github.com/grailbio/base@v0.0.11/cmd/grail-access/remote/doc.go (about)

     1  // Copyright 2022 GRAIL, Inc. All rights reserved.
     2  // Use of this source code is governed by the Apache-2.0
     3  // license that can be found in the LICENSE file.
     4  
     5  /*
     6  Package remote implements sending (and receiving) of blessings to remote
     7  machines over SSH.
     8  
     9  The remote machine must be accessible by SSH and have a version of grail-access
    10  in $PATH that supports remote blessing.
    11  
    12  The protocol looks like this:
    13  
    14  	+-------+                                                 +---------+
    15  	| Local |                                                 | Remote  |
    16  	+-------+                                                 +---------+
    17  	    |                                                          |
    18  	    | grail-access -bless-remotes                              |
    19  	    |----------------------------                              |
    20  	    |                           |                              |
    21  	    |<---------------------------                              |
    22  	    |                                                          |
    23  	    | ssh dest grail-access -bless-remotes-mode=PublicKey      |
    24  	    |--------------------------------------------------------->|
    25  	    |                                                          |
    26  	    |                            [remote principal public key] |
    27  	    |<---------------------------------------------------------|
    28  	    |                                                          |
    29  	    | blessings <= bless remote principal public key           |
    30  	    |-----------------------------------------------           |
    31  	    |                                              |           |
    32  	    |<----------------------------------------------           |
    33  	    |                                                          |
    34  	    | ssh dest grail-access -bless-remotes-mode=Receive        |
    35  	    |--------------------------------------------------------->|
    36  	    |                                                          |
    37  	    | transmit blessings (on stdout)                           |
    38  	    |--------------------------------------------------------->|
    39  	    |                                                          |
    40  	    |                                                          | set blessings
    41  	    |                                                          |--------------
    42  	    |                                                          |             |
    43  	    |                                                          |<-------------
    44  	    |                                                          |
    45  
    46  Remote machines are specified by the -bless-remotes-targets flag which accepts
    47  a comma-separated list of targets.  There are two types of targets: SSH
    48  destinations and EC2 names, specified with "ssh:" and "ec2-name:" respectively.
    49  
    50  SSH destination targets are destinations as ssh accepts, [user@]host[:port],
    51  e.g.:
    52  	ssh:10.1.0.120
    53  	ssh:ubuntu@ec2-34-214-222-123.us-west-2.compute.amazonaws.com
    54  	ssh:10.1.0.120:822
    55  
    56  EC2 name targets use AWS EC2 instance names (i.e. the value of the Name tag),
    57  [user@]instancename, e.g.:
    58  	ec2-name:my-instance-name
    59  	ec2-name:core@another-instance
    60  
    61  EC2 names are treated as filters, so "ec2-name:core@my-*-name" will target all
    62  instances matching "my-*-name" (and ssh them as user "core").  See
    63  https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Filtering.html .
    64  
    65  Example:
    66  	grail-access -bless-remotes -bless-remotes-targets="ssh:me@mine.com,ec2-name:my-instance-*"
    67  
    68  This invocation will target the SSH destination "me@mine.com" as well as all
    69  EC2 instances whose Name tag matches "my-instance-*" (using the default ssh
    70  username).
    71  
    72  Note that we don't yet support custom ports for ec2-name targets, as ':' is a
    73  valid character in names, and we are preferring to keep the parsing simple.
    74  */
    75  package remote