20482: Allows the admin to specify the user for deployment.

Also, removes the need to use AWS key pairs, by directly storing the SSH
pubkey in the user's ~/.ssh/ directory via the user-data script.

Arvados-DCO-1.1-Signed-off-by: Lucas Di Pentima <lucas.dipentima@curii.com>

diff --git a/tools/salt-install/terraform/aws/services/main.tf b/tools/salt-install/terraform/aws/services/main.tf
index b214aeb11359494030e7c3e36332142b448b2b93..e4724c92c2224edc3c988c175f72c8abd069114b 100644 (file)
--- a/tools/salt-install/terraform/aws/services/main.tf
+++ b/tools/salt-install/terraform/aws/services/main.tf
@@ -19,11 +19,6 @@ provider "aws" {
   }
 }
 
-resource "aws_key_pair" "deployer" {
-  key_name = local.pubkey_name
-  public_key = file(local.pubkey_path)
-}
-
 resource "aws_iam_instance_profile" "keepstore_instance_profile" {
   name = "${local.cluster_name}-keepstore-00-iam-role"
   role = data.terraform_remote_state.data-storage.outputs.keepstore_iam_role_name
@@ -48,9 +43,10 @@ resource "aws_instance" "arvados_service" {
   for_each = toset(concat(local.public_hosts, local.private_hosts))
   ami = data.aws_ami.debian-11.image_id
   instance_type = var.default_instance_type
-  key_name = local.pubkey_name
   user_data = templatefile("user_data.sh", {
-    "hostname": each.value
+    "hostname": each.value,
+    "deploy_user": var.deploy_user,
+    "ssh_pubkey": file(local.pubkey_path)
   })
   private_ip = local.private_ip[each.value]
   subnet_id = contains(local.user_facing_hosts, each.value) ? data.terraform_remote_state.vpc.outputs.public_subnet_id : data.terraform_remote_state.vpc.outputs.private_subnet_id

diff --git a/tools/salt-install/terraform/aws/services/outputs.tf b/tools/salt-install/terraform/aws/services/outputs.tf
index 8ff12c71b77748e34e483d447a55917bddd515d3..7ac42a783f525451cdab7df4f06244c637d15014 100644 (file)
--- a/tools/salt-install/terraform/aws/services/outputs.tf
+++ b/tools/salt-install/terraform/aws/services/outputs.tf
@@ -48,7 +48,7 @@ output "domain_name" {
 
 # Debian AMI's default user
 output "deploy_user" {
-  value = "admin"
+  value = var.deploy_user
 }
 
 output "region_name" {

diff --git a/tools/salt-install/terraform/aws/services/terraform.tfvars b/tools/salt-install/terraform/aws/services/terraform.tfvars
index 79f3dc3188e3b99c5d63aea34cfdffa95fc06d0a..7231717ee6fdb542f5b81c69f33cd543c723031a 100644 (file)
--- a/tools/salt-install/terraform/aws/services/terraform.tfvars
+++ b/tools/salt-install/terraform/aws/services/terraform.tfvars
@@ -10,4 +10,8 @@
 
 # AWS secret's name which holds the SSL certificate private key's password.
 # Default: "arvados-ssl-privkey-password"
-# ssl_password_secret_name_suffix = "some-name-suffix"
\ No newline at end of file
+# ssl_password_secret_name_suffix = "some-name-suffix"
+
+# User for software deployment. Depends on the AMI's distro.
+# Default: 'admin'
+# deploy_user = ubuntu

diff --git a/tools/salt-install/terraform/aws/services/user_data.sh b/tools/salt-install/terraform/aws/services/user_data.sh
index 6c5b574dd7c464dc9ddeb878ba5dcef7220f38c5..68af17ee2fe8d78c8ae47765c300dfb9b2f43938 100644 (file)
--- a/tools/salt-install/terraform/aws/services/user_data.sh
+++ b/tools/salt-install/terraform/aws/services/user_data.sh
@@ -17,3 +17,13 @@ while true; do
 done
 
 apt-get -o Acquire::ForceIPv4=true install -y git curl
+
+SSH_DIR="/home/${deploy_user}/.ssh"
+if [ ! -d "$${SSH_DIR}" ]; then
+  mkdir $${SSH_DIR}
+  chown ${deploy_user}.${deploy_user} $${SSH_DIR}
+  chmod 700 $${SSH_DIR}
+fi
+
+echo "${ssh_pubkey}" > $${SSH_DIR}/authorized_keys
+chmod 600 $${SSH_DIR}/authorized_keys

diff --git a/tools/salt-install/terraform/aws/services/variables.tf b/tools/salt-install/terraform/aws/services/variables.tf
index e520a9ab895f03412b6b15484f3eedb5c43cb034..4117b7b49413386fec9a7aff20b87de9e2d4003e 100644 (file)
--- a/tools/salt-install/terraform/aws/services/variables.tf
+++ b/tools/salt-install/terraform/aws/services/variables.tf
@@ -14,6 +14,12 @@ variable "pubkey_path" {
   default = "~/.ssh/id_rsa.pub"
 }
 
+variable "deploy_user" {
+  description = "User for deploying the software"
+  type = string
+  default = "admin"
+}
+
 variable "ssl_password_secret_name_suffix" {
   description = "Name suffix for the SSL certificate's private key password AWS secret."
   type = string