TLDR;1OpenShift CoreOS images does not put your public keys to .ssh/authorized_keys if you create instance from AWS Console

We aim to move OpenShift 4. It brings pretty new features compare to 3x generation2Let’s see the CoreOS. In company, we have so many security rules which make system secure. One of them is to being sure that our images should be PCI-DSS compliance.

In this week, to test PCI-DSS components, I wrote Ansible role which checks images, even if this role does not change anything in the system. It was necessary to create my own stack.

In that case, creating full stack (with gateway, OpenShift master nodes, workers) is not a good option since I have to check base image without any change. Also, it’s totally waste of resource because of installation will take a lot time.

I decided to create just 1 instance from AWS Console, than expected to connect via ssh client and test necessary scenarios3At least desicion was good in this time. .

Nopp. It’s not possible.

I don’t know 4For now what kind of mechanism RedHat did but my public key were not in the authorized_keys. So I couldn’t connect.

In the beginning, I was expecting that our great firewall in company does not allow me to connect. However, after trying same scenario from my own AWS account. After this, I was sure RedHat did kind of trick and didn’t locate my key as other images do.

In the end, I created ticket for RedHat and explain situation.5Amazon images are allow my key but your image does not. They confirmed that it’s not possible6Absolutely they didn’t write this information anywhere. I am good about RTFM. and I have to create full stack by using automation. Only in way, I can reach my goal.

After 8 7boring hours which I spent on debugging ACL and security groups I want to share pure knowledge with you.

Result: CoreOS images do not add your public key if you run it without automation to the instance: