Connect to remote SSH nodes using SSH CLI (#152)

* Connect to remote SSH nodes using SSH CLI Replace Go-native SSH implementation with SSH CLI execution to support diverse SSH configurations and agents. Implements 'uncloudd dial-stdio' subcommand that proxies gRPC connections over stdin/stdout, similar to Docker's approach. This change addresses compatibility issues with: - SSH agents exposing many keys (1Password, causing "too many authentication failures") - Tailscale SSH (which doesn't support advanced SSH channel types like direct-streamlocal) - Custom SSH configurations in ~/.ssh/config The dial-stdio approach reduces SSH feature requirements by streaming the unix socket connection over stdin/stdout instead of using SSH channel forwarding. Changes: - Add 'uncloudd dial-stdio' hidden subcommand for socket proxy - Add SSHCLIConnector using ssh command + dial-stdio - Update connection logic to use SSH CLI connector - Maintain backward compatibility with SSHKeyFile config Resolves #131 * Fix sshcli tests missing ConnectionTimeout Introduced short connection timeout on the first change but forgot to update tests to match. * Add SSHCLI field and update MachineConnection String() format - Add SSHCLI field to support ssh_cli YAML configuration - Update String() to use URI-like format (ssh://, ssh+cli://, tcp://) * Add Validate() method and tests for MachineConnection - Add Validate() to ensure connection methods are mutually exclusive - Add tests for validation and String() method * Unify SSH connector configs to use SSHConnectorConfig * Update connectCluster to support both SSH connector types * Restore Go SSH connector as default for machine init/add Revert provisionOrConnectRemoteMachine to use Go SSH connector: - Root users: reuse SSH connection from provisioning - Non-root users: establish new connection for group membership - Remove SSH CLI as default connector SSH CLI connector remains available via ssh_cli config field. * Add sshCLIDialer with DialContext method Implement proxy.ContextDialer for SSHCLIConnector using SSH -W flag. Each dial spawns a new SSH process for TCP forwarding, enabling independent connections separate from the gRPC dial-stdio connection. * Implement SSHCLIConnector.Dialer() method Return sshCLIDialer instead of error, enabling uc image push functionality with SSHCLIConnector. Validates connector is configured before returning dialer. * Fix half-closing implementation matchin Docker's approach * Use testify assertions for connection tests * Allow ssh+cli:// to be used with --connect This way I can skip the configuration file while testing things out, and confirm it works correctly: $ unset SSH_AUTH_SOCK $ ./uncloud --connect ssh://provision@blatta11 machine ls Error: connect to cluster: connect to machine: SSH login to provision@blatta11:22: connect using SSH agent: connect to SSH agent: dial unix: missing address $ ./uncloud --connect ssh+cli://provision@blatta11 machine ls NAME STATE ADDRESS PUBLIC IP WIREGUARD ENDPOINTS MACHINE ID blatta11 Up 10.210.0.1/24 - 100.64.0.22:51820, ... * Validates configuration before connecting to cluster * Do not tie client constructor with real validation No longer attempt to validate the connection when instantiating a new client. Later on we could validate it in different places. * Cleanup test and remove AI-slop There were some serious slop in those tests, so took the time to clean them up and kept only the relevant ones. There is some repetition between buildSSHArgs and buildDialArgs but can be tackled at a later stage. * Fix connection representation tests Prefix connection with ssh ssh+cli respectively. * Wait for stdout before returning Missed copy & pasta from Docker dial-stdio implementation (this happens when you stare at the code for too long that it burns your eyes).
2026-08-26 11:03:34 +00:00 · 2025-11-06 09:44:29 +10:00
parent 06d988583d
commit 48d2239f5d
10 changed files with 697 additions and 20 deletions
@@ -57,6 +57,7 @@ func New(ctx context.Context, connector Connector) (*Client, error) {
 	c.ClusterClient = pb.NewClusterClient(c.conn)
 	c.Caddy = pb.NewCaddyClient(c.conn)
 	c.Docker = docker.NewClient(c.conn)
+
 	return c, nil
 }

@@ -0,0 +1,154 @@
+package connector
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"strconv"
+
+	"github.com/docker/cli/cli/connhelper/commandconn"
+	"github.com/psviderski/uncloud/internal/machine"
+	"golang.org/x/net/proxy"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+// SSHCLIConnector establishes a connection to the machine API by executing SSH CLI
+// and running `uncloudd dial-stdio` on the remote machine.
+type SSHCLIConnector struct {
+	config SSHConnectorConfig
+	conn   net.Conn
+}
+
+func NewSSHCLIConnector(cfg *SSHConnectorConfig) *SSHCLIConnector {
+	return &SSHCLIConnector{config: *cfg}
+}
+
+// sshCLIDialer implements proxy.ContextDialer by spawning SSH processes with -W flag.
+type sshCLIDialer struct {
+	config SSHConnectorConfig
+}
+
+// buildDialArgs constructs SSH command arguments for -W flag dialing.
+func (d *sshCLIDialer) buildDialArgs(address string) []string {
+	args := []string{}
+
+	// Add connection timeout to fail fast when node is down.
+	args = append(args, "-o", "ConnectTimeout=5")
+
+	// Add port if non-standard.
+	if d.config.Port != 0 && d.config.Port != 22 {
+		args = append(args, "-p", strconv.Itoa(d.config.Port))
+	}
+
+	// Add identity file if specified.
+	if d.config.KeyPath != "" {
+		args = append(args, "-i", d.config.KeyPath)
+	}
+
+	// Add -W flag for stdin/stdout forwarding to target address.
+	args = append(args, "-W", address)
+
+	// Add user@host.
+	args = append(args, d.config.User+"@"+d.config.Host)
+
+	return args
+}
+
+// DialContext establishes a connection to the target address through an SSH tunnel using -W flag.
+func (d *sshCLIDialer) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	// Only support TCP connections.
+	if network != "tcp" {
+		return nil, fmt.Errorf("unsupported network type: %s", network)
+	}
+
+	// Build SSH command arguments.
+	args := d.buildDialArgs(address)
+
+	// Create connection using commandconn.
+	conn, err := commandconn.New(ctx, "ssh", args...)
+	if err != nil {
+		return nil, fmt.Errorf("SSH connection to %s@%s for dialing %s: %w", d.config.User, d.config.Host, address, err)
+	}
+
+	return conn, nil
+}
+
+func (c *SSHCLIConnector) Connect(ctx context.Context) (*grpc.ClientConn, error) {
+	// Build SSH command arguments.
+	args := c.buildSSHArgs()
+
+	// Create connection using commandconn.
+	conn, err := commandconn.New(ctx, "ssh", args...)
+	if err != nil {
+		return nil, fmt.Errorf("SSH connection to %s@%s: %w", c.config.User, c.config.Host, err)
+	}
+	c.conn = conn
+
+	// Create gRPC client over the connection.
+	// Use a custom dialer that returns our existing connection.
+	grpcConn, err := grpc.NewClient(
+		"passthrough:///", // Dummy target since we're using a custom dialer.
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		grpc.WithContextDialer(func(ctx context.Context, _ string) (net.Conn, error) {
+			return c.conn, nil
+		}),
+	)
+	if err != nil {
+		c.conn.Close()
+		return nil, fmt.Errorf("create machine API client: %w", err)
+	}
+
+	return grpcConn, nil
+}
+
+// buildSSHArgs constructs the SSH command arguments.
+func (c *SSHCLIConnector) buildSSHArgs() []string {
+	args := []string{}
+
+	// Add connection timeout to fail fast when node is down.
+	args = append(args, "-o", "ConnectTimeout=5")
+
+	// Add port if non-standard.
+	if c.config.Port != 0 && c.config.Port != 22 {
+		args = append(args, "-p", strconv.Itoa(c.config.Port))
+	}
+
+	// Add identity file if specified (backward compatibility with SSHKeyFile).
+	if c.config.KeyPath != "" {
+		args = append(args, "-i", c.config.KeyPath)
+	}
+
+	// Add user@host.
+	args = append(args, c.config.User+"@"+c.config.Host)
+
+	// Add remote command: uncloudd dial-stdio
+	args = append(args, "uncloudd", "dial-stdio")
+
+	// Add socket path if non-default.
+	if c.config.SockPath != "" && c.config.SockPath != machine.DefaultUncloudSockPath {
+		args = append(args, "--socket", c.config.SockPath)
+	}
+
+	return args
+}
+
+// Dialer returns a proxy dialer for establishing connections within the cluster through SSH tunnels.
+func (c *SSHCLIConnector) Dialer() (proxy.ContextDialer, error) {
+	if c.config == (SSHConnectorConfig{}) {
+		return nil, fmt.Errorf("SSH connector not configured")
+	}
+
+	return &sshCLIDialer{
+		config: c.config,
+	}, nil
+}
+
+func (c *SSHCLIConnector) Close() error {
+	if c.conn != nil {
+		err := c.conn.Close()
+		c.conn = nil
+		return err
+	}
+	return nil
+}
@@ -0,0 +1,166 @@
+package connector
+
+import (
+	"testing"
+
+	"github.com/psviderski/uncloud/internal/machine"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSSHCLIConnector_buildSSHArgs(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		config   SSHConnectorConfig
+		expected []string
+	}{
+		{
+			name: "basic connection",
+			config: SSHConnectorConfig{
+				User: "root",
+				Host: "example.com",
+			},
+			expected: []string{"-o", "ConnectTimeout=5", "root@example.com", "uncloudd", "dial-stdio"},
+		},
+		{
+			name: "with custom port",
+			config: SSHConnectorConfig{
+				User: "root",
+				Host: "example.com",
+				Port: 2222,
+			},
+			expected: []string{"-o", "ConnectTimeout=5", "-p", "2222", "root@example.com", "uncloudd", "dial-stdio"},
+		},
+		{
+			name: "with identity file",
+			config: SSHConnectorConfig{
+				User:    "root",
+				Host:    "example.com",
+				KeyPath: "/path/to/key",
+			},
+			expected: []string{"-o", "ConnectTimeout=5", "-i", "/path/to/key", "root@example.com", "uncloudd", "dial-stdio"},
+		},
+		{
+			name: "with custom socket path",
+			config: SSHConnectorConfig{
+				User:     "root",
+				Host:     "example.com",
+				SockPath: "/custom/path/uncloud.sock",
+			},
+			expected: []string{"-o", "ConnectTimeout=5", "root@example.com", "uncloudd", "dial-stdio", "--socket", "/custom/path/uncloud.sock"},
+		},
+		{
+			name: "with default socket path (not included)",
+			config: SSHConnectorConfig{
+				User:     "root",
+				Host:     "example.com",
+				SockPath: machine.DefaultUncloudSockPath,
+			},
+			expected: []string{"-o", "ConnectTimeout=5", "root@example.com", "uncloudd", "dial-stdio"},
+		},
+		{
+			name: "all options combined",
+			config: SSHConnectorConfig{
+				User:     "root",
+				Host:     "example.com",
+				Port:     2222,
+				KeyPath:  "/path/to/key",
+				SockPath: "/custom/path/uncloud.sock",
+			},
+			expected: []string{"-o", "ConnectTimeout=5", "-p", "2222", "-i", "/path/to/key", "root@example.com", "uncloudd", "dial-stdio", "--socket", "/custom/path/uncloud.sock"},
+		},
+		{
+			name: "port 22 not included (default)",
+			config: SSHConnectorConfig{
+				User: "root",
+				Host: "example.com",
+				Port: 0,
+			},
+			expected: []string{"-o", "ConnectTimeout=5", "root@example.com", "uncloudd", "dial-stdio"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			c := &SSHCLIConnector{config: tt.config}
+			got := c.buildSSHArgs()
+			assert.Equal(t, tt.expected, got)
+		})
+	}
+}
+
+func TestSSHCLIDialer_buildDialArgs(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		config   SSHConnectorConfig
+		address  string
+		expected []string
+	}{
+		{
+			name: "basic connection",
+			config: SSHConnectorConfig{
+				User: "root",
+				Host: "example.com",
+			},
+			address:  "10.210.1.1:5000",
+			expected: []string{"-o", "ConnectTimeout=5", "-W", "10.210.1.1:5000", "root@example.com"},
+		},
+		{
+			name: "custom port",
+			config: SSHConnectorConfig{
+				User: "root",
+				Host: "example.com",
+				Port: 2222,
+			},
+			address:  "10.210.1.1:5000",
+			expected: []string{"-o", "ConnectTimeout=5", "-p", "2222", "-W", "10.210.1.1:5000", "root@example.com"},
+		},
+		{
+			name: "with identity file",
+			config: SSHConnectorConfig{
+				User:    "root",
+				Host:    "example.com",
+				Port:    22,
+				KeyPath: "/home/user/.ssh/id_rsa",
+			},
+			address:  "10.210.1.1:5000",
+			expected: []string{"-o", "ConnectTimeout=5", "-i", "/home/user/.ssh/id_rsa", "-W", "10.210.1.1:5000", "root@example.com"},
+		},
+		{
+			name: "custom port with identity file",
+			config: SSHConnectorConfig{
+				User:    "root",
+				Host:    "example.com",
+				Port:    2222,
+				KeyPath: "/home/user/.ssh/id_rsa",
+			},
+			address:  "10.210.1.1:5000",
+			expected: []string{"-o", "ConnectTimeout=5", "-p", "2222", "-i", "/home/user/.ssh/id_rsa", "-W", "10.210.1.1:5000", "root@example.com"},
+		},
+		{
+			name: "zero port defaults to 22",
+			config: SSHConnectorConfig{
+				User: "root",
+				Host: "example.com",
+				Port: 0,
+			},
+			address:  "10.210.1.1:5000",
+			expected: []string{"-o", "ConnectTimeout=5", "-W", "10.210.1.1:5000", "root@example.com"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			d := &sshCLIDialer{config: tt.config}
+			got := d.buildDialArgs(tt.address)
+			assert.Equal(t, tt.expected, got)
+		})
+	}
+}