foreman_remote_execution 6.0.0 → 7.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 61d64bd14e3ce43367e26ad39ec10408baf8ec7920f45aa4ea1353340d3cf742
-  data.tar.gz: 0ab68114a29368fa4c2a269287b875368cdcc31db63dd481df223a1f91a36cef
+  metadata.gz: e9183b3b81c3033d696f4aedf861cb5eed143fb9eacccb144a23d859e3ccae69
+  data.tar.gz: 4c7c6c09c84f3d4cbef2aaa8330b7bf048d42570e9319ad227c30abc5613770c
 SHA512:
-  metadata.gz: 5d908f4f766c2b55bf6814035058b5faea29ba1ae3c61729275d2492e62b5f5aba2f60838d0b8383b9075f75daed15788d34ae1b2b9e091fea3ec26f812c670a
-  data.tar.gz: 05d63bba759d31d2b85030bc8cb4e39faeb9af50e784374e016edb4637d84906f6527b533efd5600da969a1b2315f34392f5f994d1ae17bbc840f5a2dfdf04a9
+  metadata.gz: b35e41908b57f97f80272070d84b8d2ceeb7e061e22ad673d07c694a643d057399e207af9c8f36d14d535a7ddb3eddefa013e04b3d63689796e66e6d9aeae88b
+  data.tar.gz: 5c0b0d79edaab4c28721ad26df27ad8ac14878e09349929d28175c2cc1714ebb1f81ceb9f4824215d781dc1b4b0662962a9043f4f56963fea4d0aaa3e2483f8d

data/app/controllers/api/v2/job_invocations_controller.rb

@@ -45,6 +45,7 @@ module Api
               :required => false,
               :desc => N_('Set password for effective user (using sudo-like mechanisms)')
           end
+          param :ssh_user, String, :required => false, :desc => N_('Set SSH user')
           param :password, String, :required => false, :desc => N_('Set SSH password')
           param :key_passphrase, String, :required => false, :desc => N_('Set SSH key passphrase')
 

data/app/controllers/foreman_remote_execution/concerns/api/v2/registration_controller_extensions.rb

@@ -13,6 +13,7 @@ module ForemanRemoteExecution
 
       def host_setup_extension
         remote_execution_interface
+        reset_host_known_keys! unless @host.new_record?
         super
       end
 
@@ -21,6 +22,10 @@ module ForemanRemoteExecution
 
         @host.set_execution_interface(params['remote_execution_interface'])
       end
+
+      def reset_host_known_keys!
+        @host.host_proxy_invocations.destroy_all
+      end
     end
   end
 end

data/app/controllers/ui_job_wizard_controller.rb

@@ -40,7 +40,7 @@ class UiJobWizardController < ApplicationController
   end
 
   def with_katello
-    !!defined?(::Katello)
+    ::Foreman::Plugin.installed? 'katello'
   end
 
   def resource_class

data/app/helpers/hosts_extensions_helper.rb

@@ -0,0 +1,62 @@
+module HostsExtensionsHelper
+  def rex_hosts_multiple_actions
+    return [] unless can_schedule_jobs?
+
+    [{ action: [_('Schedule Remote Job'), new_job_invocation_path, false], priority: 1000 }]
+  end
+
+  def rex_host_overview_buttons(host)
+    [
+      { button: link_to_if_authorized(_("Jobs"), hash_for_job_invocations_path(search: "host=#{host.name}"), title: _("Job invocations"), class: 'btn btn-default'), priority: 200 },
+    ]
+  end
+
+  def host_title_actions(*args)
+    title_actions(button_group(schedule_job_multi_button(*args)),
+      button_group(web_console_button(*args)))
+    super(*args)
+  end
+
+  private
+
+  def schedule_job_multi_button(*args)
+    host_features = rex_host_features(*args)
+
+    if host_features.present?
+      action_buttons(schedule_job_button(*args), *host_features)
+    else
+      schedule_job_button(*args)
+    end
+  end
+
+  def rex_host_features(host, *_rest)
+    return [] unless can_execute_on_host?(host)
+    RemoteExecutionFeature.with_host_action_button.order(:label).map do |feature|
+      link_to(_('%s') % feature.name, job_invocations_path(:host_ids => [host.id], :feature => feature.label), :method => :post)
+    end
+  end
+
+  def schedule_job_button(host, *_rest)
+    return unless can_execute_on_host?(host)
+    link_to(_('Schedule Remote Job'), new_job_invocation_path(:host_ids => [host.id]), :id => :run_button, :class => 'btn btn-default')
+  end
+
+  def web_console_button(host, *_args)
+    return if !authorized_for(permission: 'cockpit_hosts', auth_object: host) || !can_execute_on_infrastructure_host?(host)
+
+    url = SSHExecutionProvider.cockpit_url_for_host(host.name)
+    url ? link_to(_('Web Console'), url, :class => 'btn btn-default', :id => :'web-console-button', :target => '_new') : nil
+  end
+
+  def can_schedule_jobs?
+    authorized_for(controller: :job_invocations, action: :create)
+  end
+
+  def can_execute_on_host?(host)
+    can_schedule_jobs? && can_execute_on_infrastructure_host?(host)
+  end
+
+  def can_execute_on_infrastructure_host?(host)
+    !host.infrastructure_host? || User.current.can?(:execute_jobs_on_infrastructure_hosts)
+  end
+end

data/app/helpers/remote_execution_helper.rb

@@ -1,6 +1,6 @@
 module RemoteExecutionHelper
   def providers_options
-    RemoteExecutionProvider.providers.map { |key, provider| [ key, _(provider.humanized_name) ] }
+    RemoteExecutionProvider.providers.reject { |key, _provider| key == 'SSH' }.map { |key, provider| [ key, _(provider.humanized_name) ] }
   end
 
   def job_hosts_authorizer
@@ -147,9 +147,10 @@ module RemoteExecutionHelper
     end
   end
 
-  def invocation_description(invocation)
+  def invocation_description(invocation, keep_tooltip: true)
     description = invocation.description.try(:capitalize) || invocation.job_category
-    trunc_with_tooltip(description, 80)
+    description = trunc_with_tooltip(description, 80) if keep_tooltip
+    description
   end
 
   def invocation_result(invocation, key)

data/app/lib/actions/remote_execution/run_host_job.rb

@@ -40,7 +40,7 @@ module Actions
         provider = template_invocation.template.provider
         proxy_selector = provider.required_proxy_selector_for(template_invocation.template) || proxy_selector
 
-        provider_type = template_invocation.template.provider_type.to_s
+        provider_type = provider.proxy_feature
         proxy = determine_proxy!(proxy_selector, provider_type, host)
         link!(proxy)
         input[:proxy_id] = proxy.id
@@ -172,6 +172,10 @@ module Actions
         @host ||= ::Host.authorized.find(host_id)
       end
 
+      def self.cleanup_after
+        '90d'
+      end
+
       private
 
       def update_host_status

data/app/lib/actions/remote_execution/run_hosts_job.rb

@@ -153,6 +153,10 @@ module Actions
         input[:proxy_batch_size]
       end
 
+      def self.cleanup_after
+        '90d'
+      end
+
       private
 
       def mail_notification_preference

data/app/models/concerns/foreman_remote_execution/host_extensions.rb

@@ -46,6 +46,10 @@ module ForemanRemoteExecution
       end
     end
 
+    def cockpit_url
+      SSHExecutionProvider.cockpit_url_for_host(self.name)
+    end
+
     def execution_status(options = {})
       @execution_status ||= get_status(HostStatus::ExecutionStatus).to_status(options)
     end
@@ -98,7 +102,7 @@ module ForemanRemoteExecution
     end
 
     def remote_execution_ssh_keys
-      remote_execution_proxies('SSH', false).values.flatten.uniq.map { |proxy| proxy.pubkey }.compact.uniq
+      remote_execution_proxies(%w(SSH Script), false).values.flatten.uniq.map { |proxy| proxy.pubkey }.compact.uniq
     end
 
     def drop_execution_interface_cache

data/app/models/concerns/foreman_remote_execution/nic_extensions.rb

@@ -3,16 +3,18 @@ module ForemanRemoteExecution
     extend ActiveSupport::Concern
 
     included do
-      before_validation :set_execution_flag
       validate :exclusive_execution_interface
+      before_validation :move_execution_flag
     end
 
     private
 
-    def set_execution_flag
-      return unless primary? && host.present?
+    def move_execution_flag
+      return unless host && self.execution?
 
-      self.execution = true if host.interfaces.detect(&:execution).nil?
+      host.interfaces
+          .select { |i| i.execution? && i != self }
+          .each { |i| i.execution = false }
     end
 
     def exclusive_execution_interface

data/app/models/concerns/foreman_remote_execution/smart_proxy_extensions.rb

@@ -11,7 +11,7 @@ module ForemanRemoteExecution
     end
 
     def update_pubkey
-      return unless has_feature?('SSH')
+      return unless has_feature?(%w(SSH Script))
 
       key = ::ProxyAPI::RemoteExecutionSSH.new(:url => url).pubkey
       self.update_attribute(:pubkey, key) if key

data/app/models/job_invocation_composer.rb

@@ -16,6 +16,7 @@ class JobInvocationComposer
         :host_ids => ui_params[:host_ids],
         :remote_execution_feature_id => job_invocation_base[:remote_execution_feature_id],
         :description_format => job_invocation_base[:description_format],
+        :ssh_user => blank_to_nil(job_invocation_base[:ssh_user]),
         :password => blank_to_nil(job_invocation_base[:password]),
         :key_passphrase => blank_to_nil(job_invocation_base[:key_passphrase]),
         :effective_user_password => blank_to_nil(job_invocation_base[:effective_user_password]),
@@ -121,6 +122,7 @@ class JobInvocationComposer
         :targeting => targeting_params,
         :triggering => triggering_params,
         :description_format => api_params[:description_format],
+        :ssh_user => api_params[:ssh_user],
         :password => api_params[:password],
         :remote_execution_feature_id => remote_execution_feature_id,
         :effective_user_password => api_params[:effective_user_password],
@@ -217,7 +219,7 @@ class JobInvocationComposer
     def format_datetime(datetime)
       return datetime if datetime.blank?
 
-      Time.parse(datetime).utc.strftime('%Y-%m-%d %H:%M')
+      Time.parse(datetime).in_time_zone.strftime('%Y-%m-%d %H:%M')
     end
   end
 
@@ -237,6 +239,7 @@ class JobInvocationComposer
       { :job_category => job_invocation.job_category,
         :targeting => targeting_params,
         :triggering => triggering_params,
+        :ssh_user => job_invocation.ssh_user,
         :description_format => job_invocation.description_format,
         :concurrency_control => concurrency_control_params,
         :execution_timeout_interval => job_invocation.execution_timeout_interval,
@@ -399,7 +402,7 @@ class JobInvocationComposer
 
   def compose
     job_invocation.job_category = validate_job_category(params[:job_category])
-    job_invocation.job_category ||= resolve_job_category(available_job_categories.first) { |tempate| template.job_category } if @set_defaults
+    job_invocation.job_category ||= resolve_job_category(available_job_categories.first) { |template| template.job_category } if @set_defaults
     job_invocation.remote_execution_feature_id = params[:remote_execution_feature_id]
     job_invocation.targeting = build_targeting
     job_invocation.triggering = build_triggering
@@ -411,6 +414,7 @@ class JobInvocationComposer
     job_invocation.password = params[:password]
     job_invocation.key_passphrase = params[:key_passphrase]
     job_invocation.effective_user_password = params[:effective_user_password]
+    job_invocation.ssh_user = params[:ssh_user]
 
     if @reruns && job_invocation.targeting.static?
       job_invocation.targeting.assign_host_ids(JobInvocation.find(@reruns).targeting.host_ids)
@@ -544,7 +548,7 @@ class JobInvocationComposer
 
   def input_value_for(input)
     invocations = pattern_template_invocations
-    default = TemplateInvocationInputValue.new(:template_input_id => input.id)
+    default = TemplateInvocationInputValue.new(:template_input_id => input.id, :value => input.default)
     invocations.map(&:input_values).flatten.detect { |iv| iv.template_input_id == input.id } || default
   end
 

data/app/models/job_template.rb

@@ -196,7 +196,10 @@ class JobTemplate < ::Template
   def default_input_values(ignore_keys)
     result = self.template_inputs_with_foreign.select { |ti| !ti.required? && ti.input_type == 'user' }.map { |ti| ti.name.to_s }
     result -= ignore_keys.map(&:to_s)
-    Hash[result.map { |k| [ k, nil ] }]
+    default_values = self.template_inputs_with_foreign.reduce({}) do |acc, input|
+      acc.merge(input.name.to_s => input.default)
+    end
+    Hash[result.map { |k| [ k, default_values[k]] }]
   end
 
   private

data/app/models/remote_execution_provider.rb

@@ -4,7 +4,16 @@ class RemoteExecutionProvider
 
   class << self
     def provider_for(type)
-      providers[type.to_s] || providers[:SSH]
+      providers[type.to_s] || providers[:script]
+    end
+
+    def registered_name
+      klass = self
+      providers.key(klass)
+    end
+
+    def proxy_feature
+      registered_name
     end
 
     def providers

data/app/models/ssh_execution_provider.rb

@@ -1,7 +1,7 @@
-class SSHExecutionProvider < RemoteExecutionProvider
+class ScriptExecutionProvider < RemoteExecutionProvider
   class << self
     def proxy_command_options(template_invocation, host)
-      super.merge(:ssh_user => ssh_user(host),
+      super.merge(:ssh_user => ssh_user(host, template_invocation.job_invocation),
         :effective_user => effective_user(template_invocation),
         :effective_user_method => effective_user_method(host),
         :cleanup_working_dirs => cleanup_working_dirs?(host),
@@ -9,7 +9,7 @@ class SSHExecutionProvider < RemoteExecutionProvider
     end
 
     def humanized_name
-      _('SSH')
+      _('Script')
     end
 
     def supports_effective_user?
@@ -37,8 +37,7 @@ class SSHExecutionProvider < RemoteExecutionProvider
     end
 
     def ssh_params(host)
-      proxy_selector = ::RemoteExecutionProxySelector.new
-      proxy = proxy_selector.determine_proxy(host, 'SSH')
+      proxy = proxy_for_cockpit(host)
       {
         :hostname => find_ip_or_hostname(host),
         :proxy => proxy.class == Symbol ? proxy : proxy.url,
@@ -53,14 +52,28 @@ class SSHExecutionProvider < RemoteExecutionProvider
       Setting[:remote_execution_cockpit_url] % { :host => host } if Setting[:remote_execution_cockpit_url].present?
     end
 
+    def proxy_feature
+      %w(SSH Script)
+    end
+
     private
 
-    def ssh_user(host)
-      host.host_param('remote_execution_ssh_user')
+    def ssh_user(host, job_invocation = nil)
+      job_invocation&.ssh_user || host.host_param('remote_execution_ssh_user')
     end
 
     def ssh_port(host)
       Integer(host_setting(host, :remote_execution_ssh_port))
     end
+
+    def proxy_for_cockpit(host)
+      proxy_selector = ::RemoteExecutionProxySelector.new
+      proxy = proxy_selector.determine_proxy(host, 'Script', capability: 'cockpit')
+      return proxy unless [:not_defined, :not_available, nil].include?(proxy)
+
+      proxy_selector.determine_proxy(host, 'SSH')
+    end
   end
 end
+
+SSHExecutionProvider = ScriptExecutionProvider

data/app/services/default_proxy_proxy_selector.rb

@@ -7,7 +7,7 @@ class DefaultProxyProxySelector < ::RemoteExecutionProxySelector
     super
   end
 
-  def available_proxies(host, provider)
+  def available_proxies(host, provider, capability: nil)
     # TODO: Once we have a internal proxy marker/feature on the proxy, we can
     # swap the implementation
     raise _('default_capsule method missing from SmartProxy') unless ::SmartProxy.respond_to?(:default_capsule)

data/app/services/remote_execution_proxy_selector.rb

@@ -2,7 +2,12 @@ class RemoteExecutionProxySelector < ::ForemanTasks::ProxySelector
 
   INTERNAL_PROXY = 'internal'.freeze
 
-  def available_proxies(host, provider)
-    host.remote_execution_proxies(provider)
+  def available_proxies(host, provider, capability: nil)
+    proxies = host.remote_execution_proxies(provider)
+    return proxies if capability.nil?
+
+    proxies.reduce({}) do |acc, (strategy, possible_proxies)|
+      acc.merge(strategy => possible_proxies.select { |proxy| proxy.has_capability?(capability) })
+    end
   end
 end

data/app/views/api/v2/host/main.rabl

@@ -0,0 +1 @@
+attributes :cockpit_url

data/app/views/api/v2/job_invocations/base.json.rabl

@@ -1,6 +1,6 @@
 object @job_invocation
 
-attributes :id, :description, :job_category, :targeting_id, :status, :start_at, :status_label
+attributes :id, :description, :job_category, :targeting_id, :status, :start_at, :status_label, :ssh_user
 
 node do |invocation|
   {

data/app/views/dashboard/_latest-jobs.html.erb

@@ -10,7 +10,7 @@
     </tr>
     <% JobInvocation.latest_jobs.each do |invocation| %>
       <tr>
-        <td class="ellipsis"><%= link_to_if_authorized invocation_description(invocation), hash_for_job_invocation_path(invocation).merge(:auth_object => invocation, :permission => :view_job_invocations, :authorizer => authorizer) %></td>
+        <td class="ellipsis"><%= link_to_if_authorized invocation_description(invocation, keep_tooltip: false), hash_for_job_invocation_path(invocation).merge(:auth_object => invocation, :permission => :view_job_invocations, :authorizer => authorizer) %></td>
         <td><%= link_to_invocation_task_if_authorized(invocation) %></td>
         <td><%= time_in_words_span(invocation.start_at) %></td>
       </tr>

data/app/views/job_invocations/_card_target_hosts.html.erb

@@ -32,6 +32,14 @@
         <%= show_job_location(@job_location) %>
       </strong>
     </p>
+    <% if job_invocation[:ssh_user] %>
+      <p>
+        <%= _('SSH User') %>:
+        <strong>
+          <%= job_invocation[:ssh_user] %>
+        </strong>
+      </p>
+    <% end %>
   </div>
   <div class='card-pf-footer'>
     <p>

data/app/views/job_invocations/_form.html.erb

@@ -82,6 +82,8 @@
                         <% end %>
                       <% end %>
 
+                      <%= text_f f, :ssh_user, :value => f.object.ssh_user, :label => _('SSH user'), :label_help => N_('A user to be used for SSH.') %>
+
                       <% if job_template.effective_user.overridable? %>
                         <%= text_f job_template_fields, :effective_user, :value => @composer.template_invocation(job_template).try(:effective_user), :label => _('Effective user'), :label_help => N_("A user to be used for executing the script. If it differs from the SSH user, su or sudo is used to switch the accounts.") %>
                       <% end %>

data/app/views/templates/{ssh → script}/check_update.erb

@@ -1,10 +1,10 @@
 <%#
 kind: job_template
-name: Check Update - SSH Default
+name: Check Update - Script Default
 model: JobTemplate
 job_category: Packages
 description_format: "Check for package updates"
-provider_type: SSH
+provider_type: script
 %>
 
 <%

data/app/views/templates/{ssh → script}/module_action.erb

@@ -1,10 +1,10 @@
 <%#
 kind: job_template
-name: Module Action - SSH Default
+name: Module Action - Script Default
 model: JobTemplate
 job_category: Modules
 description_format: "Module %{action} %{module_spec}"
-provider_type: SSH
+provider_type: script
 template_inputs:
 - name: pre_script
   description: A script to run prior to the module action

data/app/views/templates/{ssh → script}/package_action.erb

@@ -1,10 +1,10 @@
 <%#
 kind: job_template
-name: Package Action - SSH Default
+name: Package Action - Script Default
 model: JobTemplate
 job_category: Packages
 description_format: "%{action} package(s) %{package}"
-provider_type: SSH
+provider_type: script
 template_inputs:
 - name: pre_script
   description: A script to run prior to the package action
@@ -69,8 +69,11 @@ handle_zypp_res_codes () {
 
   if [ "${ZYPP_RES_CODES[$RETVAL]}" != "" ]; then
     echo ${ZYPP_RES_CODES[$RETVAL]}
+  fi
+  if [[ $RETVAL -ge 100 && $RETVAL -le 103 ]]; then
     RETVAL=0
   fi
+
   return $RETVAL
 }
 <% end -%>

data/app/views/templates/{ssh → script}/power_action.erb

@@ -1,10 +1,10 @@
 <%#
 kind: job_template
-name: Power Action - SSH Default
+name: Power Action - Script Default
 model: JobTemplate
 job_category: Power
 description_format: '%{action} host'
-provider_type: SSH
+provider_type: script
 template_inputs:
 - name: action
   description: Action to perform on the service

data/app/views/templates/{ssh → script}/puppet_agent_disable.erb

@@ -1,5 +1,5 @@
 <%#
-name: Puppet Agent Disable - SSH Default
+name: Puppet Agent Disable - Script Default
 model: JobTemplate
 job_category: Puppet
 description_format: Disable Puppet agent
@@ -10,7 +10,7 @@ template_inputs:
   input_type: user
   description: Reason for disabling the Puppet agent
   advanced: false
-provider_type: SSH
+provider_type: script
 kind: job_template
 -%>
 <% if @host.operatingsystem.family == 'Debian' -%>

data/app/views/templates/{ssh → script}/puppet_agent_enable.erb

@@ -1,10 +1,10 @@
 <%#
-name: Puppet Agent Enable - SSH Default
+name: Puppet Agent Enable - Script Default
 model: JobTemplate
 job_category: Puppet
 description_format: Enable Puppet agent
 snippet: false
-provider_type: SSH
+provider_type: script
 kind: job_template
 -%>
 <% if @host.operatingsystem.family == 'Debian' -%>

data/app/views/templates/{ssh → script}/puppet_install_modules_from_forge.erb

@@ -1,5 +1,5 @@
 <%#
-name: Puppet Module - Install from forge - SSH Default
+name: Puppet Module - Install from forge - Script Default
 model: JobTemplate
 job_category: Puppet
 description_format: Install Puppet Module "%{puppet_module}" from forge
@@ -30,7 +30,7 @@ template_inputs:
   input_type: user
   description: Do not attempt to install dependencies. Type "true" to ignore dependencies.
   advanced: true
-provider_type: SSH
+provider_type: script
 kind: job_template
 -%>
 <% if @host.operatingsystem.family == 'Debian' -%>

data/app/views/templates/{ssh → script}/puppet_install_modules_from_git.erb

@@ -1,5 +1,5 @@
 <%#
-name: Puppet Module - Install from git - SSH Default
+name: Puppet Module - Install from git - Script Default
 model: JobTemplate
 job_category: Puppet
 description_format: Install Puppet Module "%{puppet_module}" from git
@@ -15,7 +15,7 @@ template_inputs:
   input_type: user
   description: For example, '/etc/puppetlabs/code/environments/production/modules/puppet'.
   advanced: false
-provider_type: SSH
+provider_type: script
 kind: job_template
 -%>
 git clone <%= input('git_repository') %> <%= input('target_dir') %>

data/app/views/templates/{ssh → script}/puppet_run_once.erb

@@ -1,10 +1,10 @@
 <%#
 kind: job_template
-name: Puppet Run Once - SSH Default
+name: Puppet Run Once - Script Default
 model: JobTemplate
 job_category: Puppet
 description_format: 'Run Puppet once with "%{puppet_options}"'
-provider_type: SSH
+provider_type: script
 template_inputs:
 - name: puppet_options
   description: Additional options to pass to puppet

data/app/views/templates/{ssh → script}/run_command.erb

@@ -1,10 +1,10 @@
 <%#
 kind: job_template
-name: Run Command - SSH Default
+name: Run Command - Script Default
 model: JobTemplate
 job_category: Commands
 description_format: "Run %{command}"
-provider_type: SSH
+provider_type: script
 template_inputs:
 - name: command
   description: Command to run on the host

data/app/views/templates/{ssh → script}/service_action.erb

@@ -1,10 +1,10 @@
 <%#
 kind: job_template
-name: Service Action - SSH Default
+name: Service Action - Script Default
 model: JobTemplate
 job_category: Services
 description_format: '%{action} service %{service}'
-provider_type: SSH
+provider_type: script
 template_inputs:
 - name: action
   description: Action to perform on the service

data/db/migrate/20220321101835_rename_ssh_provider_to_script.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+class RenameSshProviderToScript < ActiveRecord::Migration[6.0]
+
+  def do_change(from, to, from_re, new_label)
+    setting = Setting.find_by(:name => 'remote_execution_form_job_template')
+    default_template = nil
+
+    Template.where(:provider_type => from).each do |t|
+      default_template = t if t.name == setting&.value
+      t.provider_type = to
+      t.name = t.name.gsub(from_re, new_label)
+      t.save!
+    end
+
+    if default_template
+      setting.value = default_template.name
+      setting.save!
+    end
+  end
+
+  def up
+    do_change 'SSH', 'script', /SSH Default$/, 'Script Default'
+  end
+
+  def down
+    do_change 'script', 'SSH', /Script Default$/, 'SSH Default'
+  end
+end

data/db/migrate/20220331112719_add_ssh_user_to_job_invocation.rb

@@ -0,0 +1,5 @@
+class AddSshUserToJobInvocation < ActiveRecord::Migration[6.0]
+  def change
+    add_column :job_invocations, :ssh_user, :string
+  end
+end