support per-pod ssh credential override

[travisghansen]

Feature request

Type

• - Enhancement - completely new feature
• - Improvement - make what we have better

Is your feature request related to a problem?

A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

We have different groups building different images with different needs/desires for user account naming.

Describe the solution you'd like

A clear and concise description of what you want to happen.

I would like to be able to set the ssh creds on a per-pod basis by setting an annotation/label with the username and password to be used for that pod and overriding the defaults as set by the corresponding env vars.

Additional context

Add any other context or screenshots about the feature request here.

[tomekjarosik]

What about using something like this:

  containers:
    - name: macos-container
      image: ghcr.io/macvmio/macos-sonoma:14.5-agent-v1.6
      imagePullPolicy: IfNotPresent
      # This secret should contain SSH credentials (user/password)
      # that allow Kubernetes to execute commands inside the VM.
      envFrom:
        - secretRef:
            name: fugaci-ssh-secret

This would be secret provided by kubernetes "secretRef" and my understanding is that its access can be limited to kubernetes namespace and it's (kind of) secure way of connecting. For example, only team with access to kubernetes namespace and to macOS VM would be able to access this pod or image.

(sample implementation here: https://github.com/macvmio/fugaci/blob/main/pkg/fugaci/vm.go#L155 ) (there is no concept of default creds there, all pods definitions must provide them)

[travisghansen]

You wish for that to actually change the creds in the macos passwd file?

I am not proposing that to be clear, I am proposing that images are allowed to be created with different static creds and each pod can indicate which creds to use.

[tomekjarosik]

No, no, creds are hardcoded in the image, and provided in pod. I think I understand it how you describe it. I wanted to say that using "envFrom: secretRef" can override environment variables from Kubernetes secrets (no need for custom labels or annotations). https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#configure-all-key-value-pairs-in-a-secret-as-container-environment-variables

[travisghansen]

Ok, the problem is that your example exposes the creds to the vm (which also may be undesirable). The creds need to be exposed to kubelet, not the vm itself.

[Raikerian]

@travisghansen what would be your suggestion for this? If I understood correctly in your initial proposition, using env vars (presumably in pod yaml config) would also expose the password in VM, as we passthrough all env variables whenever we connect to the VM. So in that sense I like the proposition from @tomekjarosik better. On the other hand, it creates an issue with mapping specific secret so ssh key. What kind of pattern to follow etc. In any case so far it looks like a better and simpler suggestion.

But I don't think we can change macos passwd file from kubelet side, unless there is some new api in Virtualization.framework that I haven't seen yet.

[travisghansen]

I suggested using a label or annotation. That would not be exposed to the vm. Also to be extra clear I am not suggesting we alter the actual creds of the vm, I am suggesting those would have been set at image build time and I simply want to indicate to the vz-kubelet what they are on a pod by pod basis.