Documentation
¶
Overview ¶
Package sshkeys is the guest-side application of dynamically-pushed SSH authorized-keys updates. The host (weft-agent, or — until that lands — weft-webui's in-memory store) publishes the full desired set of keys for this VM whenever the catalogue changes ; the subscriber re-writes the target user's authorized_keys atomically (idempotent, replace-set).
Same Subscriber+ApplyFunc pattern as [[mesh]] and [[mounts]] : state is pushed whole rather than diffed, so a missed message self-heals on the next publish.
The actual file write is injected by the caller (ApplyFunc) so the pure decode/validate path is testable without root or a real filesystem.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func HandleMessage ¶
HandleMessage decodes a published update and applies it. Pure aside from the injected apply — the decode/validate path runs without a filesystem or a broker.
Types ¶
type ApplyFunc ¶
ApplyFunc applies the desired key set to the guest. The real implementation rewrites the target user's authorized_keys atomically (see cmd/weft-microvm-agent/sshkeys_linux.go). Tests inject a stub.
type Key ¶
type Key struct {
PublicKey string `json:"public_key"`
}
Key is one authorized-key entry. `PublicKey` is the full OpenSSH line (`<type> <base64> [comment]`) ; the fingerprint is host-side bookkeeping and isn't needed inside the guest.
type KeySet ¶
type KeySet struct {
Keys []Key `json:"keys"`
}
KeySet is the desired set of keys for this VM at this point in time. Empty Keys is a legitimate state — "no key authorised" — and MUST be applied (writing an empty authorized_keys, not skipping).
func (KeySet) Validate ¶
Validate enforces the minimal shape every key line needs : a type prefix (one of the known OpenSSH algorithms) followed by a base64 blob. Comments are optional. We don't decode the base64 or compute the fingerprint here — the host did that already, and a guest that re-validated would just be double-checking the wire.
type Subscriber ¶
type Subscriber struct {
// contains filtered or unexported fields
}
Subscriber listens for this VM's sshkeys updates and applies each.
func NewSubscriber ¶
NewSubscriber builds a Subscriber for vmID that applies updates via apply.
func (*Subscriber) Start ¶
func (s *Subscriber) Start() (*nats.Subscription, error)
Start subscribes to the VM's sshkeys subject. The returned subscription is live until unsubscribed or the connection drops.
Source Files