.gitlab-ci.yml

@@ -5,6 +5,7 @@ stages:
   - test
   - build
   - release
+  - renovate-downstream
 
 sast:
   stage: test
@@ -60,10 +61,25 @@ build-push:
   rules:
     - &renovateGuard
       if: >-
-        $CI_PIPELINE_SOURCE !~ /^(?:push|merge_request_event|schedule|pipeline)$/ &&
+        $CI_PIPELINE_SOURCE !~ /^(?:push|merge_request_event|schedule)$/ &&
         $RENOVATE == "true"
       when: never
-    - when: on_success
+    - if: $CI_PIPELINE_SOURCE == "schedule"
+      when: on_success
+    - if: $CI_PIPELINE_SOURCE == "web"
+      when: on_success
+    - if: $CI_JOB_MANUAL || $CI_COMMIT_TAG
+      when: on_success
+    - changes:
+        paths:
+          - .gitlab-ci.yml
+          - pkg/**
+          - cmd/**
+          - Dockerfile
+          - .dockerignore
+          - "*.mod"
+          - "*.sum"
+      when: on_success
 
 chart:release:
   image: ${HELM_IMAGE}
@@ -111,6 +127,20 @@ chart:release:
         paths:
           - .gitlab-ci.yml
           - .helm*
-          - "*.yaml"
-          - "**/*.yaml"
+          - chart/**
       when: on_success
+
+trigger-renovate:
+  stage: renovate-downstream
+  trigger:
+    project: &project hpc-internal/charts/gojump
+  rules:
+    - *renovateGuard
+    - if: >-
+        $CI_COMMIT_TAG || $CI_COMMIT_BRANCH =~ /^(main)$/
+      when: on_success
+      variables:
+        RENOVATE: "true"
+        LOG_LEVEL: debug
+        RENOVATE_REPOSITORIES: *project
+        RENOVATE_BASE_BRANCHES: dev

.gitlab/lint.yaml

@@ -4,13 +4,13 @@ include:
 
 yamllint:
   stage: lint
-  image: registry.gitlab.com/pipeline-components/yamllint:0.31.3@sha256:08e7a76592dc7cf177f6beb14a2527cf6d226ab6ace21bcd4d863adc8f7653f2
+  image: registry.gitlab.com/pipeline-components/yamllint:0.35.0@sha256:792a5c9f8c0f3b334996c8c5f9b58f000bd57ff8a87ba54fdd5e8d02679097f9
   script:
     - yamllint .
   rules:
     - &renovateGuard
       if: >-
-        $CI_PIPELINE_SOURCE !~ /^(?:push|merge_request_event|schedule|pipeline)$/ &&
+        $CI_PIPELINE_SOURCE !~ /^(?:push|merge_request_event|schedule)$/ &&
         $RENOVATE == "true"
       when: never
     - changes:
@@ -25,7 +25,7 @@ yamllint:
 
 markdownlint:
   stage: lint
-  image: registry.gitlab.com/pipeline-components/markdownlint:0.13.3@sha256:05e98b078e72c637e90a15094d012ed63108d101a941c2526833717ae50eb802
+  image: registry.gitlab.com/pipeline-components/markdownlint:0.14.0@sha256:72e81c759cfd8d81df99f58226d5ccff9a76c3b9e8e363c5a75b1f5bbfedfa9d
   script:
     - mdl .
   rules:
@@ -41,7 +41,7 @@ markdownlint:
 
 shellcheck:
   stage: lint
-  image: registry.gitlab.com/pipeline-components/shellcheck:0.12.12@sha256:6b18bbca3f26338ce7f323862115df56f07628bfc4ffbe379c22b1d87d0b74f2
+  image: registry.gitlab.com/pipeline-components/shellcheck:0.13.1@sha256:321938a73eb1b3e36977f6ad8af463b1c151530e5be17e56cca0f5dd9cf56278
   script:
     - >
       find . -name .git -type d -prune -o -type f -name '*.sh' -print0 |
@@ -57,7 +57,7 @@ shellcheck:
 
 hadolint:
   stage: lint
-  image: registry.gitlab.com/pipeline-components/hadolint:0.26.4@sha256:93ceb60f9a452741e26ea6c86ee329a8647b419f13f7304ffaa4667596944f14
+  image: registry.gitlab.com/pipeline-components/hadolint:0.27.2@sha256:7165e6e43994476e3b50028a29b9dbb5c7933a5bfbbd13f260b76dff63cc4ff7
   script:
     - find -name 'Dockerfile*' -print0 | xargs -0 hadolint
   rules:
@@ -71,7 +71,7 @@ hadolint:
 
 go-lint:
   stage: lint
-  image: registry.gitlab.com/pipeline-components/go-lint:0.17.0
+  image: registry.gitlab.com/pipeline-components/go-lint:0.17.0@sha256:b090f2038c30e8116a949e69bb2bc215a7afa782dde03bf002850643bd591fd4
   # TODO: resolve
   allow_failure: true
   script:
@@ -88,9 +88,9 @@ go-lint:
 
 golangci:
   stage: lint
-  image: golangci/golangci-lint:v1.63.4
+  image: golangci/golangci-lint:v2.1.6@sha256:568ee1c1c53493575fa9494e280e579ac9ca865787bafe4df3023ae59ecf299b
   script:
-    - golangci-lint run --print-issued-lines=false --out-format code-climate:gl-code-quality-report.json,line-number
+    - golangci-lint run
   rules:
     - *renovateGuard
     - changes:

.gitlab/renovate.json5

 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "local>hpc-internal/renovate-config",
-    "local>hpc-internal/renovate-config//managers/docker.json5",
-    "local>hpc-internal/renovate-config//managers/helm-values-image-tag.json5",
+    "local>hpc-registry/renovate-config",
+    "local>hpc-registry/renovate-config//managers/dockerfile.json5",
+    "local>hpc-registry/renovate-config//managers/helm-values-image-tag.json5",
     ":assignAndReview(mminar)",
     ":automergePatch",
     ":automergeDigest",
     ":automergeLinters",
   ],
+  "separateMultipleMajor": true,
+  "separateMultipleMinor": true,
 }

.golangci.json

+{
+  "formatters": {
+    "enable": [
+      "gofmt",
+      "goimports"
+    ],
+    "exclusions": {
+      "generated": "lax",
+      "paths": [
+        "third_party$",
+        "builtin$",
+        "examples$"
+      ]
+    }
+  },
+  "linters": {
+    "enable": [
+      "copyloopvar",
+      "dupl",
+      "goconst",
+      "gocyclo",
+      "lll",
+      "misspell",
+      "nakedret",
+      "prealloc",
+      "unconvert",
+      "unparam"
+    ],
+    "exclusions": {
+      "generated": "lax",
+      "paths": [
+        "third_party$",
+        "builtin$",
+        "examples$"
+      ]
+    }
+  },
+  "run": {
+    "allow-parallel-runners": true
+  },
+  "version": "2"
+}

.golangci.yml

----
-run:
-  deadline: 5m
-  allow-parallel-runners: true
-
-issues:
-  # don't skip warning about doc comments
-  # don't exclude the default set of lint
-  exclude-use-default: false
-  # restore some of the defaults
-  # (fill in the rest as needed)
-  exclude-rules: []
-
-linters:
-  enable:
-    - copyloopvar
-    - dupl
-    - errcheck
-    - goconst
-    - gocyclo
-    - gofmt
-    - goimports
-    - gosimple
-    - govet
-    - ineffassign
-    - lll
-    - misspell
-    - nakedret
-    - prealloc
-    - staticcheck
-    - typecheck
-    - unconvert
-    - unparam
-    - unused

.yamllint

@@ -9,7 +9,7 @@ yaml-files:
 
 rules:
   line-length:
-    max: 130
+    max: 140
     level: warning
 
 ignore:

Dockerfile

 # Build the manager binary
-FROM golang:1.22 AS builder
+FROM golang:1.23@sha256:45c8837b16499b4e0e52b62d4cfba7bf04fc651b7d9265f95010fe0beaec2626 AS builder
 ARG TARGETOS
 ARG TARGETARCH
 ARG APP_VERSION
@@ -35,7 +35,7 @@ RUN flags="-a -o gojump"; \
 
 # Use distroless as minimal base image to package the gojump binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:nonroot
+FROM gcr.io/distroless/static:nonroot@sha256:188ddfb9e497f861177352057cb21913d840ecae6c843d39e00d44fa64daa51c
 WORKDIR /
 COPY --from=builder /workspace/gojump .
 USER 65532:65532

LICENSE

+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2024-2025 Michal Minář <michal.minar@id.ethz.ch>.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

Makefile

-CA_DOMAIN        ?=
-CHART_NAME       ?=
-NAMESPACE        ?= jump
-HELM_EXTRA_ARGS  ?=
+CA_DOMAIN         ?=
+CHART_NAME        ?=
+NAMESPACE         ?= jump
+HELM_EXTRA_ARGS   ?=
 DOCKER_BUILD_ARGS ?=
 # VERSION defines the project version for the bundle.
 # Update this value when you upgrade the version of your project.
@@ -17,6 +17,13 @@ IMPORT_PATH ?= $(shell sed -n 's,^module \(.\+\),\1,p' go.mod)
 # For example, running 'make bundle-build bundle-push catalog-build catalog-push' will build and push both
 # ethz.ch/sshgw-bundle:$VERSION and ethz.ch/sshgw-catalog:$VERSION.
 IMAGE_TAG_BASE ?= registry.core.hpc.ethz.ch/hpc/gojump
+CHART_REGISTRY ?= registry.core.hpc.ethz.ch/charts
+CHART_VERSION  ?=
+
+push-chart:
+		args=""; [ -z "$(CHART_VERSION)" ] || args="$$args --version $(CHART_VERSION)"; \
+		helm package $$args chart/
+		helm push "$$(ls -1tr *.tgz | tail -n 1)" "oci://$(CHART_REGISTRY)"
 
 # Image URL to use all building/pushing image targets
 IMG ?= $(IMAGE_TAG_BASE):$(VERSION)

README.md

@@ -2,8 +2,48 @@
 
 SSH jumphost that allows clients to ProxyJump where needed.
 
-The main feature is configurable session lifetime.
+**NOTE**: It provides no shell. When you try to ssh to it requesting a regular
+session, you will get something like:
 
-## Vault integration
+```sh
+$ ssh user@jump.foo.ethz.ch
+mux_client_request_session: session request failed: Session open refused by peer
+channel 0: open failed: connect failed: Session refused
+Connection to jump.foo.hpc.ethz.ch closed.
+```
 
-TODO
+Which is expected.
+
+Its main features are:
+
+- configurable session lifetime (defaults to 24 hours)
+- small
+- efficient
+
+Requires pre-generated SSH host-keys and trusted SSH user CA (plain public keys
+will not do).
+
+## Built artifacts
+
+### Container Image
+
+Available at:
+
+- registry.ethz.ch/hpc-registry/gojump:$tag
+- registry.core.hpc.ethz.ch/hpc/gojump:$tag
+
+Where `$tag` is either `latest` or git repo tag.
+
+### Helm Chart
+
+Available at:
+
+- registry.ethz.ch/hpc-registry/gojump/chart/gojump:$tag
+- registry.core.hpc.ethz.ch/charts/gojump:$tag
+
+Where `$tag` comes from [chart/Chart.yaml](./chart/Chart.yaml)'s version.
+
+## TODOs
+
+- metrics
+- alerts (like too high # of failed login attempts)

chart/Chart.yaml

@@ -3,9 +3,11 @@ apiVersion: v2
 name: gojump
 description: SSH jumphost
 type: application
-version: 0.1.2
+version: 0.1.6
 appVersion: 0.1.2
 maintainers:
   - name: Michal Minář
     email: michal.minar@id.ethz.ch
-    # url:
+home: https://gitlab.ethz.ch/hpc-registry/gojump
+icon: https://gitlab.ethz.ch/uploads/-/system/project/avatar/53258/logo.png
+dependencies: []

chart/templates/05-sa.yaml

@@ -6,7 +6,9 @@ metadata:
     app.kubernetes.io/component: gojump
 {{ include "common.labels" . | indent 4 }}
   annotations:
-    vault.hashicorp.com/alias-metadata-ca_domain: {{ .Values.vaultHostKeySigner.caDomain }}
-{{ include "common.annotations" . | indent 4 }}
+{{ merge (index (default (dict) .Values.serviceAccount) "annotations" | default dict)
+         (include "common.annotations" . | fromYaml) |
+   toYaml | indent 4
+}}
   name: "{{ include "_helpers.fullname" . }}"
   namespace: "{{ .Release.Namespace }}"

chart/templates/15-cm-trusted-user-ca.yaml

-{{- if index (default (dict) .Values.gojump.sshd) "trustedUserCA" }}
+{{- if index (default (dict) .Values.trustedUserCAKeys) "value" }}
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -8,9 +8,9 @@ metadata:
 {{ include "common.labels" . | indent 4 }}
   annotations:
 {{ include "common.annotations" . | indent 4 }}
-  name: "{{ include "_helpers.fullname" . }}-trusted-user-ca"
+  name: "{{ include "_helpers.fullname" . }}-trusted-user-ca-keys"
   namespace: "{{ .Release.Namespace }}"
 data:
-  trusted-user-ca.pem: |
-{{ .Values.gojump.sshd.trustedUserCA | indent 4 }}
+  trusted-user-ca-keys: |
+{{ .Values.trustedUserCAKeys.value | indent 4 }}
 {{- end }}

chart/templates/15-secret-host-keys.yaml

-{{- if index (default (dict) .Values.gojump.sshd) "hostKeys" }}
----
-apiVersion: v1
-kind: Secret
-metadata:
-  labels:
-    app.kubernetes.io/component: gojump
-{{ include "common.labels" . | indent 4 }}
-  annotations:
-{{ include "common.annotations" . | indent 4 }}
-  name: "{{ include "_helpers.fullname" . }}-host-keys"
-  namespace: "{{ .Release.Namespace }}"
-data:
-{{- range $key, $value := .Values.gojump.sshd.hostKeys }}
-  "{{ $key }}": |
-{{ $value | b64enc | indent 4 }}
-{{- end }}
-{{- end }}

chart/templates/20-deployment.yaml

@@ -62,31 +62,41 @@ spec:
         - name: gojump
           args:
             - --listen-addr=:2022
-            - --log-level={{ .Values.gojump.logLevel | default "info" }}
-{{- with $caKeys := index (default (dict) .Values.vaultHostKeySigner) "trustedUserCAKeys" }}
+            - --log-level={{ .Values.logLevel | default "info" }}
+{{- with $caKeys := index (default (dict) .Values) "trustedUserCAKeys" | default dict }}
 {{- if index (default (dict) $caKeys.secret) "name" }}
-            - --trusted-user-ca-keys=/etc/ssh/trusted-user-ca-keys
+            - --trusted-user-ca-keys=/etc/gojump/trusted-user-ca-keys
 {{- end }}
 {{- end }}
-{{- range $_, $arg := .Values.gojump.extraArgs | default (list) }}
+{{- range $_, $arg := .Values.extraArgs | default (list) }}
             - {{ $arg }}
 {{- end }}
-{{- with $i := .Values.gojump.image }}
+{{- if .Values.maxSessionLifetime }}
+            - --max-session-lifetime={{ .Values.maxSessionLifetime }}
+{{- end }}
+{{- with $i := .Values.image }}
           image: >-
             {{ $i.fqin | default "registry.core.hpc.ethz.ch/hpc/gojump"
             }}{{- if $i.tag }}:{{- $i.tag }}{{- end }}{{- if $i.digest
             }}@{{- $i.digest -}}{{- end }}
           imagePullPolicy: {{ $i.pullPolicy | default "IfNotPresent" }}
+{{- end }}
+{{- if .Values.extraEnv }}
+          env:
+{{ .Values.extraEnv | toYaml | indent 12 }}
 {{- end }}
           securityContext:
-            # must match the USER ID in /etc/passwd in vault-ssh-key-signer image
-            runAsUser: &userID 1001
-            runAsNonRoot: true
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop:
-                - "ALL"
+{{- with $sc := merge (dict "_unused_" 1)
+                      (default (dict) .Values.securityContext)
+}}
+            runAsUser: {{ if $sc.runAsUser }}{{ $sc.runAsUser }}{{ else if eq $sc.runAsUser nil }}1001{{ else }}{{ $sc.runAsUser }}{{ end }}
+            readOnlyRootFilesystem: {{ $sc.readOnlyRootFilesystem | default false | toYaml }}
+            runAsNonRoot: {{ if eq $sc.runAsUser nil }}true{{ else }}{{ ne ($sc.runAsUser | toString) "0" | toYaml }}{{end}}
+            privileged: false
+{{- with $pruned := omit $sc "runAsUser" "readOnlyRootFilesystem" "runAsNonRoot" "privileged" "_unused_" }}
+{{ $pruned | toYaml | indent 12 }}
+{{- end }}
+{{- end }}
           ports:
             - name: sshd
               containerPort: 2022
@@ -106,120 +116,69 @@ spec:
             periodSeconds: 5
           resources:
             limits:
-              cpu: "4"
-              memory: 256Mi
-              ephemeral-storage: 128Mi
+{{ merge (index (default (dict) .Values.resources) "limits" | default dict)
+         (dict "cpu" "4" "memory" "256Mi" "ephemeral-storage" "128Mi") |
+   toYaml | indent 14
+}}
             requests:
-              cpu: "1"
-              memory: 128Mi
-              ephemeral-storage: 16Mi
+{{ merge (index (default (dict) .Values.resources) "requests" | default dict)
+         (dict "cpu" "1" "memory" "128Mi" "ephemeral-storage" "16Mi") |
+   toYaml | indent 14
+}}
           volumeMounts:
+{{- if index (default (dict) (index (default (dict) .Values.hostKeys) "secret")) "name" }}
             - name: ssh-host-keys
               mountPath: /etc/ssh
               readOnly: true
-      initContainers:
-        - name: vault-host-keys-signer
-{{- with $i := index (default (dict) .Values.vaultHostKeySigner) "image" }}
-          image: >-
-            {{ $i.fqin | default "registry.ethz.ch/hpc-registry/vault-ssh-key-signer" }}{{-
-            if $i.tag }}:{{- $i.tag }}{{- end }}{{-
-            if $i.digest }}@{{ $i.digest }}{{- end }}
-          imagePullPolicy: {{ $i.pullPolicy | default "IfNotPresent" }}
-{{- end }}
-          env:
-            - name: VAULT_ADDR
-              value: >-
-                {{ index (default (dict) .Values.vaultHostKeySigner.vault) "url" |
-                   default "https://vault-active.vault.svc.cluster.local:8200"
-                }}
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-            - name: K8S_ROLE
-              value: {{ .Values.vaultHostKeySigner.k8srole }}
-            - name: CA_DOMAIN
-              value: {{ .Values.vaultHostKeySigner.caDomain }}
-            - name: EXTRA_PRINCIPALS
-              value: {{ include "signer.extraPrincipals" . }}
-            - name: GENERATE_CERT_CONF_FILE
-              value: "0"
-            - name: VAULT_CAPATH
-              value: /etc/ssl/private/vault-ca.crt
-            - name: OUT_DIR
-              value: /etc/ssh
-{{- with $caKeys := index (default (dict) .Values.vaultHostKeySigner) "trustedUserCAKeys" }}
-{{- if $caKeys.value }}
-            - name: TRUSTED_USER_CA_KEYS
-              value: |
-                {{ $caKeys.value }}
-{{- end }}
 {{- end }}
-          resources:
-            requests:
-              cpu: "200m"
-              memory: 64Mi
-              ephemeral-storage: 8Mi
-            limits:
-              cpu: "500m"
-              memory: 128Mi
-              ephemeral-storage: 16Mi
-          securityContext:
-            runAsUser: *userID
-            runAsNonRoot: true
-            readOnlyRootFilesystem: true
-            privileged: false
-          volumeMounts:
-            - name: tmp-vault-host-keys-signer
-              mountPath: /tmp
-            - name: ssh-host-keys
-              mountPath: /etc/ssh
-{{- with $caKeys := default (dict) .Values.vaultHostKeySigner.trustedUserCAKeys }}
-{{- if index (default (dict) $caKeys.secret) "name" }}
-            - name: trusted-user-ca
-              mountPath: /in/trusted-user-ca-keys
-              subPath: {{ $caKeys.secret.key | default "trusted-user-ca-keys" }}
+{{- with $caKeys := index (default (dict) .Values) "trustedUserCAKeys" | default dict }}
+{{- if or $caKeys.value (index (default (dict) $caKeys.secret) "name") }}
+            - name: trusted-user-ca-keys
+              mountPath: /etc/gojump/trusted-user-ca-keys
               readOnly: true
+              subPath: {{ if $caKeys.value }}trusted-user-ca-keys{{ else }}{{ $caKeys.secret.subPath | default "trusted-user-ca-keys" }}{{ end }}
 {{- end }}
 {{- end }}
-{{- with $ca := index (default (dict) .Values.vaultHostKeySigner.vault) "ca" | default dict }}
-{{- if index (default (dict) $ca.secret) "name" }}
-            - name: vault-ca
-              mountPath: /etc/ssl/private/vault-ca.crt
-              readOnly: true
-              subPath: vault-ca.crt
-{{- end }}
+{{- if .Values.extraVolumeMounts }}
+{{ .Values.extraVolumeMounts | toYaml | indent 12 }}
 {{- end }}
+
+{{- if or .Values.initContainers .Values.initContainersTemplated }}
+      initContainers:
 {{- if .Values.initContainers }}
 {{ .Values.initContainers | toYaml | indent 8 }}
 {{- end }}
+{{- if .Values.initContainersTemplated }}
+{{ tpl .Values.initContainersTemplated . | indent 8 }}
+{{- end }}
+{{- end }}
+
 {{- if .Values.dnsConfig }}
-{{ .Values.dnsConfig | toYaml | indent 6 }}
+      dnsConfig:
+{{ .Values.dnsConfig | toYaml | indent 8 }}
 {{- end }}
       serviceAccountName: "{{ include "_helpers.fullname" . }}"
       terminationGracePeriodSeconds: 10
       volumes:
+{{- if index (default (dict) (index (default (dict) .Values.hostKeys) "secret")) "name" }}
         - name: ssh-host-keys
-          emptyDir:
-            sizeLimit: 2Mi
-{{- with $caKeys := index (default (dict) .Values.vaultHostKeySigner) "trustedUserCAKeys" | default dict }}
-{{- if index (default (dict) $caKeys.secret) "name" }}
-        - name: trusted-user-ca
           secret:
-            secretName: {{ $caKeys.secret.name }}
+            secretName: {{ .Values.hostKeys.secret.name }}
 {{- end }}
+{{- with $caKeys := index (default (dict) .Values) "trustedUserCAKeys" | default dict }}
+{{- if and (index (default (dict) $caKeys.secret) "name") ($caKeys.value) }}
+{{ fail "trustedUserCAKeys.secret.name and .trustedUserCAKeys.value are mutually exclusive!" }}
 {{- end }}
-{{- with $ca := index (default (dict) .Values.vaultHostKeySigner.vault) "ca" | default dict }}
-{{- if index (default (dict) $ca.secret) "name" }}
-        - name: vault-ca
+{{- if index (default (dict) $caKeys.secret) "name" }}
+        - name: trusted-user-ca-keys
           secret:
-            secretName: {{ $ca.secret.name }}
+            secretName: {{ $caKeys.secret.name }}
+{{- else if $caKeys.value }}
+        - name: trusted-user-ca-keys
+          configMap:
+            name: {{ include "_helpers.fullname" $ }}-trusted-user-ca-keys
+{{- end }}
 {{- end }}
+{{- if .Values.extraVolumes }}
+{{ .Values.extraVolumes | toYaml | indent 8 }}
 {{- end }}
-        - name: tmp-vault-host-keys-signer
-          emptyDir:
-            sizeLimit: 2Mi

chart/templates/30-service.yaml

@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/component: gojump
 {{ include "common.labels" . | indent 4 }}
   annotations:
-{{ merge (include "common.annotations" . | fromYaml)
-         (default (dict) .Values.gojump.service.annotations) |
+{{ merge (index (default (dict) .Values.service) "annotations" | default dict)
+         (include "common.annotations" . | fromYaml) |
    toYaml | indent 4
 }}
   name: "{{ include "_helpers.fullname" . }}"

chart/templates/_helpers.tpl

@@ -38,9 +38,3 @@ app.kubernetes.io/version: "{{ .Chart.AppVersion }}"
 {{ .Values.commonLabels | toYaml }}
 {{- end }}
 {{- end }}
-
-{{- define "signer.extraPrincipals" -}}
-{{ join ", " (concat (list (printf "%s.svc" (include "_helpers.fullname" .)))
-                     (default (list) .Values.vaultHostKeySigner.extraPrincipals))
-}}
-{{- end }}

chart/values.yaml

@@ -4,55 +4,75 @@ commonLabels:
 commonAnnotations:
 # # key: value
 
-gojump:
-  image:
-    fqin: registry.ethz.ch/hpc-registry/gojump
-    # renovate: datasource=docker depName=registry.ethz.ch/hpc-registry/gojump
-    tag: v0.1.2
-    # digest: sha256:XYZ***
-
-  keys:
-  # ## TODO: support external-secret
-  # # trustedUserCA: |
-  # #   ssh-ed25519 AAAA********************************m name 20190524
-  # ## TODO: support external-secret
-  # # host:
-  # #  sshgw_host_ed25519: |
-  # #    -----BEGIN OPENSSH PRIVATE KEY-----
-  # #    ****
-  # #    -----END OPENSSH PRIVATE KEY-----
-
-  service:
-    annotations: {}
-
-  logLevel: info
-  extraArgs: []
-  # # - --zap-log-level=2
-
-vaultHostKeySigner:
-  # TODO: make it optional
-  # enabled: true
-  image:
-    fqin: registry.ethz.ch/hpc-registry/vault-ssh-key-signer
-    # renovate: datasource=docker depName=registry.ethz.ch/hpc-registry/vault-ssh-key-signer
-    tag: v0.1.1
-    pullPolicy: IfNotPresent
-  k8srole: CHANGEME
-  ca_domain: CHANGEME
-  extra_principals: []
-  # # - fqin.ltd
-  trustedUserCAKeys:
-  # # value:
-  # # secret:
-  # #   name: CHANGEME
-  # #   key: trusted-user-ca-keys
-
-  vault:
-    url: https://vault-active.vault.svc.cluster.local:8200
-    ca: {}
-    # # secret:
-    # #   name: vault-ca
+## An SSH session gets terminated after the given time. 0 means never.
+## Supports golang's time.Duration format; viz https://pkg.go.dev/time#ParseDuration
+# maxSessionLifetime: 24h
+
+image:
+  fqin: registry.ethz.ch/hpc-registry/gojump
+  # renovate: datasource=docker depName=registry.ethz.ch/hpc-registry/gojump versioning=docker
+  tag: v0.1.2@sha256:2bada8042c8390b669c3bc871b8433d78240f95ab8fe1c3b2d09e9cf2b435a2e
+  # digest: sha256:XYZ***
+
+resources:
+  limits:
+    cpu: "5"
+    memory: 256Mi
+    ephemeral-storage: 128Mi
+  requests:
+    cpu: "1"
+    memory: 128Mi
+    ephemeral-storage: 16Mi
+
+securityContext:
+  runAsUser: 1001
+  runAsNonRoot: true
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
+  capabilities:
+    drop:
+      - "ALL"
+
+trustedUserCAKeys: {}
+### uncomment either value or secret.name
+#   value: |
+#     ssh-ed25519 AAAA...
+#   ## user-pre-created secret
+#   secret:
+#     name: trusted-user-ca-keys
+#     ## key inside the secret containing the CAs
+#     subPath: trusted-user-ca-keys
+hostKeys:
+#### user-pre-created-secret containing at least one host key and
+#### optionally a host certificate like this:
+####   ssh_host_ecdsa_key
+####   ssh_host_ecdsa_key-cert.pub
+####   ssh_host_ecdsa_key.pub
+####   ssh_host_ed25519_key
+####   ssh_host_ed25519_key-cert.pub
+####   ssh_host_ed25519_key.pub
+####   ssh_host_rsa_key
+####   ssh_host_rsa_key-cert.pub
+####   ssh_host_rsa_key.pub
+#  secret:
+#    name: ssh-host-keys
+
+serviceAccount:
+  annotations: {}
+
+service:
+  annotations: {}
+
+logLevel: info
+extraEnv: []
+extraArgs: []
+extraVolumeMounts: []
+extraVolumes: []
 
 initContainers: []
 
+# initContainersTemplated: |
+#   - name: {{ include "common.init-name" . }}
+#     ...
+
 dnsConfig: {}

cmd/main.go

 /*
-Copyright 2024 Michal Minář <michal.minar@id.ethz.ch>.
+Copyright 2024-2025 Michal Minář <michal.minar@id.ethz.ch>.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

go.mod

 module gitlab.ethz.ch/hpc-registry/gojump
 
-go 1.22.0
+go 1.23.0
 
-toolchain go1.22.6
+toolchain go1.24.3
 
 require (
-	github.com/go-logr/logr v1.4.2
+	github.com/go-logr/logr v1.4.3
 	github.com/go-logr/zapr v1.3.0
 	go.uber.org/zap v1.27.0
-	golang.org/x/crypto v0.32.0
+	golang.org/x/crypto v0.38.0
 )
 
 require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/sys v0.30.0 // indirect
+	golang.org/x/sys v0.33.0 // indirect
 )