Lakehouse Admin
f3d24634e4
- Translate all documentation to English - Add docs/ssh-mesh.md and scripts/setup/setup-ssh-mesh.sh - Add config/hosts/atc-lab.hosts for /etc/hosts on all VMs - Ignore atc_cluster private key in git; mesh deployed on 12 hosts
1.8 KiB
1.8 KiB
SSH mesh — passwordless access
All ATC lab VMs share a cluster SSH key so root can hop between hosts without passwords.
Design
| Item | Path / value |
|---|---|
| Shared private key | /root/.ssh/atc_cluster (on each VM, not in git) |
| Shared public key | /root/.ssh/atc_cluster.pub |
| SSH client snippet | /root/.ssh/config.d/99-atc-lab.conf |
| Host aliases | /etc/hosts block tagged ATC Lakehouse lab |
Proxmox (pve01) also keeps its admin key in each VM's authorized_keys for break-glass access.
Fleet (mesh enabled)
| Hostname | IP |
|---|---|
| atc-docker01 | 10.0.21.45 |
| atc-docker02 | 10.0.21.47 |
| atc-mgt01 | 10.0.20.104 |
| atc-kafka01 | 10.0.21.36 |
| atc-lake01 | 10.0.21.50 |
| atc-elastic01 | 10.0.21.46 |
| atc-db01 | 10.0.20.112 |
| atc-db02 | 10.0.21.51 |
| atc-grafana | 10.0.20.103 |
| atc-airflow01 | 10.0.21.55 |
| atc-portal01 | 10.0.21.49 |
| atc-lama01 | 10.0.21.39 |
Deploy / refresh
From Proxmox (or any host with root SSH to the fleet):
cd /root/lakehouse
./scripts/setup/setup-ssh-mesh.sh
Test
ssh -i ~/.ssh/atc_cluster root@atc-docker01
ssh -i ~/.ssh/atc_cluster root@atc-lake01 hostname
# or from docker01:
for h in atc-db01 atc-kafka01 atc-mgt01; do
ssh -i /root/.ssh/atc_cluster root@$h hostname -f
done
Hosts not yet in the mesh
These VMs did not accept the hypervisor key (different credentials or SSH policy):
10.0.21.52,10.0.21.37,10.0.21.38,10.0.21.4110.0.20.111(ObjectScale),10.0.20.31,10.0.21.44
Add the cluster public key manually after fixing root access:
cat /root/.ssh/atc_cluster.pub # from any mesh host
# paste into target:/root/.ssh/authorized_keys
Security note
The cluster private key is powerful. Restrict Forgejo repo access and rotate keys if the lab is exposed outside your network.