Skip to content

Commit ebeca4f

Browse files
dopeydopey
authored
Add disableSSHCAUser and disableSSHCAHost attributes to GCP provisioner (#1305)
* Add disableSSHCAUser and disableSSHCAHost attributes to GCP provisioner
1 parent 4dfc345 commit ebeca4f

File tree

5 files changed

+72
-3
lines changed

5 files changed

+72
-3
lines changed

‎command/ca/provisioner/add.go

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,7 @@ IID (AWS/GCP/Azure)
100100
[**--azure-audience**=<name>] [**--azure-subscription-id**=<id>]
101101
[**--azure-object-id**=<id>] [**--instance-age**=<duration>] [**--iid-roots**=<file>]
102102
[**--disable-custom-sans**] [**--disable-trust-on-first-use**]
103+
[**--disable-ssh-ca-user**] [**--disable-ssh-ca-host**]
103104
[**--admin-cert**=<file>] [**--admin-key**=<file>]
104105
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
105106
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
@@ -172,6 +173,8 @@ SCEP
172173
instanceAgeFlag,
173174
disableCustomSANsFlag,
174175
disableTOFUFlag,
176+
disableSSHCAUserFlag,
177+
disableSSHCAHostFlag,
175178

176179
// Claims
177180
x509TemplateFlag,
@@ -744,6 +747,13 @@ func createOIDCDetails(ctx *cli.Context) (*linkedca.ProvisionerDetails, error) {
744747
}
745748

746749
func createAWSDetails(ctx *cli.Context) (*linkedca.ProvisionerDetails, error) {
750+
if ctx.IsSet("disable-ssh-ca-user") {
751+
return nil, errors.New("flag disable-ssh-ca-user is not supported for AWS IID provisioners")
752+
}
753+
if ctx.IsSet("disable-ssh-ca-host") {
754+
return nil, errors.New("flag disable-ssh-ca-host is not supported for AWS IID provisioners")
755+
}
756+
747757
d, err := parseInstanceAge(ctx)
748758
if err != nil {
749759
return nil, err
@@ -764,6 +774,13 @@ func createAWSDetails(ctx *cli.Context) (*linkedca.ProvisionerDetails, error) {
764774
}
765775

766776
func createAzureDetails(ctx *cli.Context) (*linkedca.ProvisionerDetails, error) {
777+
if ctx.IsSet("disable-ssh-ca-user") {
778+
return nil, errors.New("flag disable-ssh-ca-user is not supported for Azure IID provisioners")
779+
}
780+
if ctx.IsSet("disable-ssh-ca-host") {
781+
return nil, errors.New("flag disable-ssh-ca-host is not supported for Azure IID provisioners")
782+
}
783+
767784
tenantID := ctx.String("azure-tenant")
768785
if tenantID == "" {
769786
return nil, errs.RequiredWithFlagValue(ctx, "type", ctx.String("type"), "azure-tenant")
@@ -790,13 +807,29 @@ func createGCPDetails(ctx *cli.Context) (*linkedca.ProvisionerDetails, error) {
790807
return nil, err
791808
}
792809

810+
var (
811+
disableSSHCAUser *bool
812+
disableSSHCAHost *bool
813+
)
814+
815+
if ctx.IsSet("disable-ssh-ca-user") {
816+
boolVal := ctx.Bool("disable-ssh-ca-user")
817+
disableSSHCAUser = &boolVal
818+
}
819+
if ctx.IsSet("disable-ssh-ca-host") {
820+
boolVal := ctx.Bool("disable-ssh-ca-host")
821+
disableSSHCAHost = &boolVal
822+
}
823+
793824
return &linkedca.ProvisionerDetails{
794825
Data: &linkedca.ProvisionerDetails_GCP{
795826
GCP: &linkedca.GCPProvisioner{
796827
ServiceAccounts: ctx.StringSlice("gcp-service-account"),
797828
ProjectIds: ctx.StringSlice("gcp-project"),
798829
DisableCustomSans: ctx.Bool("disable-custom-sans"),
799830
DisableTrustOnFirstUse: ctx.Bool("disable-trust-on-first-use"),
831+
DisableSshCaUser: disableSSHCAUser,
832+
DisableSshCaHost: disableSSHCAHost,
800833
InstanceAge: d,
801834
},
802835
},

‎command/ca/provisioner/provisioner.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -542,6 +542,16 @@ with the same instance will be accepted. By default only the first request
542542
will be accepted.`,
543543
}
544544

545+
disableSSHCAUserFlag = cli.BoolFlag{
546+
Name: "disable-ssh-ca-user",
547+
Usage: `Disable ability to sign SSH user certificates`,
548+
}
549+
550+
disableSSHCAHostFlag = cli.BoolFlag{
551+
Name: "disable-ssh-ca-host",
552+
Usage: `Disable ability to sign SSH host certificates`,
553+
}
554+
545555
// Nebula provisioner flags
546556
nebulaRootFlag = cli.StringFlag{
547557
Name: "nebula-root",

‎command/ca/provisioner/update.go

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ IID (AWS/GCP/Azure)
9292
[**--azure-audience**=<name>] [**--azure-subscription-id**=<id>]
9393
[**--azure-object-id**=<id>] [**--instance-age**=<duration>]
9494
[**--disable-custom-sans**] [**--disable-trust-on-first-use**]
95+
[**--disable-ssh-ca-user**] [**--disable-ssh-ca-host**]
9596
[**--admin-cert**=<file>] [**--admin-key**=<file>]
9697
[**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
9798
[**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
@@ -176,6 +177,8 @@ SCEP
176177
instanceAgeFlag,
177178
disableCustomSANsFlag,
178179
disableTOFUFlag,
180+
disableSSHCAUserFlag,
181+
disableSSHCAHostFlag,
179182

180183
// Claims
181184
x509TemplateFlag,
@@ -826,6 +829,13 @@ func updateOIDCDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
826829
}
827830

828831
func updateAWSDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
832+
if ctx.IsSet("disable-ssh-ca-user") {
833+
return errors.New("flag disable-ssh-ca-user is not supported for AWS IID provisioners")
834+
}
835+
if ctx.IsSet("disable-ssh-ca-host") {
836+
return errors.New("flag disable-ssh-ca-host is not supported for AWS IID provisioners")
837+
}
838+
829839
data, ok := p.Details.GetData().(*linkedca.ProvisionerDetails_AWS)
830840
if !ok {
831841
return errors.New("error casting details to AWS type")
@@ -855,6 +865,13 @@ func updateAWSDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
855865
}
856866

857867
func updateAzureDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
868+
if ctx.IsSet("disable-ssh-ca-user") {
869+
return errors.New("flag disable-ssh-ca-user is not supported for Azure IID provisioners")
870+
}
871+
if ctx.IsSet("disable-ssh-ca-host") {
872+
return errors.New("flag disable-ssh-ca-host is not supported for Azure IID provisioners")
873+
}
874+
858875
data, ok := p.Details.GetData().(*linkedca.ProvisionerDetails_Azure)
859876
if !ok {
860877
return errors.New("error casting details to Azure type")
@@ -914,6 +931,14 @@ func updateGCPDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
914931
if ctx.IsSet("disable-trust-on-first-use") {
915932
details.DisableTrustOnFirstUse = ctx.Bool("disable-trust-on-first-use")
916933
}
934+
if ctx.IsSet("disable-ssh-ca-user") {
935+
boolVal := ctx.Bool("disable-ssh-ca-user")
936+
details.DisableSshCaUser = &boolVal
937+
}
938+
if ctx.IsSet("disable-ssh-ca-host") {
939+
boolVal := ctx.Bool("disable-ssh-ca-host")
940+
details.DisableSshCaHost = &boolVal
941+
}
917942
if ctx.IsSet("remove-gcp-service-account") {
918943
details.ServiceAccounts = removeElements(details.ServiceAccounts, ctx.StringSlice("remove-gcp-service-account"))
919944
}
@@ -926,6 +951,7 @@ func updateGCPDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
926951
if ctx.IsSet("gcp-project") {
927952
details.ProjectIds = append(details.ProjectIds, ctx.StringSlice("gcp-project")...)
928953
}
954+
929955
return nil
930956
}
931957

‎go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ require (
2727
github.com/urfave/cli v1.22.16
2828
go.mozilla.org/pkcs7 v0.9.0
2929
go.step.sm/crypto v0.54.0
30-
go.step.sm/linkedca v0.22.1
30+
go.step.sm/linkedca v0.22.2
3131
golang.org/x/crypto v0.28.0
3232
golang.org/x/sys v0.26.0
3333
golang.org/x/term v0.25.0

‎go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -391,8 +391,8 @@ go.step.sm/cli-utils v0.9.0 h1:55jYcsQbnArNqepZyAwcato6Zy2MoZDRkWW+jF+aPfQ=
391391
go.step.sm/cli-utils v0.9.0/go.mod h1:Y/CRoWl1FVR9j+7PnAewufAwKmBOTzR6l9+7EYGAnp8=
392392
go.step.sm/crypto v0.54.0 h1:V8p+12Ld0NRA/RBMYoKXA0dWmVKZSdCwP56IwzweT9g=
393393
go.step.sm/crypto v0.54.0/go.mod h1:vQJyTngfZDW+UyZdFzOMCY/txWDAmcwViEUC7Gn4YfU=
394-
go.step.sm/linkedca v0.22.1 h1:GvprpH9P4Sv9U+eZ3bxDgRSSpW14cFDYpe1kS6yWLkw=
395-
go.step.sm/linkedca v0.22.1/go.mod h1:dOKdF4HSn73YUEkfS5/FECngZmBtj2Il5DTKWXY4S6Y=
394+
go.step.sm/linkedca v0.22.2 h1:zmFIyDC77gFHo6FLQJ8OIXYpLYDIsgDWaYqtYs6A9/Q=
395+
go.step.sm/linkedca v0.22.2/go.mod h1:ESY8r5VfhJA8ZVzI6hXIQcEX9LwaY3aoPnT+Hb9jpbw=
396396
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
397397
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
398398
golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=

0 commit comments

Comments
 (0)