20485: Option to skip automatic SSH key deployment on cloud VMs.

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@curii.com>

diff --git a/lib/cloud/azure/azure.go b/lib/cloud/azure/azure.go
index 7b170958b6ee69921f9d6186cfeaa79f091eedfb..494db854ed3c857fbf47f714f46b5c605120e30e 100644 (file)
--- a/lib/cloud/azure/azure.go
+++ b/lib/cloud/azure/azure.go
@@ -514,20 +514,23 @@ func (az *azureInstanceSet) Create(
                                AdminUsername: to.StringPtr(az.azconfig.AdminUsername),
                                LinuxConfiguration: &compute.LinuxConfiguration{
                                        DisablePasswordAuthentication: to.BoolPtr(true),
-                                       SSH: &compute.SSHConfiguration{
-                                               PublicKeys: &[]compute.SSHPublicKey{
-                                                       {
-                                                               Path:    to.StringPtr("/home/" + az.azconfig.AdminUsername + "/.ssh/authorized_keys"),
-                                                               KeyData: to.StringPtr(string(ssh.MarshalAuthorizedKey(publicKey))),
-                                                       },
-                                               },
-                                       },
                                },
                                CustomData: &customData,
                        },
                },
        }
 
+       if publicKey != nil {
+               vmParameters.VirtualMachineProperties.OsProfile.LinuxConfiguration.SSH = &compute.SSHConfiguration{
+                       PublicKeys: &[]compute.SSHPublicKey{
+                               {
+                                       Path:    to.StringPtr("/home/" + az.azconfig.AdminUsername + "/.ssh/authorized_keys"),
+                                       KeyData: to.StringPtr(string(ssh.MarshalAuthorizedKey(publicKey))),
+                               },
+                       },
+               }
+       }
+
        if instanceType.Preemptible {
                // Setting maxPrice to -1 is the equivalent of paying spot price, up to the
                // normal price. This means the node will not be pre-empted for price

diff --git a/lib/cloud/ec2/ec2.go b/lib/cloud/ec2/ec2.go
index 81e1f8b00e3c6b18518b59bb698872dbf389f5cf..e2cf5e0f1c3f35e881c882e0f005a241bd75ad8c 100644 (file)
--- a/lib/cloud/ec2/ec2.go
+++ b/lib/cloud/ec2/ec2.go
@@ -149,11 +149,6 @@ func (instanceSet *ec2InstanceSet) Create(
        initCommand cloud.InitCommand,
        publicKey ssh.PublicKey) (cloud.Instance, error) {
 
-       keyname, err := instanceSet.getKeyName(publicKey)
-       if err != nil {
-               return nil, err
-       }
-
        ec2tags := []*ec2.Tag{}
        for k, v := range newTags {
                ec2tags = append(ec2tags, &ec2.Tag{
@@ -172,7 +167,6 @@ func (instanceSet *ec2InstanceSet) Create(
                InstanceType: &instanceType.ProviderType,
                MaxCount:     aws.Int64(1),
                MinCount:     aws.Int64(1),
-               KeyName:      &keyname,
 
                NetworkInterfaces: []*ec2.InstanceNetworkInterfaceSpecification{
                        {
@@ -192,6 +186,14 @@ func (instanceSet *ec2InstanceSet) Create(
                UserData: aws.String(base64.StdEncoding.EncodeToString([]byte("#!/bin/sh\n" + initCommand + "\n"))),
        }
 
+       if publicKey != nil {
+               keyname, err := instanceSet.getKeyName(publicKey)
+               if err != nil {
+                       return nil, err
+               }
+               rii.KeyName = &keyname
+       }
+
        if instanceType.AddedScratch > 0 {
                rii.BlockDeviceMappings = []*ec2.BlockDeviceMapping{{
                        DeviceName: aws.String("/dev/xvdt"),

diff --git a/lib/config/config.default.yml b/lib/config/config.default.yml
index 06f4fb55ed6455121247b2b3478433db740744ee..4494a627d41294ded3a27bd6cc7e2d65ba444cb3 100644 (file)
--- a/lib/config/config.default.yml
+++ b/lib/config/config.default.yml
@@ -1413,6 +1413,12 @@ Clusters:
         # version of crunch-run installed; see CrunchRunCommand above.
         DeployRunnerBinary: "/proc/self/exe"
 
+        # Install the Dispatcher's SSH public key (derived from
+        # DispatchPrivateKey) when creating new cloud
+        # instances. Change this to false if you are using a different
+        # mechanism to pre-install the public key on new instances.
+        DeployPublicKey: true
+
         # Tags to add on all resources (VMs, NICs, disks) created by
         # the container dispatcher. (Arvados's own tags --
         # InstanceType, IdleBehavior, and InstanceSecret -- will also

diff --git a/lib/dispatchcloud/dispatcher.go b/lib/dispatchcloud/dispatcher.go
index 06a558d5fe2b58c7b9acf149faba020fc8f16c4e..e982736ff0aa141462f98d39b6520a94b3ed92c1 100644 (file)
--- a/lib/dispatchcloud/dispatcher.go
+++ b/lib/dispatchcloud/dispatcher.go
@@ -142,6 +142,10 @@ func (disp *dispatcher) initialize() {
        } else {
                disp.sshKey = key
        }
+       installPublicKey := disp.sshKey.PublicKey()
+       if !disp.Cluster.Containers.CloudVMs.DeployPublicKey {
+               installPublicKey = nil
+       }
 
        instanceSet, err := newInstanceSet(disp.Cluster, disp.InstanceSetID, disp.logger, disp.Registry)
        if err != nil {
@@ -149,7 +153,7 @@ func (disp *dispatcher) initialize() {
        }
        dblock.Dispatch.Lock(disp.Context, disp.dbConnector.GetDB)
        disp.instanceSet = instanceSet
-       disp.pool = worker.NewPool(disp.logger, disp.ArvClient, disp.Registry, disp.InstanceSetID, disp.instanceSet, disp.newExecutor, disp.sshKey.PublicKey(), disp.Cluster)
+       disp.pool = worker.NewPool(disp.logger, disp.ArvClient, disp.Registry, disp.InstanceSetID, disp.instanceSet, disp.newExecutor, installPublicKey, disp.Cluster)
        disp.queue = container.NewQueue(disp.logger, disp.Registry, disp.typeChooser, disp.ArvClient)
 
        if disp.Cluster.ManagementToken == "" {

diff --git a/sdk/go/arvados/config.go b/sdk/go/arvados/config.go
index 1018a9f236a9dc3ac6a0196cf5a5833881f7279a..4da851763eb9d924235544c3454806fd11c52808 100644 (file)
--- a/sdk/go/arvados/config.go
+++ b/sdk/go/arvados/config.go
@@ -559,6 +559,7 @@ type CloudVMsConfig struct {
        BootProbeCommand               string
        InstanceInitCommand            string
        DeployRunnerBinary             string
+       DeployPublicKey                bool
        ImageID                        string
        MaxCloudOpsPerSecond           int
        MaxProbesPerSecond             int