GoogleComputeEngineSSHKeys

Differences between revisions 1 and 5 (spanning 4 versions)
Revision 1 as of 2014-12-17 17:18:30
Size: 1964
Editor: oddbloke
Comment: Create page
Revision 5 as of 2018-05-17 21:03:31
Size: 2343
Editor: davecore
Comment:
Deletions are marked like this. Additions are marked like this.
Line 1: Line 1:
When an Ubuntu instance is booted within a Google Compute Engine project, SSH keys are sourced from two places: the project-level metadata, and the instance-level metadata. There are two methods that are then used to put these keys in place on an Ubuntu instance: cloud-init and the GCE daemon. In Google Compute Engine, you can connect to Ubuntu instances through either the Google Cloud Platform Console or the gcloud command-line tool. Google Compute Engine generates an SSH key for you and stores it in one of the following locations:
Line 3: Line 3:
Project-level SSH keys can be found either through the web interface in ‘Compute > Compute Engine > Metadata’ on the project page, or by looking at the value of `sshKeys` in the output of `gcloud compute project-info describe`. Each of these SSH keys specifies a user and a corresponding public key.  *By default, Compute Engine adds the generated key to [[https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys|project or instance metadata]].
 *If your account is configured to use [[https://cloud.google.com/compute/docs/instances/managing-instance-access|OS Login]], Compute Engine stores the generated key with your user account.
Line 5: Line 6:
Instance-level SSH keys are specified in metadata on starting an instance; see https://cloud.google.com/compute/docs/instances#setting_up_ssh_keys_at_the_instance_level for more details on how this is done. For more information, please refer to the [[https://cloud.google.com/compute/docs/instances/connecting-to-instance|Connecting to Linux Instances]] documentation from the Google Cloud documentation.
Line 7: Line 8:
When an Ubuntu instance is started in Google Compute Engine project with project-level SSH keys, cloud-init will always create an `ubuntu` user and add all of the project-level SSH keys (regardless of the user name they are assigned to) to `.ssh/authorized_keys` in the `ubuntu` user’s home directory. Starting from cloud-init version 17.2-20-g32a6a176-0ubuntu1, there are Ubuntu-specific cloud-init behaviours for the ubuntu and cloudinit users. Cloud-init will add keys to the ubuntu user from the metadata for the cloudinit and ubuntu users.
Line 9: Line 10:
If instance-level SSH keys are provided, the GCE daemon will only apply those to an instance; project-level SSH keys are disregarded. If (and only if) instance-level SSH keys are not specified, the GCE daemon will apply project-level SSH keys.

Once the metadata to use has been determined, the GCE daemon will create a user for each SSH key, and add the corresponding public key to `.ssh/authorized_keys` in their home directory.

In pseudo-code, the GCE daemon does the following:
For example, assume the following 'mykeys' file that holds public SSH keys for 3 users (test, ubuntu and cloudinit) prefixed with "<username>:":
Line 16: Line 13:
    sshKeys = []
    if ‘sshKeys’ in instanceMetadata:
        sshKeys = instanceMetadata[‘sshKeys’]
    elif ‘sshKeys’ in projectMetadata:
        sshKeys = projectMetadata[‘sshKeys’]
    
    for username, publicKey in sshKeys:
        create_user(username)
        add_authorized_key_for_user(username, publicKey)
test:ssh-rsa <key for test user> test@example.com
ubuntu:ssh-rsa <key for ubuntu user> test@example.com
cloudinit:ssh-rsa <key for cloudinit user> test@example.com
Line 26: Line 17:

Create a new instance with these keys as instance metadata:

{{{
gcloud compute instances create ubuntu --image-family ubuntu-1604-lts \
       --image-project ubuntu-os-cloud --metadata-from-file=ssh-keys=mykeys \
       --metadata=block-project-ssh-keys=True
}}}

The end result will be that the ubuntu user will get the two ubuntu and cloudinit keys from cloud-init. Note that it will also receive keys from the Google accounts daemon, but this is out of scope for this article:

{{{
root@ubuntu:~# cat /home/ubuntu/.ssh/authorized_keys

ssh-rsa <cloudinit key> test@example.com
ssh-rsa <ubuntu key> test@example.com
# Added by Google
ssh-rsa <also the ubuntu key, populated by the Google accounts daemon> test@example.com
}}}

Also note that the ubuntu user will still receive the ubuntu and cloudinit public keys from the metadata even when [[https://cloud.google.com/compute/docs/instances/managing-instance-access|OS Login]] is enabled.

In Google Compute Engine, you can connect to Ubuntu instances through either the Google Cloud Platform Console or the gcloud command-line tool. Google Compute Engine generates an SSH key for you and stores it in one of the following locations:

  • By default, Compute Engine adds the generated key to project or instance metadata.

  • If your account is configured to use OS Login, Compute Engine stores the generated key with your user account.

For more information, please refer to the Connecting to Linux Instances documentation from the Google Cloud documentation.

Starting from cloud-init version 17.2-20-g32a6a176-0ubuntu1, there are Ubuntu-specific cloud-init behaviours for the ubuntu and cloudinit users. Cloud-init will add keys to the ubuntu user from the metadata for the cloudinit and ubuntu users.

For example, assume the following 'mykeys' file that holds public SSH keys for 3 users (test, ubuntu and cloudinit) prefixed with "<username>:":

test:ssh-rsa <key for test user> test@example.com
ubuntu:ssh-rsa <key for ubuntu user> test@example.com
cloudinit:ssh-rsa <key for cloudinit user> test@example.com

Create a new instance with these keys as instance metadata:

gcloud compute instances create ubuntu --image-family ubuntu-1604-lts \
       --image-project ubuntu-os-cloud --metadata-from-file=ssh-keys=mykeys \
       --metadata=block-project-ssh-keys=True

The end result will be that the ubuntu user will get the two ubuntu and cloudinit keys from cloud-init. Note that it will also receive keys from the Google accounts daemon, but this is out of scope for this article:

root@ubuntu:~# cat /home/ubuntu/.ssh/authorized_keys 

ssh-rsa <cloudinit key> test@example.com
ssh-rsa <ubuntu key> test@example.com
# Added by Google
ssh-rsa <also the ubuntu key, populated by the Google accounts daemon> test@example.com

Also note that the ubuntu user will still receive the ubuntu and cloudinit public keys from the metadata even when OS Login is enabled.

GoogleComputeEngineSSHKeys (last edited 2018-05-17 21:03:31 by davecore)