Autogenerate public key

[miguel-abulencia]

In what area(s)?

cyclecloud-slurm-workspace/bicep/publicKey.bicep

Lines 4 to 10 in 5eb50c8

	//TODO: Add autogenerate public key logic via REST API call in uidefinition file
	/*
	resource autogenerate_publickey 'Microsoft.Compute/sshPublicKeys@2023-09-01' = if (autogenerateSecrets) {
	name: 'autoGeneratedKey'
	location: location
	}
	*/

Describe the feature

Just wondering if the auto-generate SSH public key feature is coming anytime soon?
It’d be super helpful to have this working, especially for smoother deployments without needing to pre-create keys manually.

[ossonts]

There is an API to generate ssh keys. This option is handy to return a private key to the creator without having to get a user s specify their public key.

In ARM/Bicep generate a SSH key:

 {
            "type": "Microsoft.Compute/sshPublicKeys",
            "apiVersion": "2021-11-01",
            "name": "[variables('cycleSSHKeyName')]",
            "location": "[variables('resourceLocation')]"
        },

then in your python you need to call the API to actually generate the key (you get one go at this)

def create_keypair(use_managed_identity, vm_metadata, ssh_key_name):
    if use_managed_identity:
        managed_identity = get_vm_managed_identity()
        access_token = managed_identity["access_token"]
        access_headers = {
            "Authorization": f"Bearer {access_token}"
        }

    subscriptionId = vm_metadata["compute"]["subscriptionId"]   #You know this already so vm_metadata is not needed
    resourceGroup = vm_metadata["compute"]["resourceGroupName"]

    sshkey_url = "https://management.azure.com/subscriptions/{}/resourceGroups/{}/providers/Microsoft.Compute/sshPublicKeys/{}/generateKeyPair?api-version=2021-11-01".format(subscriptionId, resourceGroup, ssh_key_name)
    sshkey_req = Request(sshkey_url, method="POST", headers=access_headers)

    for _ in range(30):
        print("Generating SSH key")
        sshkey_response = urlopen(sshkey_req, timeout=2)

        try:
            return json.load(sshkey_response)
        except ValueError as e:
            print("Failed to generate SSH key %s" % e)
            print("    Retrying")
            sleep(2)
            continue
        except:
            print("Unable to generate SSH key after 30 tries")
            raise

to get the actual key

ssh_key = create_keypair(args.useManagedIdentity, vm_metadata, args.sshkey)
    public_key_raw = ssh_key["publicKey"]
    # Remove the carriage return characters from the JSON string for the public key
    public_key = public_key_raw.replace("\r\n","")
    private_key = ssh_key["privateKey"]

One you have the key, you can store and return or just return.

[xpillons]

Thanks for the suggestion, but there is no way to do this only in bicep, and if you have to deploy with a script, then you can automate this on your end. Unfortunately we can't manage customers private key for them.

[ossonts]

Just checking I got it right.

Is the issue generating a key or is the issue generating keys that are on the customers sub?

If generating a key (just for the current cluster install) is okay then it is easy in bicep by using a deployscript to run the keygen and return both private and public keys back into the ARM / Bicep template, these can then be used where needed.

This does not need any identity/ nor keyvault access.

[xpillons]

The issue is on the responsibility of the management of the security of the private key. While deployscript could be an option, this is slow. But I agree, we should find a way to do it better.

[ossonts]

The deploy script takes 60seconds and it is in parallel with other deployment resources -- so wall time is not much more.

Example Module (filename: ./generateSSHKey.bicep)

param location string = resourceGroup().location

resource generateSSH 'Microsoft.Resources/deploymentScripts@2020-10-01' = {
  name: 'generateSSHKey'
  location: location
  kind: 'AzureCLI'
  properties: {
    azCliVersion: '2.56.0'
    scriptContent: '''
      #!/bin/bash
      set -euo pipefail

      KEYFILE="/tmp/id_rsa"
      PUBKEYFILE="${KEYFILE}.pub"

      echo "Generating SSH key..."
      ssh-keygen -t rsa -m PEM -f "$KEYFILE" -C "generated_by_bicep" -N ""

      if [ ! -f "$KEYFILE" ]; then
        echo "SSH private key not found." >&2
        exit 1
      fi

      if [ ! -f "$PUBKEYFILE" ]; then
        echo "SSH public key not found." >&2
        exit 1
      fi

      PEM_CONTENT=$(cat "$KEYFILE")
      PUBKEY_CONTENT=$(cat "$PUBKEYFILE")

      jq -n --arg pem "$PEM_CONTENT" --arg publicKey "$PUBKEY_CONTENT" '{ pem: $pem, publicKey: $publicKey }' > "$AZ_SCRIPTS_OUTPUT_PATH"
    '''
    retentionInterval: 'PT1H'
    cleanupPreference: 'OnSuccess'
    timeout: 'PT5M'
  }
}

output pem string = generateSSH.properties.outputs.pem
output publicKey string = generateSSH.properties.outputs.publicKey

USAGE

module generateSSHKey './generateSSHKey.bicep' = {
  name: 'generateSSHKey'
  params: {
    location: az.resourceGroup().location
  }
}

//using 
adminSshPublicKey: generateSSHKey.outputs.publicKey
//and
extractedPEM string = generateSSHKey.outputs.pem