fix(ssh-proxy): Generate host key for gcp (#527)

Signed-off-by: Nathanael Ruf <nathanael@codesphere.com>

Author: nathanael-ruf

internal/installer/files/secret_names.go

@@ -57,6 +57,9 @@ const (
 	// Ceph
 	SecretCephSshPrivateKey = "cephSshPrivateKey"
 
+	// SSH workspace proxy
+	SecretSshWorkspaceProxyHostKey = "sshWorkspaceProxyHostKey"
+
 	// Cluster / TLS
 	SecretSelfSignedCaKeyPem = "selfSignedCaKeyPem"
 

internal/installer/secrets/secrets.go

@@ -35,6 +35,9 @@ func EnsureSecrets(vault *files.InstallVault, config *files.RootConfig) error {
 	if err := EnsureCephSSHKeys(vault, &config.Ceph); err != nil {
 		return fmt.Errorf("ensure ceph SSH keys: %w", err)
 	}
+	if err := EnsureSshWorkspaceProxyHostKey(vault); err != nil {
+		return fmt.Errorf("ensure ssh workspace proxy host key: %w", err)
+	}
 	if config.Postgres.Primary != nil {
 		if err := EnsurePostgresSecrets(vault, &config.Postgres); err != nil {
 			return fmt.Errorf("ensure postgres secrets: %w", err)
@@ -328,6 +331,24 @@ func EnsureCephSSHKeys(vault *files.InstallVault, ceph *files.CephConfig) error
 	return nil
 }
 
+// EnsureSshWorkspaceProxyHostKey generates the SSH host key for the SSH workspace proxy if not
+// already present in vault. Only the private key is stored (as key.pem); the matching public key
+// is derived by the proxy at runtime.
+func EnsureSshWorkspaceProxyHostKey(vault *files.InstallVault) error {
+	if vault.GetSecret(files.SecretSshWorkspaceProxyHostKey) != nil {
+		return nil
+	}
+	privKey, _, err := GenerateSSHKeyPair()
+	if err != nil {
+		return fmt.Errorf("generate ssh workspace proxy host key: %w", err)
+	}
+	vault.SetSecret(files.SecretEntry{
+		Name: files.SecretSshWorkspaceProxyHostKey,
+		File: &files.SecretFile{Name: "key.pem", Content: privKey},
+	})
+	return nil
+}
+
 // EnsurePostgresSecrets generates all postgres certificates and passwords if not already present
 // in vault (sentinel: postgresPassword). Private keys and passwords are written to vault;
 // cert PEMs are set on the postgres config struct for inclusion in the config YAML.

internal/installer/secrets/secrets_test.go

@@ -287,6 +287,28 @@ var _ = Describe("EnsureCephSSHKeys", func() {
 	})
 })
 
+var _ = Describe("EnsureSshWorkspaceProxyHostKey", func() {
+	It("writes the host private key to vault", func() {
+		vault := newVault()
+
+		Expect(secrets.EnsureSshWorkspaceProxyHostKey(vault)).To(Succeed())
+
+		hostKey := vault.GetSecret("sshWorkspaceProxyHostKey")
+		Expect(hostKey).NotTo(BeNil())
+		Expect(hostKey.File.Name).To(Equal("key.pem"))
+		Expect(hostKey.File.Content).To(ContainSubstring("BEGIN RSA PRIVATE KEY"))
+	})
+
+	It("is idempotent", func() {
+		vault := newVault()
+		Expect(secrets.EnsureSshWorkspaceProxyHostKey(vault)).To(Succeed())
+
+		origKey := vault.GetSecret("sshWorkspaceProxyHostKey").File.Content
+		Expect(secrets.EnsureSshWorkspaceProxyHostKey(vault)).To(Succeed())
+		Expect(vault.GetSecret("sshWorkspaceProxyHostKey").File.Content).To(Equal(origKey))
+	})
+})
+
 var _ = Describe("EnsurePostgresSecrets", func() {
 	var postgres *files.PostgresConfig