Sync a Concourse authoriezd key with ssh keys provided by Cycloid devops platform.
100K+
This image sync a Concourse team yaml authoriezd key file with vault ssh keys provided by Cycloid devops platform.
Each check interval, it will list all concourse teams into vault, and look for worker ssh keys, insert them into the authorized key file (shared with Concourse).
Then send a USER1 signal to Concourse web process to re-open the authorized key file.
| Env var name | Required | Description |
|---|---|---|
| VAULT_URL | yes | Vault server URL. Example : https://vault.concourse.io |
| VAULT_ROLE_ID | yes | Approle role ID of the vault server |
| VAULT_SECRET_ID | yes | Approle secret ID of the vault server |
| VAULT_MOUNT_POINT | no | Mount point of the vault server. Default cycloid |
| CHECK_INTERVAL | no | Interval in secondes to run the check of new Cycloid teams. Default 60 |
| YAML_KEYS_FILE | no | Path of the yaml team authorized key file. Default /datas/team_authorized_worker_keys.yml |
| START_GRACE_PERIODE | no | Wait N secondes before starting. Default 60. |
| VERBOSE | no | Run in verbose mode. Default False |
sudo docker run --pid=container:<concourse web container name>\
-v <concourse web volume for the authorized key>:/datas \
-e VAULT_URL=... \
-e VAULT_ROLE_ID=... \
-e VAULT_SECRET_ID=... \
cycloid/concourse-team-authorized-key-sync
Note :
If you run it with docker or k8s, it's important to have a shared volume for the authorized_key file between Concourse web and this container.
The second point is to share process namespaces between this container and Concourse web, to be able to send USER1 signal to Concourse. See https://github.com/concourse/concourse/issues/1105#issuecomment-473360524
In case of Docker : --pid=container:<container_name>. In case of k8s shareProcessNamespace: true$ see https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/
sudo docker build -t cycloid/concourse-team-authorized-key-sync .
sudo docker push cycloid/concourse-team-authorized-key-sync
Content type
Image
Digest
sha256:695ccc7ee…
Size
435.9 MB
Last updated
about 1 month ago
docker pull cycloid/concourse-team-authorized-key-sync