Skip to content

Limit where user tf is defined #414

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cmd-ntrf merged 5 commits into from
Feb 20, 2026
Merged

Limit where user tf is defined #414

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ae93dec
Consider bastion tag when configuring tf ssh access
cmd-ntrf Feb 19, 2026
a8a3fc2
Chomp tf's openssh public key in puppet.yaml
cmd-ntrf Feb 19, 2026
49c8542
Create user tf only on puppetserver and bastions
cmd-ntrf Feb 19, 2026
97b4dda
Skip bastion_host provision when puppetservers are bastion
cmd-ntrf Feb 20, 2026
185d97c
Restrict tf user from jumping out of puppetserver
cmd-ntrf Feb 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions common/configuration/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,7 @@ locals {
cloud_provider = var.cloud_provider
cloud_region = var.cloud_region
tags = values.tags
bastion_tags = var.bastion_tags
node_name = key,
node_prefix = values.prefix,
domain_name = var.domain_name
Expand All @@ -108,7 +109,7 @@ locals {
puppetserver_password = local.puppet_passwd,
sudoer_username = var.sudoer_username,
ssh_authorized_keys = local.public_keys
tf_ssh_public_key = tls_private_key.ssh.public_key_openssh
tf_ssh_public_key = chomp(tls_private_key.ssh.public_key_openssh)
terraform_facts = local.terraform_facts
skip_upgrade = var.skip_upgrade
puppetfile = var.puppetfile
Expand Down Expand Up @@ -141,7 +142,7 @@ output "terraform_facts" {
}

output "puppetservers" {
value = { for host, values in local.final_inventory : host => values.local_ip if contains(values.tags, "puppet") }
value = { for host, values in local.final_inventory : host => { local_ip = values.local_ip, public_ip = values.public_ip } if contains(values.tags, "puppet") }
}

output "guest_passwd" {
Expand Down
20 changes: 16 additions & 4 deletions common/configuration/puppet.yaml.tftpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,15 @@ mounts:
- [ ephemeral0, /mnt/ephemeral0 ]

users:
%{ if contains(tags, "puppet") || length(setintersection(tags, bastion_tags)) > 0 ~}
- name: tf
system: true
passwd: '*'
no_user_group: true
homedir: /tmp
%{ if contains(tags, "puppet") }
sudo: "ALL = NOPASSWD: /usr/sbin/update_etc_puppetlabs.sh *.zip"
%{ endif ~}
%{ endif ~}
- name: ${sudoer_username}
groups: adm, wheel, systemd-journal
Expand Down Expand Up @@ -164,16 +166,26 @@ runcmd:
- test -f /run/cloud-init-failed && echo 'WARNING - some steps cloud-init runcmd failed, listed in /run/cloud-init-failed. Manual fixing and rebooting required. ' | tee /etc/motd || true

write_files:
# If the ip addresses of the puppet servers are not known in advance, we cannot restrict the ssh connection to them.
- content: restrict,%{ if contains(tags, "puppet") }pty%{ else }%{if length(compact(values(puppetservers))) == length(keys(puppetservers)) }%{ for host, ip in puppetservers }permitopen="${ip}:22"%{ endfor }%{ else }pty%{ endif },port-forwarding,command="/sbin/nologin"%{ endif } ${tf_ssh_public_key}
path: /etc/ssh/authorized_keys.tf
permissions: "0644"
%{ if contains(tags, "puppet") || length(setintersection(tags, bastion_tags)) > 0 ~}
- content: |
Match User tf
AuthorizedKeysFile /etc/ssh/authorized_keys.%u
AuthenticationMethods publickey
path: /etc/ssh/sshd_config.d/50-authenticationmethods.conf
permissions: "0600"
%{ endif ~}
%{ if contains(tags, "puppet") ~}
- content: restrict,pty ${tf_ssh_public_key}
path: /etc/ssh/authorized_keys.tf
permissions: "0644"
%{ else ~}
%{ if length(setintersection(tags, bastion_tags)) > 0 ~}
# If the ip addresses of the puppet servers are not known in advance, we cannot restrict the ssh connection to them.
- content: restrict,%{if length(compact(values(puppetservers))) == length(keys(puppetservers)) }%{ for host, ip in puppetservers }permitopen="${ip}:22"%{ endfor }%{ else }pty%{ endif },port-forwarding,command="/sbin/nologin" ${tf_ssh_public_key}
path: /etc/ssh/authorized_keys.tf
permissions: "0644"
%{ endif ~}
%{ endif ~}
- content: |
facts : {
blocklist : [
Expand Down
7 changes: 4 additions & 3 deletions common/provision/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,8 @@ data "archive_file" "puppetserver_files" {
}

locals {
bastion_host = length(var.configuration.bastions) > 0 ? var.configuration.bastions[keys(var.configuration.bastions)[0]] : null
puppetservers_are_bastion = length(setintersection(keys(var.configuration.bastions), keys(var.configuration.puppetservers))) == length(var.configuration.puppetservers)
bastion_host = length(var.configuration.bastions) > 0 ? var.configuration.bastions[keys(var.configuration.bastions)[0]] : null
}

resource "terraform_data" "deploy_puppetserver_files" {
Expand All @@ -69,11 +70,11 @@ resource "terraform_data" "deploy_puppetserver_files" {
connection {
type = "ssh"
agent = false
bastion_host = contains(local.bastion_host.tags, "public") ? local.bastion_host.public_ip : local.bastion_host.local_ip
bastion_host = local.puppetservers_are_bastion ? null : (contains(local.bastion_host.tags, "public") ? local.bastion_host.public_ip : local.bastion_host.local_ip)
bastion_user = "tf"
bastion_private_key = var.configuration.ssh_key.private
user = "tf"
host = each.value
host = local.puppetservers_are_bastion && each.value.public_ip != "" ? each.value.public_ip : each.value.local_ip
private_key = var.configuration.ssh_key.private
}

Expand Down