Enhance troubleshooting for SSH key injection #795

ldomb · 2018-12-05T21:33:16Z

Added some more documentation around ssh. I don't think its clear to everyone that "core" is the user needed for ssh nor howto generate the config for the sshKey used in the installation.

…familiar with coreos

openshift-ci-robot · 2018-12-05T21:33:32Z

Hi @ldomb. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2018-12-05T21:33:58Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ldomb
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: rajatchopra

If they are not already assigned, you can assign the PR to them by writing /assign @rajatchopra in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

ldomb · 2018-12-05T21:47:42Z

/assign @rajatchopra

docs/user/troubleshooting.md

ldomb · 2018-12-06T14:43:47Z

doc needs to be adjusted

wking · 2018-12-06T17:42:56Z

docs/user/troubleshooting.md

@@ -52,7 +52,9 @@ If no pods are shown, etcd will need to be [investigated](#etcd-is-not-running).

 ### Unable to SSH into Master Nodes

-In order to SSH into the master nodes, it is necessary to include an administrator's SSH key during the installation. If SSH authentication is failing, ensure that the proper SSH key is being used.
+In order to SSH into the master nodes as user `core`, it is necessary to include an administrator's SSH key during the installation. When asked by the installation wizzard for the ssh-key, make sure you define the absolute path to your key. This key will be added to the core user's authorized_keys file. If installed in aws you will not see this key attached to your instance as a keypair in the aws console. 


nits: "ssh" -> "SSH". "SSH" is the protocol; ssh is just the executable. And "core" -> "core" and "authorized_keys" -> "authorized_keys". And "aws" -> "AWS".

Re: "absolute path", the wizard prompt is a Select of your ~/.ssh/*.pub. I don't think it allows free-form input (or at least, it didn't allow it in my tests).

minor: "wizzard" -> "wizard"

kikisdeliveryservice · 2018-12-07T19:11:47Z

docs/user/troubleshooting.md

-In order to SSH into the master nodes, it is necessary to include an administrator's SSH key during the installation. If SSH authentication is failing, ensure that the proper SSH key is being used.
+In order to SSH into the master nodes as user `core`, it is necessary to include an administrator's SSH key during the installation. When asked by the installation wizzard for the ssh-key, make sure you define the absolute path to your key. This key will be added to the core user's authorized_keys file. If installed in aws you will not see this key attached to your instance as a keypair in the aws console. 
+
+If SSH authentication is failing, ensure that the proper SSH key is being used.


Could we add something like: "Verify your SSH Key by using oc get configmap -n kube-system cluster-config-v1 -o yaml etc... after "ensure that the proper SSH key is being used."? Because I don't think it's clear for people how to verify the key without restarting the install.

I still think we should add something like this to the documentation.

With the oc get configmap ... and associated lead-in above, I think we can drop this line.

wking · 2019-01-02T17:50:12Z

@ldomb, do you have time to come back to this and address the remaining feedback? Just had another report here from someone who could have used the "user is core" documentation. If you don't have time, do you mind if I carry your commit into a new PR that addresses the feedback?

ldomb · 2019-01-02T19:26:19Z

Done, let me know if that works for you

…

On Wed, Jan 2, 2019 at 12:50 PM W. Trevor King ***@***.***> wrote: @ldomb <https://github.com/ldomb>, do you have time to come back to this and address the remaining feedback? Just had another report here <https://groups.google.com/d/msg/openshift-4-dev-preview/5wgpUsoxzDw/2PR5hBYiCAAJ> from someone who could have used the "user is core" documentation. If you don't have time, do you mind if I carry your commit into a new PR that addresses the feedback? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#795 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABarZuDSBqAfaAG1ziL1SL5C4-lsqKvkks5u_PFdgaJpZM4ZFJDW> .

wking · 2019-01-02T19:44:32Z

docs/user/troubleshooting.md

@@ -50,9 +50,9 @@ sudo crictl pods --name=etcd-member

 If no pods are shown, etcd will need to be [investigated](#etcd-is-not-running).

-### Unable to SSH into Master Nodes
+### Unable to access the Master Nodes via SSH 


nit: trailing whitespace (and also in the next paragraph).

I'd rather leave this header alone (since I'm fine with "SSH" as a verb). But if you want to update it, you'll also need to update references to it:

$ git grep unable-to origin/pr/795 origin/pr/795:docs/user/troubleshooting.md:If SSH access to the master nodes isn't available, that will need to be [investigated next](#unable-to-ssh-into-master-node).

And it looks like that link is already broken in master because it uses -node instead of -nodes. I've filed #980 to fix that, so you don't have to worry about it if you leave the header alone.

wking · 2019-01-02T20:00:08Z

docs/user/troubleshooting.md


-In order to SSH into the master nodes as user `core`, it is necessary to include an administrator's SSH key during the installation. When asked by the installation wizzard for the ssh-key, make sure you define the absolute path to your key. This key will be added to the core user's authorized_keys file. If installed in aws you will not see this key attached to your instance as a keypair in the aws console. 
+In order to ssh into the master nodes as user **core**, it is necessary to include an administrator's ssh-key during the installation. When asked by the installation wizard for the ssh-key, make sure you select your ssh-key from the wizard prompt **~/.ssh/*.pub**. This key will be added to the **core** user's **authorized_keys** file. If installed in AWS you will **not** see this key attached to your instance as a keypair in the AWS console. 


This is moving in the wrong direction with SSH -> ssh. Per this comment, you should be using "SSH" (for the protocol) everywhere unless you are writing ssh ... for a shell command.

Also, core is more appropriate than core, because the username is literal code you could paste into shell scripts. Similarly for your paths (~/.ssh/*.pub and authorized_keys).

not would be more appropriate than not, because this is for local emphasis. For example, see "However, it should not be used..." and "This is not a drill". And the AWS docs use "key pair", not "keypair". So I'd rather see something like:

The public key is placed in authorized_keys by Ignition; it is not configured via platform-specific approaches like AWS key pairs.

instead of your last two sentences.

kikisdeliveryservice · 2019-01-02T20:07:48Z

Is there a reason why you didn't add my suggestion here?: #795 (comment)

ldomb · 2019-01-02T22:06:03Z

Added section for comment 795

ldomb · 2019-01-02T22:38:42Z

No no reason, added it to the doc

…

On Wed, Jan 2, 2019 at 3:07 PM Kirsten ***@***.***> wrote: Is there a reason why you didn't add my suggestion here?: #795 (comment) <#795 (comment)> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#795 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABarZiIW3W8E3mXVWZtTGBdrc4kkhGTDks5u_RGcgaJpZM4ZFJDW> .

wking · 2019-01-02T23:15:37Z

docs/user/troubleshooting.md


-In order to SSH into the master nodes, it is necessary to include an administrator's SSH key during the installation. If SSH authentication is failing, ensure that the proper SSH key is being used.
+In order to SSH into the master nodes as user `core`, it is necessary to include an administrator's ssh-key during the installation. When asked by the installation wizard for the ssh-key, make sure you select your ssh-key from the wizard prompt `~/.ssh/*.pub`. This key will be added to the `core` user's `authorized_keys` file. The public key is placed in authorized_keys by Ignition and is not configured via platform-specific approaches like [AWS key pairs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html). To verify if you added the correct ssh-key during installation you can use thefollowing command:


"thefollowing" -> "the following". Or just end with:

You can verify the configured SSH key with:

oc get configmap ...

There's also an authorized_keys that still needs backticks.

I'd prefer to use reference-style links for external links (like we do now for kubernetes-debug), but if you're tired of tweaking, I'm ok with the inline link.

docs/user/troubleshooting.md

wking · 2019-01-02T23:51:15Z

docs/user/troubleshooting.md

-In order to SSH into the master nodes, it is necessary to include an administrator's SSH key during the installation. If SSH authentication is failing, ensure that the proper SSH key is being used.
+In order to SSH into the master nodes as user `core`, it is necessary to include an administrator's SSH key during the installation. When asked by the installation wizzard for the ssh-key, make sure you define the absolute path to your key. This key will be added to the core user's authorized_keys file. If installed in aws you will not see this key attached to your instance as a keypair in the aws console. 
+
+If SSH authentication is failing, ensure that the proper SSH key is being used.


With the oc get configmap ... and associated lead-in above, I think we can drop this line.

…ion is failing ...

wking · 2019-01-03T08:01:41Z

I've pushed 73aa0e4 with the remaining changes I'd like to see here, in case squashing that in is easier than working through GitHub review comments. You should be able to add that commit to your branch with:

$ git pull https://github.com/wking/openshift-installer.git ssh-detail-fixups

if it looks good to you. Then squash this branch down to a single commit, and we should be good to go :).

…H auth…

ldomb · 2019-01-03T13:49:04Z

Squashed commits and created a new PR #986 Also added your changes. But had to modify the links as you have two [][] instead of []()

…

On Thu, Jan 3, 2019 at 3:01 AM W. Trevor King ***@***.***> wrote: I've pushed 73aa0e4 <73aa0e4> with the remaining changes I'd like to see here, in case squashing that in is easier than working through GitHub review comments. You should be able to add that commit to your branch with: $ git pull https://github.com/wking/openshift-installer.git ssh-detail-fixups if it looks good to you. Then squash this branch down to a single commit, and we should be good to go :). — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#795 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABarZvElQ2OaqWPyazlDF79WeDeKnesZks5u_bjtgaJpZM4ZFJDW> .

wking · 2019-01-03T19:50:17Z

Squashed commits and created a new PR

In the future, it's better to force-push to your existing branch instead of creating a new pull request. That way it's easier for folks starting from a landed commit to find the PR discussion.

But had to modify the links as you have two [][] instead of []()

Those were intentional. See the docs for reference-style links and the implicit link name shortcut. But whatever, inline links work too ;).

Laurent Domb added 2 commits December 5, 2018 16:27

added some more specifics to get ssh working for users which are not …

fade1f8

…familiar with coreos

highlight core as well

d6c5b4b

openshift-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Dec 5, 2018

openshift-ci-robot requested review from abhinavdahiya and wking December 5, 2018 21:34

openshift-ci-robot assigned rajatchopra Dec 5, 2018

wking changed the title ~~Enahncetrshooting~~ Enhance troubleshooting for SSH key injection Dec 5, 2018

wking reviewed Dec 5, 2018

View reviewed changes

docs/user/troubleshooting.md Outdated Show resolved Hide resolved

added more specific information around ssh troubleshooting for aws

f1cf969

wking reviewed Dec 6, 2018

View reviewed changes

kikisdeliveryservice reviewed Dec 7, 2018

View reviewed changes

Laurent Domb added 3 commits January 2, 2019 14:18

addressed remaining feedback for troubleshooting of ssh

5488da0

fixed ssh-key to be consistent

e38ad4e

removed brackets for ssh-key

7b7f8eb

wking reviewed Jan 2, 2019

View reviewed changes

added suggested changes to troubleshoot doc

5ef154c

openshift-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Jan 2, 2019

added suggestion and fixed colon and ssh-key

268f402

wking reviewed Jan 2, 2019

View reviewed changes

updated command to verify ssh-key and removed line If SSH authenticat…

676d92c

…ion is failing ...

openshift-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jan 3, 2019

added fixup! updated command to verify ssh-key and removed line If SS…

c534e54

…H auth…

ldomb closed this Jan 3, 2019

ldomb deleted the enahncetrshooting branch January 3, 2019 13:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enhance troubleshooting for SSH key injection #795

Enhance troubleshooting for SSH key injection #795

ldomb commented Dec 5, 2018

openshift-ci-robot commented Dec 5, 2018

openshift-ci-robot commented Dec 5, 2018

ldomb commented Dec 5, 2018

ldomb commented Dec 6, 2018 •

edited

Loading

wking Dec 6, 2018

kikisdeliveryservice Dec 7, 2018

kikisdeliveryservice Dec 7, 2018 •

edited

Loading

kikisdeliveryservice Jan 2, 2019 •

edited

Loading

wking Jan 2, 2019

wking commented Jan 2, 2019

ldomb commented Jan 2, 2019 via email

wking Jan 2, 2019

wking Jan 2, 2019

kikisdeliveryservice commented Jan 2, 2019

ldomb commented Jan 2, 2019

ldomb commented Jan 2, 2019 via email

wking Jan 2, 2019

wking Jan 2, 2019

wking commented Jan 3, 2019

ldomb commented Jan 3, 2019 via email

wking commented Jan 3, 2019


		In order to SSH into the master nodes as user `core`, it is necessary to include an administrator's SSH key during the installation. When asked by the installation wizzard for the ssh-key, make sure you define the absolute path to your key. This key will be added to the core user's authorized_keys file. If installed in aws you will not see this key attached to your instance as a keypair in the aws console.
		In order to ssh into the master nodes as user core, it is necessary to include an administrator's ssh-key during the installation. When asked by the installation wizard for the ssh-key, make sure you select your ssh-key from the wizard prompt *~/.ssh/.pub. This key will be added to the core user's authorized_keys file. If installed in AWS you will not** see this key attached to your instance as a keypair in the AWS console.


		In order to SSH into the master nodes, it is necessary to include an administrator's SSH key during the installation. If SSH authentication is failing, ensure that the proper SSH key is being used.
		In order to SSH into the master nodes as user `core`, it is necessary to include an administrator's ssh-key during the installation. When asked by the installation wizard for the ssh-key, make sure you select your ssh-key from the wizard prompt `~/.ssh/*.pub`. This key will be added to the `core` user's `authorized_keys` file. The public key is placed in authorized_keys by Ignition and is not configured via platform-specific approaches like [AWS key pairs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html). To verify if you added the correct ssh-key during installation you can use thefollowing command:

Enhance troubleshooting for SSH key injection #795

Enhance troubleshooting for SSH key injection #795

Conversation

ldomb commented Dec 5, 2018

openshift-ci-robot commented Dec 5, 2018

openshift-ci-robot commented Dec 5, 2018

ldomb commented Dec 5, 2018

ldomb commented Dec 6, 2018 • edited Loading

wking Dec 6, 2018

Choose a reason for hiding this comment

kikisdeliveryservice Dec 7, 2018

Choose a reason for hiding this comment

kikisdeliveryservice Dec 7, 2018 • edited Loading

Choose a reason for hiding this comment

kikisdeliveryservice Jan 2, 2019 • edited Loading

Choose a reason for hiding this comment

wking Jan 2, 2019

Choose a reason for hiding this comment

wking commented Jan 2, 2019

ldomb commented Jan 2, 2019 via email

wking Jan 2, 2019

Choose a reason for hiding this comment

wking Jan 2, 2019

Choose a reason for hiding this comment

kikisdeliveryservice commented Jan 2, 2019

ldomb commented Jan 2, 2019

ldomb commented Jan 2, 2019 via email

wking Jan 2, 2019

Choose a reason for hiding this comment

wking Jan 2, 2019

Choose a reason for hiding this comment

wking commented Jan 3, 2019

ldomb commented Jan 3, 2019 via email

wking commented Jan 3, 2019

ldomb commented Dec 6, 2018 •

edited

Loading

kikisdeliveryservice Dec 7, 2018 •

edited

Loading

kikisdeliveryservice Jan 2, 2019 •

edited

Loading