ATC/Lakehouse
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add ObjectScale to SSH mesh (admin bootstrap, root via keys)

Browse Source 
ObjectScale blocks root SSH by default; only admin accepts login.
Bootstrap installs cluster key for admin and root; document in ssh-mesh.md.
This commit is contained in:
Lakehouse Admin
2026-05-19 22:50:32 +02:00
parent f3d24634e4
commit f0c56f137c
6 changed files with 285 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ssh-mesh.md
+42 -26
View File
@@ -1,6 +1,6 @@
# SSH mesh — passwordless access
All ATC lab VMs share a cluster SSH key so root can hop between hosts without passwords.
All ATC lab VMs share a cluster SSH key so hosts can hop between each other without passwords.
## Design
@@ -15,20 +15,39 @@ Proxmox (`pve01`) also keeps its admin key in each VM's `authorized_keys` for br
## Fleet (mesh enabled)
| Hostname | IP |
|----------|-----|
| atc-docker01 | 10.0.21.45 |
| atc-docker02 | 10.0.21.47 |
| atc-mgt01 | 10.0.20.104 |
| atc-kafka01 | 10.0.21.36 |
| atc-lake01 | 10.0.21.50 |
| atc-elastic01 | 10.0.21.46 |
| atc-db01 | 10.0.20.112 |
| atc-db02 | 10.0.21.51 |
| atc-grafana | 10.0.20.103 |
| atc-airflow01 | 10.0.21.55 |
| atc-portal01 | 10.0.21.49 |
| atc-lama01 | 10.0.21.39 |
| Hostname | IP | SSH user |
|----------|-----|----------|
| atc-docker01 | 10.0.21.45 | root |
| atc-docker02 | 10.0.21.47 | root |
| atc-mgt01 | 10.0.20.104 | root |
| atc-kafka01 | 10.0.21.36 | root |
| atc-lake01 | 10.0.21.50 | root |
| atc-elastic01 | 10.0.21.46 | root |
| atc-db01 | 10.0.20.112 | root |
| atc-db02 | 10.0.21.51 | root |
| atc-grafana | 10.0.20.103 | root |
| atc-airflow01 | 10.0.21.55 | root |
| atc-portal01 | 10.0.21.49 | root |
| atc-lama01 | 10.0.21.39 | root |
| **atc-objectscale** | **10.0.20.111** | **admin** (root via key after bootstrap) |
## ObjectScale (special case)
Dell ObjectScale runs **Luna OS** (CentOS 7-based). Out of the box:
- **`root` SSH login is disabled** — only `admin` accepts SSH (appliance default).
- Default lab password was used once to bootstrap keys; after bootstrap, use the cluster key only.
```bash
# From any mesh host (root works after bootstrap):
ssh -i /root/.ssh/atc_cluster root@atc-objectscale hostname # → luna.local
ssh -i /root/.ssh/atc_cluster admin@atc-objectscale hostname # also works
# Web UI
https://10.0.20.111/ or https://atc-objectscale/
```
Bootstrap script: `scripts/setup/setup-objectscale-ssh.sh` (run from Proxmox if keys are missing).
## Deploy / refresh
@@ -37,6 +56,7 @@ From Proxmox (or any host with root SSH to the fleet):
```bash
cd /root/lakehouse
./scripts/setup/setup-ssh-mesh.sh
./scripts/setup/setup-objectscale-ssh.sh # if ObjectScale was reinstalled
```
## Test
@@ -44,26 +64,22 @@ cd /root/lakehouse
```bash
ssh -i ~/.ssh/atc_cluster root@atc-docker01
ssh -i ~/.ssh/atc_cluster root@atc-lake01 hostname
# or from docker01:
for h in atc-db01 atc-kafka01 atc-mgt01; do
ssh -i ~/.ssh/atc_cluster root@atc-objectscale hostname -f
for h in atc-db01 atc-kafka01 atc-objectscale; do
ssh -i /root/.ssh/atc_cluster root@$h hostname -f
done
```
## Hosts not yet in the mesh
These VMs did not accept the hypervisor key (different credentials or SSH policy):
These VMs still reject the hypervisor key (different credentials or SSH policy):
- `10.0.21.52`, `10.0.21.37`, `10.0.21.38`, `10.0.21.41`
- `10.0.20.111` (ObjectScale), `10.0.20.31`, `10.0.21.44`
- `10.0.20.31`, `10.0.21.44`
Add the cluster public key manually after fixing root access:
```bash
cat /root/.ssh/atc_cluster.pub # from any mesh host
# paste into target:/root/.ssh/authorized_keys
```
Add the cluster public key manually after fixing access.
## Security note
The cluster private key is powerful. Restrict Forgejo repo access and rotate keys if the lab is exposed outside your network.
The cluster private key is powerful. Restrict Forgejo repo access and rotate keys if the lab is exposed outside your network. Do not commit ObjectScale `admin` passwords to git.