From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ADE412874F7 for ; Thu, 2 Oct 2025 20:21:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1759436504; cv=none; b=fxYnsOyUn26Y3d07zK0PjiE1+tk6BIVEkvzRCOQOqZ9DakpUKrQkrjC6IbCcBYTNfsEFiuqntKHu3ywqVDe8E2Wd3Nc+ucJvM49DvMbIDShXxtZIYxJBJai26iMilQ5tRU4zZyzPR2KSM6EjD5CzB0WAADNmwamo2CJdhRzyIjQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1759436504; c=relaxed/simple; bh=BWvAFFBBUegkvPxxh13OfHW0QfbRcrxiK5YKfXD+wfg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Cs51cJE6rrVe8gSuOJxFvX6MsqRTJKrz0JP7wOAy+iaZucC2kzg5YE4opPVKJrUVVdY4+Qpq2NIk2wqFHvt5rxifnnl5p6ziDES1fftvLgtQOfbEizFyNa1/En9U7l4363Nq++UA5UyY6SCYU4eAQpaH3eaDEDyMLWaWm0VYKVw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=NLQ0nPfZ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="NLQ0nPfZ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id ECABBC4CEF4; Thu, 2 Oct 2025 20:21:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1759436504; bh=BWvAFFBBUegkvPxxh13OfHW0QfbRcrxiK5YKfXD+wfg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NLQ0nPfZIFLd+C2Mwwee95JjVUvbM0gfsrJ/UJyGYLhUgZhyDMEQ4/qdTlTSCKpdI xE8mtUtd6Pi2WObTxG4pXJTYTA6ccxSCH9ox56FUtDZjdtAzkWNj+liIzi10Zggme4 VLQGSCnBz3D+8pGr7p9Q+kLGtTbFNQCFmE0M1S+iNfD3YfGpnnsS+nPNFKR2Hu++R0 MvOdXuR6VnCKzqOR5/irKSIb78VYhKgEnKCo8MSyzdZqXHDOwTYM9ZR08tKc94ONiV qOxIkFr80C2JlfEgCI8iIK8VT/EcTP9SMYvzp4T38MBsQYXMm6mrPpcKQwjaUtor/U GS3r+c+nUwEpw== From: Chuck Lever To: Cc: Chuck Lever Subject: [PATCH v1 4/6] guestfs: Use the alternate ssh port for Ansible control Date: Thu, 2 Oct 2025 16:21:38 -0400 Message-ID: <20251002202140.3596787-5-cel@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20251002202140.3596787-1-cel@kernel.org> References: <20251002202140.3596787-1-cel@kernel.org> Precedence: bulk X-Mailing-List: kdevops@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Chuck Lever When provisioning guestfs instances, make use of the Ansible ssh port setting, in case it is set to something other than port 22. Generated-by: Claude AI Signed-off-by: Chuck Lever --- playbooks/nixos.yml | 2 +- playbooks/roles/guestfs/tasks/bringup/main.yml | 11 ++++++++++- scripts/update_ssh_config_guestfs.py | 3 ++- 3 files changed, 13 insertions(+), 3 deletions(-) diff --git a/playbooks/nixos.yml b/playbooks/nixos.yml index bdc9b1e8555e..262855202ca6 100644 --- a/playbooks/nixos.yml +++ b/playbooks/nixos.yml @@ -430,7 +430,7 @@ python3 {{ playbook_dir }}/../scripts/update_ssh_config_nixos.py update \ {{ item }} \ {{ nixos_vm_ips[item] }} \ - 22 \ + {{ ansible_cfg_ssh_port }} \ kdevops \ {{ nixos_ssh_config_file | default(ansible_env.HOME + '/.ssh/config') }} \ {{ ssh_key_path_for_config.stdout | trim }} \ diff --git a/playbooks/roles/guestfs/tasks/bringup/main.yml b/playbooks/roles/guestfs/tasks/bringup/main.yml index ce7e4122d6e9..81bac7ceb6aa 100644 --- a/playbooks/roles/guestfs/tasks/bringup/main.yml +++ b/playbooks/roles/guestfs/tasks/bringup/main.yml @@ -71,7 +71,16 @@ "--hostname", inventory_hostname, "--ssh-inject", "kdevops:file:" + ssh_key + ".pub", "--timezone", host_timezone.stdout - ] + ] + ( + [ + "--run-command", "sed -i '/^#*Port /d' /etc/ssh/sshd_config", + "--append-line", "/etc/ssh/sshd_config:Port " + (ansible_cfg_ssh_port | string), + "--firstboot-command", "semanage port -a -t ssh_port_t -p tcp " + (ansible_cfg_ssh_port | string) + " 2>/dev/null || semanage port -m -t ssh_port_t -p tcp " + (ansible_cfg_ssh_port | string) + "; systemctl restart sshd", + "--firstboot-command", "if command -v firewall-cmd >/dev/null 2>&1 && systemctl is-enabled firewalld >/dev/null 2>&1; then firewall-cmd --permanent --add-port=" + (ansible_cfg_ssh_port | string) + "/tcp && firewall-cmd --reload; fi", + "--firstboot-command", "if command -v ufw >/dev/null 2>&1 && systemctl is-active ufw >/dev/null 2>&1; then ufw allow " + (ansible_cfg_ssh_port | string) + "/tcp; fi" + ] + if ansible_cfg_ssh_port | int != 22 else [] + ) }} - name: Build the root image for each target node (as root) diff --git a/scripts/update_ssh_config_guestfs.py b/scripts/update_ssh_config_guestfs.py index 143ff4fc24c4..40f1ccad02b6 100755 --- a/scripts/update_ssh_config_guestfs.py +++ b/scripts/update_ssh_config_guestfs.py @@ -21,7 +21,7 @@ from pathlib import Path ssh_template = """Host {name} {addr} HostName {addr} User kdevops - Port 22 + Port {port} IdentityFile {sshkey} UserKnownHostsFile /dev/null StrictHostKeyChecking no @@ -97,6 +97,7 @@ def main(): context = { "name": name, "addr": addr, + "port": extra_vars.get("ansible_cfg_ssh_port", 22), "sshkey": f"{extra_vars['guestfs_path']}/{name}/ssh/id_ed25519", } sshconf.write(ssh_template.format(**context)) -- 2.51.0