hetzner-k3s 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d251d84c9600608af2e382ae10838104bb8fe81fa87b1058b25fd571187a0a88
-  data.tar.gz: 9530af5905cebe724e6be2eafaf60da07172a7a640b1913e3572ee419b0feaed
+  metadata.gz: 7702216e981cea045d5c8fc09087a233a41ed06fa1a812e2aab008db8375e953
+  data.tar.gz: 43d606e2517b62bd27ba040305b67c9a84f07d6e55a84ea5ed1a0d92ba501af9
 SHA512:
-  metadata.gz: c3b567d8c78c29bc0785d943c52ab65eab40d934ebdf01045c7efd0c76d74087eca2f81c1a790fb4d700bf39c92a696aca9794e17c252467de7838bb2149e56e
-  data.tar.gz: 010a87dd114c2d1209f8da453ebb8123fbbf4f4684dacf3aa2e85d648715c78013f798e68b413603a25f9869e153afced6104cceca5914060aaedb6de8a358b2
+  metadata.gz: 1b7286180209083562f31e07b6227e47c04db0fdc3eadbb9fbd8506cf63bbd59bf449f8d99a48f6d9647e03214a84c04ef2c364c9d2a004b71777557607dd9d1
+  data.tar.gz: 6fa33623fb8dccbf06395aa5fbb14d74ad2a4581954c7a425b839eef1ccb04888ed7abe1025b245fcade8dac18be6864c702c240d5c5fdfc87370a884735bfd9

data/README.md

@@ -44,6 +44,7 @@ cluster_name: test
 kubeconfig_path: "./kubeconfig"
 k3s_version: v1.21.3+k3s1
 ssh_key_path: "~/.ssh/id_rsa.pub"
+verify_host_key: false
 location: nbg1
 masters:
   instance_type: cpx21
@@ -74,6 +75,8 @@ curl \
 ```
 
 
+Note: the option `verify_host_key` is by default set to `false` to disable host key verification. This is because sometimes when creating new servers, Hetzner may assign IP addresses that were previously used by other servers you owned in the past. Therefore the host key verification would fail. If you set this option to `true` and this happens, the tool won't be able to continue creating the cluster until you resolve the issue with one of the suggestions it will give you.
+
 Finally, to create the cluster run:
 
 ```bash
@@ -211,6 +214,9 @@ Once the cluster is ready you can create persistent volumes out of the box with
 
 ## changelog
 
+- 0.3.1
+  - Allow enabling/disabling the host key verification
+
 - 0.3.0
   - Handle case when an SSH key with the given fingerprint already exists in the Hetzner project
   - Handle a timeout of 5 seconds for requests to the Hetzner API

data/cluster_config.yaml.example

@@ -4,6 +4,7 @@ cluster_name: test
 kubeconfig_path: "../kubeconfig"
 k3s_version: v1.21.3+k3s1
 ssh_key_path: "~/.ssh/id_rsa.pub"
+verify_host_key: false
 location: nbg1
 masters:
   instance_type: cpx21

data/lib/hetzner/k3s/cli.rb

@@ -80,6 +80,7 @@ module Hetzner
             validate_k3s_version
             validate_masters
             validate_worker_node_pools
+            validate_verify_host_key
           when :delete
             validate_kubeconfig_path_must_exist
           when :upgrade
@@ -292,6 +293,12 @@ module Hetzner
           errors << "Cannot connect to the Kubernetes cluster"
           false
         end
+
+
+        def validate_verify_host_key
+          return unless [true, false].include?(configuration.fetch("ssh_key_path", false))
+          errors << "Please set the verify_host_key option to either true or false"
+        end
     end
   end
 end

data/lib/hetzner/k3s/cluster.rb

@@ -29,6 +29,7 @@ class Cluster
     @masters_config = configuration.dig("masters")
     @worker_node_pools = configuration.dig("worker_node_pools")
     @location = configuration.dig("location")
+    @verify_host_key = configuration.fetch("verify_host_key", false)
     @servers = []
 
     create_resources
@@ -68,7 +69,7 @@ class Cluster
                 :masters_config, :worker_node_pools,
                 :location, :ssh_key_path, :kubernetes_client,
                 :hetzner_token, :tls_sans, :new_k3s_version, :configuration,
-                :config_file
+                :config_file, :verify_host_key
 
 
     def latest_k3s_version
@@ -138,14 +139,14 @@ class Cluster
         end
       end
 
-      threads.each(&:join)
+      threads.each(&:join) unless threads.empty?
 
       puts
       threads = servers.map do |server|
         Thread.new { wait_for_ssh server }
       end
 
-      threads.each(&:join)
+      threads.each(&:join) unless threads.empty?
     end
 
     def delete_resources
@@ -160,22 +161,22 @@ class Cluster
             end
           end
 
-          threads.each(&:join)
+          threads.each(&:join) unless threads.empty?
         end
-      rescue Timeout::Error
+      rescue Timeout::Error, Excon::Error::Socket
         puts "Unable to fetch nodes from Kubernetes API. Is the cluster online?"
       end
 
       # Deleting nodes defined in the config file just in case there are leftovers i.e. nodes that
       # were not part of the cluster for some reason
 
-      threads = all_servers.each do |server|
+      threads = all_servers.map do |server|
         Thread.new do
           Hetzner::Server.new(hetzner_client: hetzner_client, cluster_name: cluster_name).delete(server_name: server["name"])
         end
       end
 
-      threads.each(&:join)
+      threads.each(&:join) unless threads.empty?
 
       puts
 
@@ -292,7 +293,7 @@ class Cluster
           end
         end
 
-        threads.each(&:join)
+        threads.each(&:join) unless threads.empty?
       end
 
       threads = workers.map do |worker|
@@ -307,7 +308,7 @@ class Cluster
         end
       end
 
-      threads.each(&:join)
+      threads.each(&:join) unless threads.empty?
     end
 
     def deploy_cloud_controller_manager
@@ -464,18 +465,23 @@ class Cluster
       public_ip = server.dig("public_net", "ipv4", "ip")
       output = ""
 
-      Net::SSH.start(public_ip, "root", verify_host_key: :never) do |session|
+      Net::SSH.start(public_ip, "root", verify_host_key: (verify_host_key ? :always : :never)) do |session|
         session.exec!(command) do |channel, stream, data|
           output << data
           puts data if print_output
         end
       end
-
       output.chop
     rescue Net::SSH::Disconnect => e
       retry unless e.message =~ /Too many authentication failures/
     rescue Net::SSH::ConnectionTimeout, Errno::ECONNREFUSED, Errno::ENETUNREACH, Errno::EHOSTUNREACH
       retry
+    rescue Net::SSH::HostKeyMismatch
+      puts
+      puts "Cannot continue: Unable to SSH into server with IP #{public_ip} because the existing fingerprint in the known_hosts file does not match that of the actual host key."
+      puts "This is due to a security check but can also happen when creating a new server that gets assigned the same IP address as another server you've owned in the past."
+      puts "If are sure no security is being violated here and you're just creating new servers, you can eiher remove the relevant lines from your known_hosts (see IPs from the cloud console) or disable host key verification by setting the option 'verify_host_key' to false in the configuration file for the cluster."
+      exit 1
     end
 
     def kubernetes_client

data/lib/hetzner/k3s/version.rb

@@ -1,5 +1,5 @@
 module Hetzner
   module K3s
-    VERSION = "0.3.0"
+    VERSION = "0.3.1"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hetzner-k3s
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Vito Botta