Skip to content

fix(BRE2-1307): fix ssh key sanitzation (AVIO) and deprecated sfc v1 #164

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
patelspratik merged 1 commit into from
Nov 11, 2026
Merged

fix(BRE2-1307): fix ssh key sanitzation (AVIO) and deprecated sfc v1 #164

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions v1/providers/sfcompute/client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,15 +9,18 @@ import (
sfcnodes "github.com/sfcompute/nodes-go"
)

// CloudProviderID deprecated: Use sfcomputev2.CloudProviderID instead.
const CloudProviderID = "sfcompute"

// Deprecated: Use sfcomputev2.SFCCredentialV2 instead.
type SFCCredential struct {
RefID string
APIKey string `json:"api_key"`
}

var _ v1.CloudCredential = &SFCCredential{}

// Deprecated: Use sfcomputev2.NewSFCCredentialV2 instead.
func NewSFCCredential(refID string, apiKey string) *SFCCredential {
return &SFCCredential{
RefID: refID,
Expand All @@ -42,6 +45,7 @@ func (c *SFCCredential) GetTenantID() (string, error) {
return "", nil
}

// Deprecated: Use sfcomputev2.SFCClientV2 instead.
type SFCClient struct {
v1.NotImplCloudClient
refID string
Expand All @@ -53,8 +57,10 @@ type SFCClient struct {

var _ v1.CloudClient = &SFCClient{}

// Deprecated: Use sfcomputev2.SFCClientV2Option instead.
type SFCClientOption func(c *SFCClient)

// Deprecated: Use sfcomputev2.WithLogger instead.
func WithLogger(logger v1.Logger) SFCClientOption {
return func(c *SFCClient) {
c.logger = logger
Expand Down
5 changes: 5 additions & 0 deletions v1/providers/sfcompute/doc.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
// Package v1 implements the legacy SFCompute nodes API provider.
//
// Deprecated: Use github.com/brevdev/cloud/v1/providers/sfcomputev2 instead.
// This provider is retained for backward compatibility and is planned for removal.
package v1
17 changes: 14 additions & 3 deletions v1/providers/sfcompute/instance.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ import (
v1 "github.com/brevdev/cloud/v1"
sfcnodes "github.com/sfcompute/nodes-go"
"github.com/sfcompute/nodes-go/packages/param"
"golang.org/x/crypto/ssh"
)

const (
Expand All @@ -23,6 +24,11 @@ const (
)

func (c *SFCClient) CreateInstance(ctx context.Context, attrs v1.CreateInstanceAttrs) (*v1.Instance, error) {
cloudInit, err := sshKeyCloudInit(attrs.PublicKey)
if err != nil {
return nil, errors.WrapAndTrace(err)
}

// Get the zone for the location (do not include unavailable zones)
zone, err := c.getZone(ctx, attrs.Location, false)
if err != nil {
Expand All @@ -41,7 +47,7 @@ func (c *SFCClient) CreateInstance(ctx context.Context, attrs v1.CreateInstanceA
MaxPricePerNodeHour: maxPricePerNodeHour,
Zone: zone.Name,
Names: []string{name},
CloudInitUserData: param.Opt[string]{Value: sshKeyCloudInit(attrs.PublicKey)},
CloudInitUserData: param.Opt[string]{Value: cloudInit},
},
})
if err != nil {
Expand All @@ -61,9 +67,14 @@ func (c *SFCClient) CreateInstance(ctx context.Context, attrs v1.CreateInstanceA
return instance, nil
}

func sshKeyCloudInit(sshKey string) string {
func sshKeyCloudInit(sshKey string) (string, error) {
key, _, _, _, err := ssh.ParseAuthorizedKey([]byte(sshKey))
if err != nil {
return "", fmt.Errorf("invalid SSH public key: %w", err)
}
sshKey = strings.TrimSpace(string(ssh.MarshalAuthorizedKey(key)))
script := fmt.Sprintf("#cloud-config\nssh_authorized_keys:\n - %s", sshKey)
return base64.StdEncoding.EncodeToString([]byte(script))
return base64.StdEncoding.EncodeToString([]byte(script)), nil
}

func (c *SFCClient) GetInstance(ctx context.Context, id v1.CloudProviderInstanceID) (*v1.Instance, error) {
Expand Down
17 changes: 14 additions & 3 deletions v1/providers/sfcomputev2/instance.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,13 @@ import (
"net/http"
"regexp"
"slices"
"strings"
"time"

"github.com/alecthomas/units"
"github.com/brevdev/cloud/internal/errors"
v1 "github.com/brevdev/cloud/v1"
"golang.org/x/crypto/ssh"
)

// SFC instance names must match `[a-zA-Z0-9][a-zA-Z0-9._-]{0,254}`: start with an
Expand Down Expand Up @@ -41,6 +43,11 @@ func makeSFCName(refID string, tags v1.Tags) string {
}

func (c *SFCClientV2) CreateInstance(ctx context.Context, attrs v1.CreateInstanceAttrs) (*v1.Instance, error) {
cloudInit, err := sshKeyCloudInit(attrs.PublicKey)
if err != nil {
return nil, errors.WrapAndTrace(err)
}

c.logger.Debug(ctx, "sfcv2: CreateInstance start",
v1.LogField("name", attrs.Name),
v1.LogField("location", attrs.Location),
Expand All @@ -57,7 +64,6 @@ func (c *SFCClientV2) CreateInstance(ctx context.Context, attrs v1.CreateInstanc
return nil, errors.WrapAndTrace(err)
}

cloudInit := sshKeyCloudInit(attrs.PublicKey)
req := createInstanceRequest{
Pool: c.GetDefaultPoolResourcePath(),
Image: c.GetDefaultImageResourcePath(),
Expand Down Expand Up @@ -89,9 +95,14 @@ func (c *SFCClientV2) CreateInstance(ctx context.Context, attrs v1.CreateInstanc
return instance, nil
}

func sshKeyCloudInit(sshKey string) string {
func sshKeyCloudInit(sshKey string) (string, error) {
key, _, _, _, err := ssh.ParseAuthorizedKey([]byte(sshKey))
if err != nil {
return "", fmt.Errorf("invalid SSH public key: %w", err)
}
sshKey = strings.TrimSpace(string(ssh.MarshalAuthorizedKey(key)))
script := fmt.Sprintf("#cloud-config\nssh_authorized_keys:\n - %s", sshKey)
return base64.StdEncoding.EncodeToString([]byte(script))
return base64.StdEncoding.EncodeToString([]byte(script)), nil
}

func (c *SFCClientV2) GetInstance(ctx context.Context, id v1.CloudProviderInstanceID) (*v1.Instance, error) {
Expand Down
Loading