private key file? about knife-azure

[adamedx]

@tessus it doesn't get uploaded, it's used to connect to the remote system. Is there anything in particular that led you to believe it was being uploaded?

[adamedx]

For reference @tessus, the private key is used to generate the public key which is then configured on the remote system: https://github.com/chef/knife-azure/blob/master/lib/azure/service_management/certificate.rb#L50-L58

[tessus]

@adamedx I think you misunderstood my question.

I know that I can create a public key from a private key, but there's no reason to do that. I have a key pair in my .ssh directory. To connect to a remote machine, the public key has to be uploaded to the remote system.
There should be no need for you to touch my private key in any way.

Thus you should be able to specify the public key with this parameter and this key should then be uploaded and put into the authorized_keys file.

[adamedx]

Right, we could just use your public key for just provisioning the remote system, but we also need the private key because after the VM boots up, we create an ssh connection to the remote system and use that to bootstrap. Again, the private key is never sent to the remote system.

Since we need the private key to start the ssh connection, we just ask you to specify that. We could also ask you for the public key, but since we can generate that, it's not necessary and avoids the complexity of supplying extra arguments and making sure the keys match up.

Here's another place where you'll see the private key used: bootstrapping an existing system via the knife command that comes with chef: https://github.com/chef/chef/blob/master/lib/chef/knife/bootstrap.rb#L80-L83. This is actually the same case here, the difference is that with knife-azure we actually create the system, and we also configure it with a public key before resuming with the sequence in plain knife.

[adamedx]

One other suggestion if you're looking at this from a security standpoint: an even safer way than using ssh for bootstrap is using the --bootstrap-protocol cloud-api option. That simply uses the Azure api to inject Chef into the VM rather than sending commands via ssh. For that flow you don't have to specify a private key, and you could enable ssh via a cookbook with a public key rather than through knife itself.

[tessus]

Thank you for the info.

I didn't realize the bootstrap part. For some reason I thought this would be either part of the image or done via other means.

Now it makes sense. I just got nervous having to specify a private key without knowing why it was necessary and what was done with the key.