plus3it / cfn-gitlab

Use AWS CloudFormation to deploy GitLab onto STIG-hardened EL7 Amazon instances

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

[Bug] Node SSH Keys Not Persistent

ferricoxide opened this issue · comments

Describe the bug

When templates deploy replacement instances, the host SSH keys are not persisted across instantiations. This causes clients using SSH for push/pull to pop a MITM attack-alert

Severity

  • Completely Broken (No work-around evident)
  • Severely Broken (Work-around possible but difficult)
  • Moderately Broken (Trivial work-around)
  • Nuisance (Functions but untrapped errors can slip through)

To Reproduce

Use either the Standalone templates to deploy a new stack-set for migration or use the Autoscale templates to do automated rebuilds. Whenever the new instance(s) are made "live", SSH clients pop host-key errors

Expected behavior

Reprovision events are transparent to service-consumers

Fix Suggestions

Add logic to check config-bucket for service host-key files: if present download them in place of the ones generated at instance-launch; if absent, copy-up the host-key files to the config-bucket.