From Ganeti 2.12 to 2.13, we switched from a one-ssh-key setup
to a setup with individual SSH keys. Unfortunately, the current
implementation of renew-crypto deleted the master key when it
inteded to delete a non-master node's key if it was run in a
one-ssh-key setup. This patch fixes it by fetching the key of
the node first and only delete it, if it differs from the
master key.
This fixes bug 1065.
Signed-off-by: Helga Velroyen <[email protected]>
---
lib/backend.py | 38 +++++++++++++++++++++++++++-----------
1 file changed, 27 insertions(+), 11 deletions(-)
diff --git a/lib/backend.py b/lib/backend.py
index 90f8def..711dced 100644
--- a/lib/backend.py
+++ b/lib/backend.py
@@ -1890,6 +1890,8 @@ def RenewSshKeys(node_uuids, node_names, ssh_port_map,
(_, root_keyfiles) = \
ssh.GetAllUserFiles(constants.SSH_LOGIN_USER, mkdir=False, dircheck=False)
+ (_, dsa_pub_keyfile) = root_keyfiles[constants.SSHK_DSA]
+ old_master_key = utils.ReadFile(dsa_pub_keyfile)
node_uuid_name_map = zip(node_uuids, node_names)
@@ -1910,16 +1912,31 @@ def RenewSshKeys(node_uuids, node_names, ssh_port_map,
% (node_name, node_uuid))
if master_candidate:
- logging.debug("Removing SSH key of node '%s'." % node_name)
- RemoveNodeSshKey(node_uuid, node_name,
- master_candidate_uuids,
- potential_master_candidates,
- ssh_port_map,
- master_uuid=master_node_uuid,
- from_authorized_keys=master_candidate,
- from_public_keys=False,
- clear_authorized_keys=False,
- clear_public_keys=False)
+ logging.debug("Fetching old SSH key from node '%s'.", node_name)
+ old_pub_key = ssh.ReadRemoteSshPubKeys(dsa_pub_keyfile,
+ node_name, cluster_name,
+ ssh_port_map[node_name],
+ False, # ask_key
+ False) # key_check
+ if old_pub_key != old_master_key:
+ # If we are already in a multi-key setup (that is past Ganeti 2.12),
+ # we can safely remove the old key of the node. Otherwise, we cannot
+ # remove that node's key, because it is also the master node's key
+ # and that would terminate all communication from the master to the
+ # node.
+ logging.debug("Removing SSH key of node '%s'.", node_name)
+ RemoveNodeSshKey(node_uuid, node_name,
+ master_candidate_uuids,
+ potential_master_candidates,
+ ssh_port_map,
+ master_uuid=master_node_uuid,
+ from_authorized_keys=master_candidate,
+ from_public_keys=False,
+ clear_authorized_keys=False,
+ clear_public_keys=False)
+ else:
+ logging.debug("Old key of node '%s' is the same as the current master"
+ " key. Not deleting that key on the node.", node_name)
logging.debug("Generating new SSH key for node '%s'.", node_name)
_GenerateNodeSshKey(node_uuid, node_name, ssh_port_map,
@@ -1929,7 +1946,6 @@ def RenewSshKeys(node_uuids, node_names, ssh_port_map,
run_cmd_fn=run_cmd_fn)
try:
- (_, dsa_pub_keyfile) = root_keyfiles[constants.SSHK_DSA]
logging.debug("Fetching newly created SSH key from node '%s'.", node_name)
pub_key = ssh.ReadRemoteSshPubKeys(dsa_pub_keyfile,
node_name, cluster_name,
--
2.2.0.rc0.207.ga3a616c
