Fix VM creation and update when sshAccess is disabled.

[AleksandarSavchev]

What this PR does / why we need it:
This PR fixes creation and update of azure VMs when sshAccess is disabled by adding a "fake" PublicKey.

Currently, creating an azure shoot with sshAccess disabled is not possible since the shoot would fail in reconciliation. It fails with the following cloud provider validation error: The value of parameter linuxConfiguration.ssh.publicKeys.keyData is invalid. since its value is "".

After removing SSH from LinuxConfiguration it starts failing with this cloud provider error: Authentication using either SSH or by user name and password must be enabled in Linux profile., which would suggest we need to provide either SSH or an adminPassword. We do not include the adminPassword and it is ill-advised to do so. The only option left would be to pass a "fake" PublicKey.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Release note:

Fixed VM creation and update when `sshAccess` is disabled.

[himanshu-kun]

@AleksandarSavchev could you mention why an SSH access disablement is required ? Any gardener issue , slack thread ? We would like to know the context , as this will affect all our mcm-providers.
cc @ashwani2k @unmarshall

[AleksandarSavchev]

@himanshu-kun disabling SSH access is needed to make our clusters compliant with DISA STIGs rules 242393 and 242394. You can find the backlog issue for these changes here. For more information you can check the PR that added SSHAccess field to shoot description: ref.

[unmarshall]

As per MicrosoftDocs/azure-docs#14447 it should be possible to block SSH access by configuring network security group. Have you already tried this out?

[kon-angelo]

@unmarshall there are 2 issues:
a) The links that @AleksandarSavchev posted show that the endgoal is to disable the sshd daemon of the nodes - not disable SSH access somehow e.g. with NSGs.
b) If when shoot.spec.sshAccess is disabled, gardener does not create any SSH public key, then the machineclass will be invalid anyway. I think this was the original problem, that the since there isn't a key anymore, machine creation fails anyway.

[himanshu-kun]

a) The links that @AleksandarSavchev posted show that the endgoal is to disable the sshd daemon of the nodes - not disable SSH access somehow e.g. with NSGs.

But then the current solution of passing a fake ssh key also doesn't solve the problem as the sshd is still enabled. @AleksandarSavchev could you confirm if the requirement is to disable ssh access and not a specific requirement of disable ssh daemon ?

[AleksandarSavchev]

When a shoot is configured with SSHAccess disabled a service called sshd-ensurer runs a script every 30 seconds which disables and stops the sshd service if enabled and/or running, it also kills any ssh connections. With SSHAccess disabled no public keys are created and the creation of bastions is disabled as well(ref: gardener/gardener#7188)

The problem of disabling ssh access has already been solved by the upper mentioned functionality. The problem in provider-azure is that we cannot create shoots with SSHAccess disabled, since there are no SSH public keys.

[himanshu-kun]

we already have a test for admin name

machine-controller-manager-provider-azure/pkg/azure/core_test.go

Lines 409 to 422 in 1d20246

	Entry("#15 Create machine without Admin Username in providerSpec",
	&mock.AzureProviderSpecWithoutAdminUserName,
	&driver.CreateMachineRequest{
	Machine: newMachine("dummy-machine"),
	MachineClass: newAzureMachineClass(mock.AzureProviderSpecWithoutAdminUserName),
	Secret: newSecret(azureProviderSecret),
	},
	nil,
	nil,
	nil,
	nil,
	nil,
	true,
	fmt.Errorf(internalErrorPrefix, "properties.osProfile.adminUsername: Required value: AdminUsername is required").Error(),

Similarly , pls also add the following test case:

• when providerSpec.Properties.OsProfile.LinuxConfiguration.SSH.PublicKeys.KeyData is not supplied , we get the following error

Failure sending request: StatusCode=400 -- Original Error: Code="InvalidParameter" Message="The value of parameter linuxConfiguration.ssh.publicKeys.keyData is invalid." Target="linuxConfiguration.ssh.publicKeys.keyData"

[himanshu-kun]

When a shoot is configured with SSHAccess disabled a service called sshd-ensurer runs a script every 30 seconds which disables and stops the sshd service if enabled and/or running, it also kills any ssh connections. With SSHAccess disabled no public keys are created and the creation of bastions is disabled as well(ref: gardener/gardener#7188)

The problem of disabling ssh access has already been solved by the upper mentioned functionality. The problem in provider-azure is that we cannot create shoots with SSHAccess disabled, since there are no SSH public keys.

thanks for the context and sorry for the delay. I tried this out myself ..
the machineClass looked like this when workersSettings.sshAccess.enabled: false

osProfile:
      adminUsername: core
      linuxConfiguration:
        disablePasswordAuthentication: true
        ssh:
          publicKeys:
            keyData: null
            path: /home/core/.ssh/authorized_keys

the error from provider was

Cloud provider message - machine codes error: code = [Internal] message = [compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="InvalidParameter" Message="The value of parameter linuxConfiguration.ssh.publicKeys.keyData is invalid." Target="linuxConfiguration.ssh.publicKeys.keyData"]

I have reviewed the PR, kindly address , then we'll merge it.

[himanshu-kun]

/lgtm
Thnx , this looks better!