Files
cluster-knaster/platform/proxmox/scripts/trust-vm-hostkeys.sh
T
2026-10-12 19:19:58 +02:00

20 lines
974 B
Bash
Executable File

#!/usr/bin/env bash
# Hostschlüssel der GPU-VMs über den qemu-guest-agent lesen und in ~/.ssh/known_hosts eintragen
# (läuft auf ops, im Verzeichnis platform/proxmox/tofu). Vertrauensweg: Proxmox-API/Agent statt
# ssh-keyscan übers Netz. Wartet vorher, bis cloud-init in der VM fertig ist.
set -euo pipefail
tofu output -json gpu_vms | python3 -c '
import json, sys
for name, v in json.load(sys.stdin).items():
if v["ipv4"]:
print(name, v["node"], v["vmid"], v["ipv4"])
' | while read -r name node vmid ip; do
ssh -n "$node" "qm guest exec $vmid --timeout 900 -- cloud-init status --wait" >/dev/null || true
key=$(ssh -n "$node" "qm guest exec $vmid -- cat /etc/ssh/ssh_host_ed25519_key.pub" \
| python3 -c 'import json, sys; print(json.load(sys.stdin)["out-data"].strip())')
ssh-keygen -R "$ip" >/dev/null 2>&1 || true
echo "$ip $key" >> ~/.ssh/known_hosts
echo "$name ($ip): $(ssh-keygen -lf <(echo "$ip $key") | awk '{print $2}')"
done