diff --git a/openssh/files/ssh_known_hosts b/openssh/files/ssh_known_hosts index a8496dd..f3e2a87 100644 --- a/openssh/files/ssh_known_hosts +++ b/openssh/files/ssh_known_hosts @@ -2,10 +2,41 @@ # vi:syntax=jinja #} +{#- Generates one known_hosts entry per given key #} +{%- macro known_host_entry(host, host_names, keys) %} + +{#- Get IPv4 and IPv6 addresses from the DNS #} +{%- set ip4 = salt['dig.A'](host) -%} +{%- set ip6 = salt['dig.AAAA'](host) -%} + +{#- The host names to use are to be found within the dict 'host_names'. #} +{#- If there are none, the host is used directly. #} +{%- set names = [host_names.get(host, host)] -%} + +{#- Append IP addresses and aliases (if they are not already present) #} +{%- for ip in (ip4 + ip6)|sort -%} +{%- do names.append(ip) -%} +{%- for alias in aliases_ips.get(ip, []) -%} +{%- if alias not in names -%} +{%- do names.append(alias) -%} +{%- endif -%} +{%- endfor -%} +{%- endfor -%} + +{#- Write one line per key; join the names together #} +{%- for line in keys.split('\n') -%} +{%- if line -%} +{{ ','.join(names) }} {{ line }} +{% endif -%} +{%- endfor -%} +{%- endmacro -%} + +{#- Pre-fetch pillar data #} {%- set target = salt['pillar.get']('openssh:known_hosts:target', '*') -%} {%- set expr_form = salt['pillar.get']('openssh:known_hosts:expr_form', 'glob') -%} {%- set keys_function = salt['pillar.get']('openssh:known_hosts:mine_keys_function', 'public_ssh_host_keys') -%} {%- set hostname_function = salt['pillar.get']('openssh:known_hosts:mine_hostname_function', 'public_ssh_hostname') -%} + {#- Lookup IP of all aliases so that when we have a matching IP, we inject the alias name in the SSH known_hosts entry -#} {%- set aliases = salt['pillar.get']('openssh:known_hosts:aliases', []) -%} @@ -15,24 +46,10 @@ {%- do aliases_ips.setdefault(ip, []).append(alias) -%} {%- endfor -%} {%- endfor -%} + {#- Loop over targetted minions -#} {%- set host_keys = salt['mine.get'](target, keys_function, expr_form=expr_form) -%} {%- set host_names = salt['mine.get'](target, hostname_function, expr_form=expr_form) -%} {%- for host, keys in host_keys|dictsort -%} - {%- set ip4 = salt['dig.A'](host) -%} - {%- set ip6 = salt['dig.AAAA'](host) -%} - {%- set names = [host_names.get(host, host)] -%} - {%- for ip in (ip4 + ip6)|sort -%} - {%- do names.append(ip) -%} - {%- for alias in aliases_ips.get(ip, []) -%} - {%- if alias not in names -%} - {%- do names.append(alias) -%} - {%- endif -%} - {%- endfor -%} - {%- endfor -%} - {%- for line in keys.split('\n') -%} - {%- if line -%} -{{ ','.join(names) }} {{ line }} -{% endif -%} - {%- endfor -%} +{{ known_host_entry(host, host_names, keys) }} {%- endfor -%}