From c11b8403b65de75fb59026490e67be41882dc8f2 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Fri, 11 Apr 2025 13:43:18 -0700
Subject: [PATCH] Manage gerrit's ecdsa and ed25519 hostkeys
This came up as something that was missing while we bootstrapped a new
gerrit server. The rsa hostkey is managed but none of the three ecdsa
keys or the ed25519 key is. Fix that by managing these keys in the same
manner we manager the RSA key.
Change-Id: Iaf58543b6833273ca45fa5c359dc88eaf64d7a03
---
playbooks/roles/gerrit/tasks/main.yaml | 70 ++++++++++++++++++-
.../host_vars/review99.opendev.org.yaml.j2 | 50 +++++++++++++
2 files changed, 117 insertions(+), 3 deletions(-)
diff --git a/playbooks/roles/gerrit/tasks/main.yaml b/playbooks/roles/gerrit/tasks/main.yaml
index 1ccf6dc7aa..fa2f0ce8ac 100644
--- a/playbooks/roles/gerrit/tasks/main.yaml
+++ b/playbooks/roles/gerrit/tasks/main.yaml
@@ -96,8 +96,8 @@
group: "{{ gerrit_user_name }}"
mode: 0644
-# Server host key for SSH service on port 29418
-- name: Write Gerrit SSH host private key
+# Server host keys for SSH service on port 29418
+- name: Write Gerrit SSH RSA host private key
copy:
content: "{{ gerrit_ssh_rsa_key_contents }}"
dest: "{{ gerrit_site_dir }}/etc/ssh_host_rsa_key"
@@ -105,7 +105,7 @@
group: "{{ gerrit_user_name }}"
mode: 0600
-- name: Write Gerrit SSH host public key
+- name: Write Gerrit SSH RSA host public key
copy:
content: "{{ gerrit_ssh_rsa_pubkey_contents }}"
dest: "{{ gerrit_site_dir }}/etc/ssh_host_rsa_key.pub"
@@ -113,6 +113,70 @@
group: "{{ gerrit_user_name }}"
mode: 0644
+- name: Write Gerrit SSH ECDSA host private key
+ copy:
+ content: "{{ gerrit_ssh_ecdsa_key_contents }}"
+ dest: "{{ gerrit_site_dir }}/etc/ssh_host_ecdsa_key"
+ owner: "{{ gerrit_user_name }}"
+ group: "{{ gerrit_user_name }}"
+ mode: 0600
+
+- name: Write Gerrit SSH ECDSA host public key
+ copy:
+ content: "{{ gerrit_ssh_ecdsa_pubkey_contents }}"
+ dest: "{{ gerrit_site_dir }}/etc/ssh_host_ecdsa_key.pub"
+ owner: "{{ gerrit_user_name }}"
+ group: "{{ gerrit_user_name }}"
+ mode: 0644
+
+- name: Write Gerrit SSH ECDSA 384 host private key
+ copy:
+ content: "{{ gerrit_ssh_ecdsa_384_key_contents }}"
+ dest: "{{ gerrit_site_dir }}/etc/ssh_host_ecdsa_384_key"
+ owner: "{{ gerrit_user_name }}"
+ group: "{{ gerrit_user_name }}"
+ mode: 0600
+
+- name: Write Gerrit SSH ECDSA 384 host public key
+ copy:
+ content: "{{ gerrit_ssh_ecdsa_384_pubkey_contents }}"
+ dest: "{{ gerrit_site_dir }}/etc/ssh_host_ecdsa_384_key.pub"
+ owner: "{{ gerrit_user_name }}"
+ group: "{{ gerrit_user_name }}"
+ mode: 0644
+
+- name: Write Gerrit SSH ECDSA 521 host private key
+ copy:
+ content: "{{ gerrit_ssh_ecdsa_521_key_contents }}"
+ dest: "{{ gerrit_site_dir }}/etc/ssh_host_ecdsa_521_key"
+ owner: "{{ gerrit_user_name }}"
+ group: "{{ gerrit_user_name }}"
+ mode: 0600
+
+- name: Write Gerrit SSH ECDSA 521 host public key
+ copy:
+ content: "{{ gerrit_ssh_ecdsa_521_pubkey_contents }}"
+ dest: "{{ gerrit_site_dir }}/etc/ssh_host_ecdsa_521_key.pub"
+ owner: "{{ gerrit_user_name }}"
+ group: "{{ gerrit_user_name }}"
+ mode: 0644
+
+- name: Write Gerrit SSH ED25519 host private key
+ copy:
+ content: "{{ gerrit_ssh_ed25519_key_contents }}"
+ dest: "{{ gerrit_site_dir }}/etc/ssh_host_ed25519_key"
+ owner: "{{ gerrit_user_name }}"
+ group: "{{ gerrit_user_name }}"
+ mode: 0600
+
+- name: Write Gerrit SSH ED25519 host public key
+ copy:
+ content: "{{ gerrit_ssh_ed25519_pubkey_contents }}"
+ dest: "{{ gerrit_site_dir }}/etc/ssh_host_ed25519_key.pub"
+ owner: "{{ gerrit_user_name }}"
+ group: "{{ gerrit_user_name }}"
+ mode: 0644
+
# Private key for openstack-project-creator user
- name: Write Gerrit SSH project private key
copy:
diff --git a/playbooks/zuul/templates/host_vars/review99.opendev.org.yaml.j2 b/playbooks/zuul/templates/host_vars/review99.opendev.org.yaml.j2
index 8907652e56..68dfd1b67f 100644
--- a/playbooks/zuul/templates/host_vars/review99.opendev.org.yaml.j2
+++ b/playbooks/zuul/templates/host_vars/review99.opendev.org.yaml.j2
@@ -29,6 +29,56 @@ gerrit_ssh_rsa_key_contents: |
-----END RSA PRIVATE KEY-----
gerrit_ssh_rsa_pubkey_contents: |
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+pCQlTAQYmCrOY6aPbvbyKQDcOCXibPNGIjnPPMuEItCS0vtRnqEBz7znWZS5Drq9yKpROh6uFF01ao2VnNjw6f+NdRNV19RWVe6mYN+qa2VrH2caLwBrKPiH0Xc/eK41D55dZU7IWwKYAw/NpiBaBfHavFwipI+rmEb68MH2hcimDdr/bji+0hkh3X+42dkNvmMdtkuCW6nKdAEhnXaHZc5SJR/EvzgRCfB8vbML13p46O9xhoJgn7ZWvMb3vaR5jxIkQwstUR36raEVhttBDEuWasWnHYbrM1zd3ooudbTEQf5vXISZKFygHyJFFqb4iQ76i+hDlb0VQKZCdaol test-gerrit-hostkey
+gerrit_ssh_ecdsa_key_contents: |
+ -----BEGIN OPENSSH PRIVATE KEY-----
+ b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
+ 1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQRZtjWNgtRszhwwxbDSHL2ufeD4TeeT
+ V6KmRH5UcPAvOoNo3//q5mWPUDrrFDK1OlfgxIUdcp3vSvCLIKVVc44kAAAAqLihL2q4oS
+ 9qAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFm2NY2C1GzOHDDF
+ sNIcva594PhN55NXoqZEflRw8C86g2jf/+rmZY9QOusUMrU6V+DEhR1yne9K8IsgpVVzji
+ QAAAAgVf9XXCDp1ydUD64uMquWwJSYUMPi63zGfMtVejAGyKUAAAANY2xhcmtAdG9hc3Rl
+ cgECAw==
+ -----END OPENSSH PRIVATE KEY-----
+gerrit_ssh_ecdsa_pubkey_contents: |
+ ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFm2NY2C1GzOHDDFsNIcva594PhN55NXoqZEflRw8C86g2jf/+rmZY9QOusUMrU6V+DEhR1yne9K8IsgpVVzjiQ= test-gerrit-hostkey
+gerrit_ssh_ecdsa_384_key_contents: |
+ -----BEGIN OPENSSH PRIVATE KEY-----
+ b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAiAAAABNlY2RzYS
+ 1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRjTpPwkO7rGhGVJCMWUrAcIMpGec34
+ 0ti6MQ6m/XvfWxYvZ6cIOES1CcFwZrzJ8ImJpb3+tOGg5iGFkKVWFMrDJUPLcrrdgYmMAg
+ AoLsN3RlNohXf3UvGj//8gRs/lLxQAAADYLkUkxi5FJMYAAAATZWNkc2Etc2hhMi1uaXN0
+ cDM4NAAAAAhuaXN0cDM4NAAAAGEEY06T8JDu6xoRlSQjFlKwHCDKRnnN+NLYujEOpv1731
+ sWL2enCDhEtQnBcGa8yfCJiaW9/rThoOYhhZClVhTKwyVDy3K63YGJjAIAKC7Dd0ZTaIV3
+ 91Lxo///IEbP5S8UAAAAMG2QdS4dTlRTeMHsw6le5MrI2pcJM+DDF791jn/GOh+0lFWV2H
+ qdHPhs8Cl5wEjOWwAAAA1jbGFya0B0b2FzdGVyAQID
+ -----END OPENSSH PRIVATE KEY-----
+gerrit_ssh_ecdsa_384_pubkey_contents: |
+ ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBGNOk/CQ7usaEZUkIxZSsBwgykZ5zfjS2LoxDqb9e99bFi9npwg4RLUJwXBmvMnwiYmlvf604aDmIYWQpVYUysMlQ8tyut2BiYwCACguw3dGU2iFd/dS8aP//yBGz+UvFA== test-gerrit-hostkey
+gerrit_ssh_ecdsa_521_key_contents: |
+ -----BEGIN OPENSSH PRIVATE KEY-----
+ b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAArAAAABNlY2RzYS
+ 1zaGEyLW5pc3RwNTIxAAAACG5pc3RwNTIxAAAAhQQBaJa5U2SwgWTRis4ixQ5Y0F+SL7eL
+ eFPLfukKQ5g+4U3R7/f10k+4YweOuA+aP9PEy0IUixSbdUM8vlydJ0L3jPcA1vDSJ3Vm7S
+ lD5wbDwq/htBU0jKlCsd4Hre2TWlPcl/6rxz9mqNu06XriO2kz5iAOREastwDx3OqGW9QD
+ GoceWVcAAAEQkQYD25EGA9sAAAATZWNkc2Etc2hhMi1uaXN0cDUyMQAAAAhuaXN0cDUyMQ
+ AAAIUEAWiWuVNksIFk0YrOIsUOWNBfki+3i3hTy37pCkOYPuFN0e/39dJPuGMHjrgPmj/T
+ xMtCFIsUm3VDPL5cnSdC94z3ANbw0id1Zu0pQ+cGw8Kv4bQVNIypQrHeB63tk1pT3Jf+q8
+ c/ZqjbtOl64jtpM+YgDkRGrLcA8dzqhlvUAxqHHllXAAAAQgCAYxTk0LklOsGyS/iRfFDy
+ 7RGJ6hoTRf6M8FIH5KS9l6++dL66T9Z4T/x/o2U6cBVCBy/ZAFi0Mi7s9KZMdlOlQAAAAA
+ 1jbGFya0B0b2FzdGVyAQIDBAU=
+ -----END OPENSSH PRIVATE KEY-----
+gerrit_ssh_ecdsa_521_pubkey_contents: |
+ ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAFolrlTZLCBZNGKziLFDljQX5Ivt4t4U8t+6QpDmD7hTdHv9/XST7hjB464D5o/08TLQhSLFJt1Qzy+XJ0nQveM9wDW8NIndWbtKUPnBsPCr+G0FTSMqUKx3get7ZNaU9yX/qvHP2ao27TpeuI7aTPmIA5ERqy3APHc6oZb1AMahx5ZVw== test-gerrit-hostkey
+gerrit_ssh_ed25519_key_contents: |
+ -----BEGIN OPENSSH PRIVATE KEY-----
+ b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+ QyNTUxOQAAACBSWYNC/4rHZ6+8MiQ41Xi8A7BWm2/Ze2U3tVqwLY3lvwAAAJDVdmJE1XZi
+ RAAAAAtzc2gtZWQyNTUxOQAAACBSWYNC/4rHZ6+8MiQ41Xi8A7BWm2/Ze2U3tVqwLY3lvw
+ AAAEDdfaDmCCWyXyX9ewHOeMWwR7aTUcRQmbYy52gjaLcn91JZg0L/isdnr7wyJDjVeLwD
+ sFabb9l7ZTe1WrAtjeW/AAAADWNsYXJrQHRvYXN0ZXI=
+ -----END OPENSSH PRIVATE KEY-----
+gerrit_ssh_ed25519_pubkey_contents: |
+ ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFJZg0L/isdnr7wyJDjVeLwDsFabb9l7ZTe1WrAtjeW/ test-gerrit-hostkey
gerrit_known_hosts_keys:
'[{% raw %}{{ gerrit_vhost_name }}{% endraw %}]:29418': |
[{% raw %}{{ gerrit_vhost_name }}{% endraw %}]:29418,[localhost]:29418,[127.0.0.1]:29418,[::1]:29418 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+pCQlTAQYmCrOY6aPbvbyKQDcOCXibPNGIjnPPMuEItCS0vtRnqEBz7znWZS5Drq9yKpROh6uFF01ao2VnNjw6f+NdRNV19RWVe6mYN+qa2VrH2caLwBrKPiH0Xc/eK41D55dZU7IWwKYAw/NpiBaBfHavFwipI+rmEb68MH2hcimDdr/bji+0hkh3X+42dkNvmMdtkuCW6nKdAEhnXaHZc5SJR/EvzgRCfB8vbML13p46O9xhoJgn7ZWvMb3vaR5jxIkQwstUR36raEVhttBDEuWasWnHYbrM1zd3ooudbTEQf5vXISZKFygHyJFFqb4iQ76i+hDlb0VQKZCdaol