KNEL/PFVCluster
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(bootstrap): AGENT_USER parameter for subodev/ultixfield systems

Browse Source 
agent-bootstrap.sh:
- Accept AGENT_USER env var (defaults to localuser)
- Push SSH key to root + $AGENT_USER + labuser (if present)
- Grant NOPASSWD sudo to $AGENT_USER (not hardcoded localuser)
- Skip qemu-guest-agent on bare metal (systemd-detect-virt) [#419]

bootstrap-all.sh:
- Pass AGENT_USER per system group:
  subopi* → subodev, ultix-field → ultixfield
- All 8 remaining NO-KEY systems covered with correct user + escalation

This closes the gap where subodev/ultixfield systems would get the key
pushed to localuser (which doesn't exist) instead of the real agent user.

Refs [#403], [#419]

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
This commit is contained in:
mrcharles
2026-08-10 15:38:30 -05:00
parent 13f4e44671
commit dbecf87806
2 changed files with 46 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bootstrap-all.sh
+14 -11
View File
@@ -5,6 +5,9 @@
# sudo → Ubuntu systems (no root password, localuser has sudo)
# su → Debian systems (root has a password)
#
# Passes AGENT_USER so agent-bootstrap.sh pushes the key + sudo to the
# correct unprivileged user per system type.
#
# You'll enter passwords interactively. Idempotent: safe to re-run.
set -u
cd "$(dirname "$0")" || exit 1
@@ -13,24 +16,24 @@ SCRIPT=agent-bootstrap.sh
SSH_OPTS=(-o StrictHostKeyChecking=accept-new -o ConnectTimeout=10)
run_with_sudo() {
local name="$1" ip="$2" user="$3"
local name="$1" ip="$2" user="$3" agent_user="${4:-localuser}"
echo "========================================"
echo " $name ($ip) — $user (sudo)"
echo " $name ($ip) — $user (sudo, agent=${agent_user})"
echo "========================================"
scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" \
&& ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" "sudo bash /tmp/$SCRIPT" \
&& ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" "sudo AGENT_USER=${agent_user} bash /tmp/$SCRIPT" \
&& echo " -> $name DONE" \
|| echo " -> $name FAILED"
echo
}
run_with_su() {
local name="$1" ip="$2" user="$3"
local name="$1" ip="$2" user="$3" agent_user="${4:-localuser}"
echo "========================================"
echo " $name ($ip) — $user (su)"
echo " $name ($ip) — $user (su, agent=${agent_user})"
echo "========================================"
scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" \
&& ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" "su -c 'bash /tmp/$SCRIPT'" \
&& ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" "su -c 'AGENT_USER=${agent_user} bash /tmp/$SCRIPT'" \
&& echo " -> $name DONE" \
|| echo " -> $name FAILED"
echo
@@ -44,17 +47,17 @@ run_with_sudo sectestbed-cloudron 100.97.140.105 localuser
run_with_sudo kali-tsys 100.82.30.115 localuser
run_with_sudo pfvsvrpi 100.91.151.113 localuser
# === Debian: subodev + su (root password reset) ===
# === Debian: subodev + su ===
echo "### Debian: subodev + su ###"
echo
run_with_su subopi3 100.93.17.77 subodev
run_with_su subopi-dev-3 100.64.231.65 subodev
run_with_su subopi-dev-4 100.65.224.85 subodev
run_with_su subopi3 100.93.17.77 subodev subodev
run_with_su subopi-dev-3 100.64.231.65 subodev subodev
run_with_su subopi-dev-4 100.65.224.85 subodev subodev
# === Debian: ultixfield + su ===
echo "### Debian: ultixfield + su ###"
echo
run_with_su ultix-field 100.115.233.124 ultixfield
run_with_su ultix-field 100.115.233.124 ultixfield ultixfield
echo "========================================"
echo "Done. Tell the agent to re-run access-matrix.sh to verify."