Also while thinking about it, ~5-8 curl calls fro every SSH login can be quite 
expensive.
I know it fortunately has an early exit but that still is 2 curl requests.

If this is installed in any place without the endpoint at
169.254.169.254 being responsive and super fast this could lead to a
very bad user experience.

Examples:
1. it checks the instance-id via curl, only then locally if it runs on EC2
   I think it really should check that ahead of time

2. (more of a general design issue); doing that on every login feels like a 
massive overhead.
   Think of remote configuration management software that expects to run 
hundreds of ssh calls
   per second. We were bitten in the past by issues there e.g. slow MOTD 
generated on login.
   I really would want all those scripts to do some rate-limiting.
   That is either a full design change away from AuthorizedKeysCommand 
(probably too complex),
   or and that might be more doable a rate limit. Let it timestamp itself and 
do any execution 
   except this check only once per 5 seconds. For an example load with 100 
logins per second for 
   10 seconds that would drop the overhead from 1000 to 2. And I think it would 
be fine to wait 5 
   sec for a new key to be active.

@cyphermox can you bring that up with the developers who write on this
as well?

-- 
You received this bug notification because you are a member of cloud-
init commiters, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1835114

Title:
  [MIR] ec2-instance-connect

Status in ec2-instance-connect package in Ubuntu:
  Incomplete

Bug description:
  [Availability]
  ec2-instance-connect is in the Ubuntu archive, and available for all supported
  releases. It is available on all architectures despite only being useful on
  Amazon EC2 instances.

  [Rationale]
  This package is useful on Amazon EC2 instances to make use of a new feature:
  Instance Connect; which allows storing SSH keys for access online in the 
Amazon
  systems. These SSH keys are then retrieved to be used by the system's SSH
  service, collated with pre-existing keys as deployed on the system.

  Installing the package enables the use of Instance Connect on an
  instance.

  [Security]
  This is a new package, and as such has no security history to speak of.

  [Quality Assurance]
  The package consists in a few shell scripts that are difficult to test by
  themselves due to the high reliance on Amazon's Instance Connect service;
  which is online and limited to use on Amazon instances.

  Given that it's a new package, there are no long-term outstanding bugs in
  Ubuntu or Debian. The package is only maintained in Ubuntu at the moment.

  This package deals with special "hardware"; it is only useful on Amazon
  instances, and its support is required as a default deployment on such
  instances when deployed with Ubuntu.

  [UI Standards]
  Not applicable. This service is command-line only and has no configuration 
options.

  [Dependencies]
  There are no special dependencies to speak of.

  [Standards Compliance]
  This package has been thoroughly reviewed by a few Canonical engineers, there
  are no standards violations known.

  [Maintenance]
  This package is to be owned by the Ubuntu Foundations team.

  [Background Information]
  This is Amazon-specific, as previously mentioned.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ec2-instance-connect/+bug/1835114/+subscriptions

_______________________________________________
Mailing list: https://launchpad.net/~cloud-init-dev
Post to     : cloud-init-dev@lists.launchpad.net
Unsubscribe : https://launchpad.net/~cloud-init-dev
More help   : https://help.launchpad.net/ListHelp

Reply via email to