Nexus Linux machine uses SSH keys

[marrobi]

Fixes #4359

Update Sonatype Nexus VM to require SSH key-based authentication.

• Remove password-based authentication and related resources from templates/shared_services/sonatype-nexus-vm/terraform/vm.tf.
• Add resources to generate and store SSH keys in Key Vault.
• Update the connection block to use the SSH private key for authentication.
• Update docs/tre-templates/shared-services/nexus.md to reflect the change to SSH key-based authentication and provide instructions on how to retrieve the SSH private key from Key Vault.

---

For more details, open the Copilot Workspace session.

[marrobi]

@jonnyry ran his through copilot, fancy testing and fixing up?

[github-actions]

Unit Test Results

0 tests   0 ✅  0s ⏱️
0 suites  0 💤
0 files    0 ❌

Results for commit 677fb05.

[jonnyry]

@jonnyry ran his through copilot, fancy testing and fixing up?

there's a few issues with it that I can see at first glance -

• the SSH key pair get written to the terraform state
• the private key is passed to the Nexus VM rather than the public key
• the Nexus VM will get destroyed since changing disable_password_authentication is destructive

I've got a fix for this issue locally that uses a bash script to keep the SSH private key out of TF state. Happy to PR back if you like.

[marrobi]

@jonnyry ran his through copilot, fancy testing and fixing up?

there's a few issues with it that I can see at first glance -

• the SSH key pair get written to the terraform state
• the private key is passed to the Nexus VM rather than the public key
• the Nexus VM will get destroyed since changing disable_password_authentication is destructive

I've got a fix for this issue locally that uses a bash script to keep the SSH private key out of TF state. Happy to PR back if you like.

Hmm, I'd like to avoid even more bash script to be honest. How about an Ephemeral resource - https://developer.hashicorp.com/terraform/language/resources/ephemeral

[jonnyry]

@jonnyry ran his through copilot, fancy testing and fixing up?

there's a few issues with it that I can see at first glance -

• the SSH key pair get written to the terraform state
• the private key is passed to the Nexus VM rather than the public key
• the Nexus VM will get destroyed since changing disable_password_authentication is destructive

I've got a fix for this issue locally that uses a bash script to keep the SSH private key out of TF state. Happy to PR back if you like.

Hmm, I'd like to avoid even more bash script to be honest. How about an Ephemeral resource - https://developer.hashicorp.com/terraform/language/resources/ephemeral

Currently they can only read existing secrets/certs in azurerm provider:

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/ephemeral-resources/key_vault_secret