gardenctl ssh improvement #195

tedteng · 2020-04-27T06:59:08Z

What this PR does / why we need it:

fix: check if bastion host exists, avoid multiple bastions create and occupied source in cloud
add: waiting instance-status.status,Values=ok then ssh (ssh timeout due to status check initiating)

Warning: Permanently added '<some-public-ip>' (ECDSA) to the list of known hosts.
channel 0: open failed: connect failed: Connection timed out
stdio forwarding failed
kex_exchange_identification: Connection closed by remote host
exit status 255

add: use exist global flags -c trigger clear up function gardenctl ssh xxxx -c
add: check ssh rule if exist avoid blocked the deletion flow.

(2/3) Close SSH Port on Node.

An error occurred (InvalidPermission.NotFound) when calling the RevokeSecurityGroupIngress operation: The specified rule does not exist in this security group.

Which issue(s) this PR fixes:
Fixes #191
Fixes #192

Special notes for your reviewer:
global flags testing
gardenctl ssh (any hostname) -c

gardenctl ssh and exit

Release note:

improvement operator handling of external resources relate with bastion instance in was, manual gracefully deleted by global flags enable

vpnachev · 2020-04-29T14:30:36Z

This PR is not fixing #192.

tedteng · 2020-04-30T02:23:07Z

This PR is not fixing #192.

@vpnachev , the current fix is able to remove bastion resources include (ec2 , sg, 22 rules) manually if there any resource leaking. in #192 do you mean I need to refactor ssh, call CRD create term- pod then get through term- pod to access node instead of current ssh method? Is that idea want to achieve it?

vpnachev · 2020-04-30T08:19:28Z

My idea is gardenctl to use machine.sapcloud.io/v1alpha1.Machine resource for the bastion host and let the MCM do the real work on creating/deleting these VMs. This approach is applicable for any cloud provider, not only AWS.

The implementation is, of course cloud dependent because on some providers, e.g. Azure, a public IP is directly attached to the VM and a bastion is not used.

tedteng · 2020-04-30T10:25:48Z

more discuss in #192 if relate with #192
this PR only for #191

tedteng · 2020-05-12T00:58:33Z

sign-off

no extra resources generated on Cloud Provider when using SSH Pod.
able to SSH AWS, AZURE, GCP, ALICLOUD, OPENSTACK now
gardenctl ssh xxxxx use Pod as jump box as default way. flag --j will use Bastion VM as a jump box gardenctl ssh --j xxxx
global flag -c also able to use for cleanup AWS Bastion VM gardenctl ssh -c xxx
bugs fix

Openstack SSH Tesing result

Azure SSH Testing result

GCP SSH Testing result

AWS SSH Testing result

DockToFuture

Thanks, the PR looks very good. Just a few minor things in the comments. Can you please also rebase the PR?

DockToFuture · 2020-05-25T06:42:28Z

pkg/cmd/ssh.go

 			return nil
 		},
 	}

+	cmd.Flags().BoolVar(&bastionVM, "j", false, "Use Bastion VM as jump box")


Please replace by
cmd.Flags().BoolVarP(&bastionVM, "jumpbox", "j", false, "Use Bastion VM as jump box")

I am using local flags that seem not to support it.

too many arguments in call to cmd.Flags().BoolVar have (*bool, string, string, bool, string) want (*bool, string, bool, string)go

DockToFuture · 2020-05-25T07:03:58Z

pkg/cmd/ssh_aws.go

@@ -64,15 +64,21 @@ func sshToAWSNode(nodeName, path, user, pathSSKeypair string, sshPublicKey []byt
 	a.createBastionHostSecurityGroup()
 	fmt.Println("")

+	// if global flag -c is specified call cleanupAwsBastionHost


I would rather name the flag cleanup to make things more clear. Maybe we can also document it in the readme. We only have this for aws. In my opinion it would also make sense to add this for the other infrastructures, what do you think?

sure.
due to -c already use by no-cache, I change to -e as erase

I agree with you, regarding the other infrastructures. I will work on that.

tedteng

Readme add

tedteng · 2020-05-25T08:15:19Z

pkg/cmd/ssh.go

 			return nil
 		},
 	}

+	cmd.Flags().BoolVar(&bastionVM, "j", false, "Use Bastion VM as jump box")


I am using local flags that seem not to support it.

too many arguments in call to cmd.Flags().BoolVar have (*bool, string, string, bool, string) want (*bool, string, bool, string)go

tedteng requested review from DockToFuture and ialidzhikov as code owners April 27, 2020 06:59

gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Apr 27, 2020

gardener-robot-ci-3 added needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Apr 27, 2020

tedteng mentioned this pull request Apr 27, 2020

Improve handling of external resources #192

Open

tedteng force-pushed the master branch from b68f96a to 64c5fbc Compare April 29, 2020 06:52

gardener-robot-ci-3 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Apr 29, 2020

gardener-robot-ci-1 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Apr 29, 2020

tedteng mentioned this pull request May 5, 2020

gardenctl ssh does not work #191

Closed

gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label May 11, 2020

gardener-robot-ci-2 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label May 11, 2020

tedteng force-pushed the master branch from 6058dd3 to 2055bf9 Compare May 12, 2020 00:37

gardener-robot-ci-1 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels May 12, 2020

gardener-robot-ci-3 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label May 12, 2020

gardener-robot-ci-2 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label May 12, 2020

DockToFuture suggested changes May 25, 2020

View reviewed changes

gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label May 25, 2020

gardener-robot-ci-1 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels May 25, 2020

tedteng commented May 25, 2020

View reviewed changes

gardener-robot-ci-3 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label May 25, 2020

gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label May 26, 2020

gardener-robot-ci-3 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label May 26, 2020

gardener-robot-ci-3 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label May 28, 2020

gardener-robot-ci-1 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label May 28, 2020

tedteng closed this May 29, 2020

tedteng force-pushed the master branch from d448bec to d422d29 Compare May 29, 2020 04:57

gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label May 29, 2020

tedteng mentioned this pull request Jul 20, 2020

Extension concept for cloud-provider specific operations #208

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

gardenctl ssh improvement #195

gardenctl ssh improvement #195

tedteng commented Apr 27, 2020 •

edited

Loading

vpnachev commented Apr 29, 2020

tedteng commented Apr 30, 2020 •

edited

Loading

vpnachev commented Apr 30, 2020

tedteng commented Apr 30, 2020 •

edited

Loading

tedteng commented May 12, 2020

DockToFuture left a comment

DockToFuture May 25, 2020

tedteng May 25, 2020

DockToFuture May 25, 2020

tedteng May 25, 2020

tedteng May 25, 2020

tedteng left a comment

tedteng May 25, 2020

gardenctl ssh improvement #195

gardenctl ssh improvement #195

Conversation

tedteng commented Apr 27, 2020 • edited Loading

vpnachev commented Apr 29, 2020

tedteng commented Apr 30, 2020 • edited Loading

vpnachev commented Apr 30, 2020

tedteng commented Apr 30, 2020 • edited Loading

tedteng commented May 12, 2020

DockToFuture left a comment

Choose a reason for hiding this comment

DockToFuture May 25, 2020

Choose a reason for hiding this comment

tedteng May 25, 2020

Choose a reason for hiding this comment

DockToFuture May 25, 2020

Choose a reason for hiding this comment

tedteng May 25, 2020

Choose a reason for hiding this comment

tedteng May 25, 2020

Choose a reason for hiding this comment

tedteng left a comment

Choose a reason for hiding this comment

tedteng May 25, 2020

Choose a reason for hiding this comment

tedteng commented Apr 27, 2020 •

edited

Loading

tedteng commented Apr 30, 2020 •

edited

Loading

tedteng commented Apr 30, 2020 •

edited

Loading