I'm creating a system similar to a cloud computing provider using the libvirt python bindings.
I would like to give users the ability to specify a custom virtual machine image, in a similar fashion to AWS.
I would like to generate SSH key pairs on the fly and set the VM up for public key authentication.
Which is the best method to do this? Which requirements should I impose on the user-specified VM image for this to work?
I was thinking at a passwordless root account to allow my piece of software to login and set up what needed, but this leaves a (short) timespan during which everyone could login as root. Are there better solutions? Can I edit the virtual machine image before starting it?
In practice, I need to login to be able to login to the machine and execute some commands, before giving it to the user.
Some additional details:
- I know about Eucalyptus, Cloudstack and Openstack. This implementation is for a very specific environment/requirements (HPC clusters, batch job scheduling) and does not allow to run these.
- I actually don't care (or, for the purpose of this question, it is not relevant) where the key pair comes from, I only want to know how the service provider can possibly access the machine, by requiring as less setup as possible on the VM image on the user part; ErikA replied to this suggesting a service specific key pair. Fair enough. Are there other solutions?
- The final user does not have to have access to the new virtual machine, he will run jobs on it through SLURM (though, he could access it if he wants to, I don't care).
- The provider takes care of:
- Allocating and spawning new domains (virtual machines)
- Spawning the SLURM daemon (which does not have to happen at startup, but at a certain point in time, thus the need for the provider to be able to access the machine)