=200)
# Output Console - standardized to match Docker Build screen # Output Console - standardized to match Docker Build screen
console = self._create_console_output(y=260, title="SSH Output", width=900, height=520) console = self._create_console_output(y=260, title="SSH Output", width=900, height=520)
@ -2266,6 +2272,18 @@ class ProleInstaller:
if line: if line:
console.write(line) console.write(line)
if proc.returncode != 0:
console.write(f"\ned25519 generation failed, falling back to rsa (code {proc.returncode})\n")
cmd = ["ssh-keygen", "-t", "rsa", "-b", "4096", "-N", "", "-f", str(key_path), "-C", self.db_username.get()]
console.write(f"Running: {' '.join(cmd)}\n\n")
proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
while True:
line = proc.stdout.readline()
if not line and proc.poll() is not None:
break
if line:
console.write(line)
if proc.returncode == 0: if proc.returncode == 0:
console.write("\nSSH key generated successfully.\n") console.write("\nSSH key generated successfully.\n")
self.safe_after(lambda: self.bg_canvas.itemconfig(status_label, text="SSH key generated successfully.", fill='#34c759') if self.bg_canvas.winfo_exists() else None) self.safe_after(lambda: self.bg_canvas.itemconfig(status_label, text="SSH key generated successfully.", fill='#34c759') if self.bg_canvas.winfo_exists() else None)