Fix prestage playbook access to subcloud denied when host key changes
Steps to Reproduce:
1 Upgrade system controller
2 Upgrade subcloud
3 prestage subcloud for reinstallation
The issue came from “Upgrade Subcloud” rather than prestage. At the
end of upgrade, it restored the old ssh configurations including
public keys on the subclouds which cause the ssh authentication
failed in the next step.
This is a generic fix for all of the playbooks (eg. reinstall,
upgrade, prestage, etc.). This UserKnownHostsFile=/dev/null ssh
option will make sure not save the host key as trusted for added
security no matter the host key changed or not. It combined with
the existing StrictHostKeyChecking=no option will disable
the public key checking for ssh connections.
Test Plan:
PASS:
- Verify installation without failures
- Verify upgrade subclouds without any access failures
- Verify prestage without subclouds access failures
- Verify no subclouds access failures according to the given
100% reproducible steps.
Closes-Bug: 1967798
Signed-off-by: Li Zhu <email address hidden>
Change-Id: I100a65845875d93666f7e6b60b92f8e9add653e4
Reviewed: https:/ /review. opendev. org/c/starlingx /distcloud/ +/836400 /opendev. org/starlingx/ distcloud/ commit/ d9af1bf0ec17955 d9a76800448189b 37443fd6b6
Committed: https:/
Submitter: "Zuul (22348)"
Branch: master
commit d9af1bf0ec17955 d9a76800448189b 37443fd6b6
Author: Li Zhu <email address hidden>
Date: Mon Apr 4 15:42:02 2022 -0400
Fix prestage playbook access to subcloud denied when host key changes
Steps to Reproduce:
1 Upgrade system controller
2 Upgrade subcloud
3 prestage subcloud for reinstallation
The issue came from “Upgrade Subcloud” rather than prestage. At the
end of upgrade, it restored the old ssh configurations including
public keys on the subclouds which cause the ssh authentication
failed in the next step.
This is a generic fix for all of the playbooks (eg. reinstall, ile=/dev/ null ssh ecking= no option will disable
upgrade, prestage, etc.). This UserKnownHostsF
option will make sure not save the host key as trusted for added
security no matter the host key changed or not. It combined with
the existing StrictHostKeyCh
the public key checking for ssh connections.
Test Plan:
PASS:
- Verify installation without failures
- Verify upgrade subclouds without any access failures
- Verify prestage without subclouds access failures
- Verify no subclouds access failures according to the given
100% reproducible steps.
Closes-Bug: 1967798 3666f7e6b60b92f 8e9add653e4
Signed-off-by: Li Zhu <email address hidden>
Change-Id: I100a65845875d9