Skip to content

SSH Gateway #7412

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Jan 6, 2022
Merged

SSH Gateway #7412

merged 3 commits into from
Jan 6, 2022

Conversation

iQQBot
Copy link
Contributor

@iQQBot iQQBot commented Jan 1, 2022 •
edited
Loading

Description

Add SSH Gateway to ws-proxy
This Gateway support sftp, shell, pty, scp and port-forward

Related Issue(s)

Fixes #5602

How to test

Common step

  1. start a workspace
  2. get ownerToken

Integration with openssh

  1. Use follow command to connect workspace, the username is workspaceId password is ownerToken
ssh workspaceId@workspaceUrl

image
2. or you can use workspaceId:ownerToken for the username, and provider any publickey

Integration with VSCode Desktop

  1. Remove your vscode desktop config remote.SSH.configFile
  2. Use Remote plugin
  3. Select Connect to Host...
  4. Enter workspaceId@workspaceUrl or workspaceId:ownerToken@workspaceUrl
    image
    image

Integration with Jetbrains IDE

  1. start Jetbrains Gateway
  2. click Connect via SSH
  3. Host is workspace url and user is workspaceId or workspaceId:ownerToken
  4. Select a IDE to start
    image

How to get ownerToken?

  1. You can get it via kubectl or lens
    image
  2. You can use Chrome DevTool, and find it on cookie
    image

Release Notes

NONE

Documentation

TOOD:

  • Replace fixed hostkey
  • Loadbalancer for ws-proxy in preview env

@roboquat roboquat added release-note-none team: IDE team: delivery Issue belongs to the self-hosted team team: workspace Issue belongs to the Workspace team size/XXL labels Jan 1, 2022
@codecov
Copy link

codecov bot commented Jan 1, 2022 •
edited
Loading

Codecov Report

Merging #7412 (adcf62e) into main (ebf03b0) will increase coverage by 13.54%.
The diff coverage is 4.83%.

❗ Current head adcf62e differs from pull request most recent head c415b21. Consider uploading reports for the commit c415b21 to get more accurate results
Impacted file tree graph

@@             Coverage Diff             @@
##             main    #7412       +/-   ##
===========================================
+ Coverage   19.04%   32.59%   +13.54%     
===========================================
  Files           2       61       +59     
  Lines         168     9112     +8944     
===========================================
+ Hits           32     2970     +2938     
- Misses        134     5925     +5791     
- Partials        2      217      +215
Flag Coverage Δ
components-gitpod-cli-app 9.56% <ø> (?)
components-ide-code-desktop-status-app ∅ <ø> (?)
components-image-builder-mk3-app 35.26% <ø> (?)
components-local-app-api-go-lib ∅ <ø> (?)
components-local-app-app-darwin-amd64 ∅ <ø> (?)
components-local-app-app-darwin-arm64 ∅ <ø> (?)
components-local-app-app-linux-amd64 19.04% <ø> (ø)
components-local-app-app-linux-arm64 ∅ <ø> (∅)
components-local-app-app-windows-386 ∅ <ø> (∅)
components-local-app-app-windows-amd64 ∅ <ø> (∅)
components-local-app-app-windows-arm64 ∅ <ø> (∅)
components-supervisor-api-go-lib ∅ <ø> (?)
components-supervisor-app 35.57% <0.00%> (?)
components-ws-proxy-app 68.32% <75.00%> (?)
installer-raw-app 5.76% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
components/supervisor/pkg/supervisor/services.go 21.56% <0.00%> (ø)
components/supervisor/pkg/supervisor/ssh.go 0.00% <0.00%> (ø)
components/ws-proxy/pkg/proxy/workspacerouter.go 81.89% <75.00%> (ø)
...ents/image-builder-mk3/pkg/orchestrator/monitor.go 23.12% <0.00%> (ø)
installer/pkg/components/ws-manager/configmap.go 29.71% <0.00%> (ø)
components/gitpod-cli/cmd/credential-helper.go 1.25% <0.00%> (ø)
components/gitpod-cli/cmd/await-port.go 8.00% <0.00%> (ø)
components/ws-proxy/pkg/proxy/cookies.go 78.57% <0.00%> (ø)
components/supervisor/pkg/ports/slirp4netns.go 0.00% <0.00%> (ø)
... and 52 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ebf03b0...c415b21. Read the comment docs.

@iQQBot iQQBot force-pushed the pd/ssh-gateway branch 6 times, most recently from e8bb61c to 0b55333 Compare January 2, 2022 18:54
@akosyakov
Copy link
Member

Please don't forget to fill in how to test section. It should demonstrate how to try with VS Code and JetBrains product as well as existing local companion is not broken in any way.

akosyakov
akosyakov reviewed Jan 3, 2022
View reviewed changes
components/ws-proxy/pkg/sshproxy/server.go
case "tcpip-forward":
newChannel.Reject(ssh.UnknownChannelType, "Gitpod SSH Gateway cannot remote forward ports")
default:
newChannel.Reject(ssh.UnknownChannelType, fmt.Sprintf("Gitpod SSH Gateway cannot handle %s channel types", newChannel.ChannelType()))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it may be worth to log that we know

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this may spam the logs. Consider introducing a counter metric instead

@iQQBot
Copy link
Contributor Author

iQQBot commented Jan 3, 2022

Please don't forget to fill in how to test section. It should demonstrate how to try with VS Code and JetBrains product as well as existing local companion is not broken in any way.

updated how to test section

@akosyakov
Copy link
Member

akosyakov commented Jan 3, 2022 •
edited
Loading

I tested for regressions:

  • local companion works fine
  • but VS Code Desktop integration cannot connect for some reasons, it hangs forever
    • i checked that VS Code Desktop still works in production
    • updated: although i am not sure i can reproduce it on staging as well

It turned out to be a regression in the local companion: #7420

@iQQBot iQQBot force-pushed the pd/ssh-gateway branch 3 times, most recently from 9e7c4bf to 42a2a2c Compare January 3, 2022 10:26
@akosyakov
Copy link
Member

akosyakov commented Jan 3, 2022 •
edited by werft-gitpod-dev-com bot
Loading

@csweichel I can confirm that VS Code and JetBrains integration work nicely with this approach. Could you review please? 🙏 We would like to move with that as soon as possible to provide JetBrains team with test builds of Gateway plugin.

@csweichel
Copy link
Contributor

will take a look before the end of the day

@iQQBot
Copy link
Contributor Author

iQQBot commented Jan 3, 2022

I tested for regressions:

  • local companion works fine

  • but VS Code Desktop integration cannot connect for some reasons, it hangs forever

    • i checked that VS Code Desktop still works in production
    • updated: although i am not sure i can reproduce it on staging as well

It turned out to be a regression in the local companion: #7420

Already rebase, you can test again after build

csweichel
csweichel reviewed Jan 3, 2022
View reviewed changes
Copy link
Contributor

@csweichel csweichel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code by and large looks very good. A bunch of nits and potentially dangling Go routines.

Trying this now.

components/ws-proxy/pkg/sshproxy/server.go
case "tcpip-forward":
newChannel.Reject(ssh.UnknownChannelType, "Gitpod SSH Gateway cannot remote forward ports")
default:
newChannel.Reject(ssh.UnknownChannelType, fmt.Sprintf("Gitpod SSH Gateway cannot handle %s channel types", newChannel.ChannelType()))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this may spam the logs. Consider introducing a counter metric instead

meysholdt
meysholdt approved these changes Jan 6, 2022
View reviewed changes
Copy link
Member

@meysholdt meysholdt left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this PR is about more than just preview envs and there is time pressure - feel free to merge and do the cleanup in a follow-up PR.

@roboquat roboquat added the lgtm label Jan 6, 2022
@roboquat
Copy link
Contributor

roboquat commented Jan 6, 2022

LGTM label has been added.

Git tree hash: 689ab2beec09246c6286895ba7d44ee1b5303b7e

@roboquat roboquat removed the lgtm label Jan 6, 2022
meysholdt
meysholdt reviewed Jan 6, 2022
View reviewed changes
.werft/build.ts Outdated
@@ -533,6 +535,21 @@ export async function deployToDevWithInstaller(deploymentConfig: DeploymentConfi
werft.fail('authProviders', err);
}

werft.log("SSH gateway hostkey", "copy host-key from secret")
try {
exec(`kubectl --namespace keys get secret host-key -o yaml \
Copy link
Member

@meysholdt meysholdt Jan 6, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you run kubectl --namespace keys get secret host-key before

gitpod/.werft/build.ts

Line 334 in c732acb

exec(`mv k3s.yml /home/gitpod/.kube/config`)
gets executed?

This is needed in the with-vm scenario because we change the kubectl-context awawy from core-dev to the preview environment's k3s cluster.

meysholdt
meysholdt reviewed Jan 6, 2022
View reviewed changes
.werft/post-process.sh
if [[ "ws-proxy" == "$NAME" ]] && [[ "$KIND" == "Service" ]]; then
WORK="overrides for $NAME $KIND"
echo "$WORK"
# Provide harvester compatibility by adding ports instead of modifying the original ports
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❤️

@meysholdt
Copy link
Member

Just one remark; Other than that it L very GTM :)

@akosyakov
Copy link
Member

/lgtm

@roboquat roboquat added the lgtm label Jan 6, 2022
@roboquat
Copy link
Contributor

roboquat commented Jan 6, 2022

LGTM label has been added.

Git tree hash: 2bcb02036bd6c74d5153b22c147ce61ab7d6a580

@roboquat roboquat removed the lgtm label Jan 6, 2022
@meysholdt
Copy link
Member

/lgtm

@roboquat roboquat added the lgtm label Jan 6, 2022
@roboquat
Copy link
Contributor

roboquat commented Jan 6, 2022

LGTM label has been added.

Git tree hash: 8f36f5acf9454ef47aa4ee772afcd7b44c997b9c

@roboquat
Copy link
Contributor

roboquat commented Jan 6, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: akosyakov, csweichel, meysholdt, MrSimonEmms

Associated issue: #5602

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@iQQBot
Copy link
Contributor Author

iQQBot commented Jan 6, 2022

/unhold

@roboquat roboquat merged commit b0a97a4 into main Jan 6, 2022
@roboquat roboquat deleted the pd/ssh-gateway branch January 6, 2022 16:29
@iQQBot iQQBot mentioned this pull request Jan 6, 2022
Merged
@roboquat roboquat added the deployed: workspace Workspace team change is running in production label Jan 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@meysholdt meysholdt meysholdt approved these changes

@mrsimonemms mrsimonemms mrsimonemms left review comments

@akosyakov akosyakov akosyakov left review comments

@csweichel csweichel csweichel left review comments

Assignees

@meysholdt meysholdt

@mrsimonemms mrsimonemms

@akosyakov akosyakov

@iQQBot iQQBot

Labels
approved deployed: workspace Workspace team change is running in production release-note-none size/XXL team: delivery Issue belongs to the self-hosted team team: IDE team: workspace Issue belongs to the Workspace team
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Investigate ssh proxy (For: JetBrains integration, VSCode Desktop)
6 participants
@iQQBot @akosyakov @csweichel @mrsimonemms @meysholdt @roboquat