sweep: verify pool host keys on the driver

Open
  • Is something wrong?
#451 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
github-actions, go
Domain
devops, security, testing

Research direction

Start with generatedSSHConfig() in benchkit/cmd/sweep/driver.go and trace how sweep options reach the release workflows and cluster-check probe. Add a pool known_hosts option, pass the pool keys from the proposed cluster secret, and check the probe’s behavior for unknown or changed keys. Done means release checks reject untrusted pool keys while interactive sweeps keep their current default.

Written by the indexing model from the issue text.

Description

The driver dials the pool hosts with host-key checking turned off. generatedSSHConfig() in benchkit/cmd/sweep/driver.go writes StrictHostKeyChecking no and UserKnownHostsFile /dev/null for every host.

This matters for the release smoke gate in #449. The runner pins the host keys of the jump host and the driver, but nothing pins the pool hosts. A machine on the cluster network that can impersonate a pool host can accept the SSH session from the driver. It can then fake the -check diagnostics or the benchmark output, and a release could pass the gate on fabricated results.

Proposal

  • Add a sweep option that gives the driver a known_hosts file for the pool, and switches the generated config to StrictHostKeyChecking yes when the option is set.
  • In the release workflows, pass the pool host keys from a new cluster environment secret, for example CLUSTER_POOL_KNOWN_HOSTS.
  • Make cluster-check fail when a pool key is unknown or has changed, and test that failure in the probe.
  • Keep the current behavior as the default for interactive sweeps, unless we decide otherwise.

The change touches the SSH config that sweep generates for every user, so it is kept out of the #446/#447/#449 stack.

Raised in review of #449.

Dominant language
Go
Stars
149
Forks
15
Avg merge
1d 54m
Merged PRs (30d)
53

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from relab/gorums

All issues in relab/gorums

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.