Merge pull request #319 from y1hao/yihao/expire

Expose "oslogin_ssh_key_expire_after" as a parameter

Author: tanmay-hc

.web-docs/components/builder/googlecompute/README.md

@@ -372,6 +372,11 @@ builder.
 
   Note: Invalid or unsupported values will result in an error during provisioning.
 
+- `oslogin_ssh_key_expire_after` (duration string | ex: "1h5m2s") - The duration after which an SSH key imported into OS Login will expire.
+  This parameter is used when an SSH key is imported into the OS Login profile.
+  The expiration time is calculated from the current time plus this duration.
+  Example value: `1h`, `30m`, `24h`.
+
 - `wait_to_add_ssh_keys` (duration string | ex: "1h5m2s") - The time to wait between the creation of the instance used to create the image,
   and the addition of SSH configuration, including SSH keys, to that instance.
   The delay is intended to protect packer from anything in the instance boot

builder/googlecompute/config.go

@@ -369,6 +369,11 @@ type Config struct {
 	//
 	// Note: Invalid or unsupported values will result in an error during provisioning.
 	OSLoginSSHUsername string `mapstructure:"oslogin_ssh_username" required:"false"`
+	// The duration after which an SSH key imported into OS Login will expire.
+	// This parameter is used when an SSH key is imported into the OS Login profile.
+	// The expiration time is calculated from the current time plus this duration.
+	// Example value: `1h`, `30m`, `24h`.
+	OSLoginSSHKeyExpireAfter time.Duration `mapstructure:"oslogin_ssh_key_expire_after" required:"false"`
 	// The time to wait between the creation of the instance used to create the image,
 	// and the addition of SSH configuration, including SSH keys, to that instance.
 	// The delay is intended to protect packer from anything in the instance boot

builder/googlecompute/config.hcl2spec.go

@@ -102,7 +102,16 @@ func (s *StepImportOSLoginSSHKey) Run(ctx context.Context, state multistep.State
 		return multistep.ActionHalt
 	}
 
-	loginProfile, err := driver.ImportOSLoginSSHKey(s.accountEmail, string(config.Comm.SSHPublicKey))
+	// Calculate expiration time if oslogin_ssh_key_expire_after is set
+	// This is used when an SSH key is imported into the OS Login profile
+	var expirationTimeUsec *int64
+	if config.OSLoginSSHKeyExpireAfter > 0 {
+		expirationTime := time.Now().Add(config.OSLoginSSHKeyExpireAfter)
+		expirationTimeUsecVal := expirationTime.UnixMicro()
+		expirationTimeUsec = &expirationTimeUsecVal
+	}
+
+	loginProfile, err := driver.ImportOSLoginSSHKey(s.accountEmail, string(config.Comm.SSHPublicKey), expirationTimeUsec)
 	if err != nil {
 		err := fmt.Errorf("Error importing SSH public key for OSLogin: %s", err)
 		state.Put("error", err)

builder/googlecompute/step_import_os_login_ssh_key.go

@@ -9,7 +9,9 @@ import (
 	"encoding/hex"
 	"os"
 	"testing"
+	"time"
 
+	"github.com/hashicorp/packer-plugin-googlecompute/lib/common"
 	"github.com/hashicorp/packer-plugin-sdk/multistep"
 	configsdk "github.com/hashicorp/packer-plugin-sdk/template/config"
 	"google.golang.org/api/oauth2/v2"
@@ -309,3 +311,79 @@ func TestGetOSLoginUsername(t *testing.T) {
 		})
 	}
 }
+
+func TestStepImportOSLoginSSHKey_withExpirationTime(t *testing.T) {
+	state := testState(t)
+	fakeAccountEmail := "raffi-compute@developer.gserviceaccount.com"
+	driver := state.Get("driver").(*common.DriverMock)
+	step := &StepImportOSLoginSSHKey{
+		TokeninfoFunc: func() (*oauth2.Tokeninfo, error) {
+			return &oauth2.Tokeninfo{Email: fakeAccountEmail}, nil
+		},
+	}
+	defer step.Cleanup(state)
+
+	config := state.Get("config").(*Config)
+	config.UseOSLogin = configsdk.TriTrue
+	config.Comm.SSHPublicKey = []byte{'k', 'e', 'y'}
+	config.OSLoginSSHKeyExpireAfter = 1 * time.Hour
+
+	beforeTime := time.Now()
+	if action := step.Run(context.Background(), state); action != multistep.ActionContinue {
+		t.Fatalf("bad action: %#v", action)
+	}
+	afterTime := time.Now()
+
+	if driver.ImportOSLoginSSHKeyExpirationTime == nil {
+		t.Fatal("expected expiration time to be set, but got nil")
+	}
+
+	expectedExpirationMin := beforeTime.Add(config.OSLoginSSHKeyExpireAfter).UnixMicro()
+	expectedExpirationMax := afterTime.Add(config.OSLoginSSHKeyExpireAfter).UnixMicro()
+	actualExpiration := *driver.ImportOSLoginSSHKeyExpirationTime
+
+	if actualExpiration < expectedExpirationMin || actualExpiration > expectedExpirationMax {
+		t.Errorf("expected expiration time to be between %d and %d, but got %d", expectedExpirationMin, expectedExpirationMax, actualExpiration)
+	}
+
+	if driver.ImportOSLoginSSHKeyUser != fakeAccountEmail {
+		t.Errorf("expected user to be %q, but got %q", fakeAccountEmail, driver.ImportOSLoginSSHKeyUser)
+	}
+
+	if driver.ImportOSLoginSSHKeyKey != "key" {
+		t.Errorf("expected key to be %q, but got %q", "key", driver.ImportOSLoginSSHKeyKey)
+	}
+}
+
+func TestStepImportOSLoginSSHKey_withoutExpirationTime(t *testing.T) {
+	state := testState(t)
+	fakeAccountEmail := "raffi-compute@developer.gserviceaccount.com"
+	driver := state.Get("driver").(*common.DriverMock)
+	step := &StepImportOSLoginSSHKey{
+		TokeninfoFunc: func() (*oauth2.Tokeninfo, error) {
+			return &oauth2.Tokeninfo{Email: fakeAccountEmail}, nil
+		},
+	}
+	defer step.Cleanup(state)
+
+	config := state.Get("config").(*Config)
+	config.UseOSLogin = configsdk.TriTrue
+	config.Comm.SSHPublicKey = []byte{'k', 'e', 'y'}
+	config.OSLoginSSHKeyExpireAfter = 0 // Not set
+
+	if action := step.Run(context.Background(), state); action != multistep.ActionContinue {
+		t.Fatalf("bad action: %#v", action)
+	}
+
+	if driver.ImportOSLoginSSHKeyExpirationTime != nil {
+		t.Errorf("expected expiration time to be nil when not set, but got %v", *driver.ImportOSLoginSSHKeyExpirationTime)
+	}
+
+	if driver.ImportOSLoginSSHKeyUser != fakeAccountEmail {
+		t.Errorf("expected user to be %q, but got %q", fakeAccountEmail, driver.ImportOSLoginSSHKeyUser)
+	}
+
+	if driver.ImportOSLoginSSHKeyKey != "key" {
+		t.Errorf("expected key to be %q, but got %q", "key", driver.ImportOSLoginSSHKeyKey)
+	}
+}

builder/googlecompute/step_import_os_login_ssh_key_test.go

@@ -318,6 +318,11 @@
 
   Note: Invalid or unsupported values will result in an error during provisioning.
 
+- `oslogin_ssh_key_expire_after` (duration string | ex: "1h5m2s") - The duration after which an SSH key imported into OS Login will expire.
+  This parameter is used when an SSH key is imported into the OS Login profile.
+  The expiration time is calculated from the current time plus this duration.
+  Example value: `1h`, `30m`, `24h`.
+
 - `wait_to_add_ssh_keys` (duration string | ex: "1h5m2s") - The time to wait between the creation of the instance used to create the image,
   and the addition of SSH configuration, including SSH keys, to that instance.
   The delay is intended to protect packer from anything in the instance boot

docs-partials/builder/googlecompute/Config-not-required.mdx

@@ -86,7 +86,9 @@ type Driver interface {
 	CreateOrResetWindowsPassword(zone, name string, config *WindowsPasswordConfig) (<-chan error, error)
 
 	// ImportOSLoginSSHKey imports SSH public key for OSLogin.
-	ImportOSLoginSSHKey(user, sshPublicKey string) (*oslogin.LoginProfile, error)
+	// expirationTimeUsec is an optional expiration time in microseconds since Unix epoch.
+	// If nil, no expiration time will be set.
+	ImportOSLoginSSHKey(user, sshPublicKey string, expirationTimeUsec *int64) (*oslogin.LoginProfile, error)
 
 	// DeleteOSLoginSSHKey deletes the SSH public key for OSLogin with the given key.
 	DeleteOSLoginSSHKey(user, fingerprint string) error

lib/common/driver.go

@@ -898,12 +898,17 @@ func (d *driverGCE) getPasswordResponses(zone, instance string) ([]windowsPasswo
 	return passwordResponses, nil
 }
 
-func (d *driverGCE) ImportOSLoginSSHKey(user, sshPublicKey string) (*oslogin.LoginProfile, error) {
+func (d *driverGCE) ImportOSLoginSSHKey(user, sshPublicKey string, expirationTimeUsec *int64) (*oslogin.LoginProfile, error) {
 	parent := fmt.Sprintf("users/%s", user)
 
-	resp, err := d.osLoginService.Users.ImportSshPublicKey(parent, &oslogin.SshPublicKey{
+	sshKey := &oslogin.SshPublicKey{
 		Key: sshPublicKey,
-	}).Do()
+	}
+	if expirationTimeUsec != nil {
+		sshKey.ExpirationTimeUsec = *expirationTimeUsec
+	}
+
+	resp, err := d.osLoginService.Users.ImportSshPublicKey(parent, sshKey).Do()
 	if err != nil {
 		return nil, err
 	}

lib/common/driver_gce.go

@@ -124,6 +124,10 @@ type DriverMock struct {
 	UploadToBucketData       io.Reader
 	UploadToBucketResult     string
 	UploadToBucketError      error
+
+	ImportOSLoginSSHKeyUser           string
+	ImportOSLoginSSHKeyKey            string
+	ImportOSLoginSSHKeyExpirationTime *int64
 }
 
 func (d *DriverMock) CreateImage(project string, imageSpec *compute.Image) (<-chan *Image, <-chan error) {
@@ -379,7 +383,10 @@ func (d *DriverMock) CreateOrResetWindowsPassword(instance, zone string, c *Wind
 	return resultCh, d.CreateOrResetWindowsPasswordErr
 }
 
-func (d *DriverMock) ImportOSLoginSSHKey(user, key string) (*oslogin.LoginProfile, error) {
+func (d *DriverMock) ImportOSLoginSSHKey(user, key string, expirationTimeUsec *int64) (*oslogin.LoginProfile, error) {
+	d.ImportOSLoginSSHKeyUser = user
+	d.ImportOSLoginSSHKeyKey = key
+	d.ImportOSLoginSSHKeyExpirationTime = expirationTimeUsec
 	account := oslogin.PosixAccount{Primary: true, Username: "testing_packer_io"}
 	profile := oslogin.LoginProfile{
 		PosixAccounts: []*oslogin.PosixAccount{&account},