Add opt-in SSH access [1/2]

contrib/chart/templates/apirs.yaml

@@ -624,8 +624,12 @@ spec:
 {{- range $name, $value := .Values.apiRs.extraEnv }}
 {{- if ne $name "SESSION_SANDBOX_PASSTHROUGH_ENV" }}
             - name: {{ $name }}
+{{- if kindIs "map" $value }}
+{{ toYaml $value | nindent 14 }}
+{{- else }}
               value: {{ $value | quote }}
 {{- end }}
+{{- end }}
 {{- end }}
           envFrom:
             - secretRef:

contrib/chart/templates/proxy-sync.yaml

@@ -98,6 +98,8 @@ spec:
 {{- end }}
             - name: RUST_LOG
               value: info
+            - name: CENTAUR_SSH_TARGETS
+              value: {{ .Values.proxySync.sshTargets | toJson | quote }}
           ports:
             - name: http
               containerPort: {{ .Values.proxySync.port }}

contrib/chart/values.schema.json

@@ -524,7 +524,17 @@
         },
         "extraEnv": {
           "type": "object",
-          "additionalProperties": { "type": "string" }
+          "additionalProperties": {
+            "oneOf": [
+              { "type": "string" },
+              {
+                "type": "object",
+                "required": ["valueFrom"],
+                "additionalProperties": false,
+                "properties": { "valueFrom": { "type": "object", "minProperties": 1 } }
+              }
+            ]
+          }
         }
       }
     },

contrib/chart/values.yaml

@@ -435,6 +435,10 @@ agentSandbox:
 # for POST /api/v1/proxy/sync while all operator/admin traffic continues to use
 # Console. The service reads Console's database directly.
 proxySync:
+  # Deployment-owned WSS destinations for reusable personal SSH keys.
+  # Example: [{host: "*.dev.example.com", path: /events/events, username: dev}]
+  # Empty denies dynamic targets. Exact paths and TLS verification are mandatory.
+  sshTargets: []
   # Two replicas keep sync available during pod restarts and rolling updates.
   replicaCount: 2
   nodeSelector: {}

crates/centaur-api-server/src/args.rs

@@ -1912,6 +1912,18 @@ fn repository_visibility(value: Option<&str>) -> String {
 
 #[derive(Debug, ClapArgs)]
 struct IronProxyArgs {
+    #[arg(
+        long = "kubernetes-iron-proxy-ssh-enabled",
+        env = "KUBERNETES_IRON_PROXY_SSH_ENABLED",
+        default_value_t = false
+    )]
+    ssh_enabled: bool,
+    #[arg(
+        long = "kubernetes-iron-proxy-ssh-workspace",
+        env = "KUBERNETES_IRON_PROXY_SSH_WORKSPACE",
+        default_value = "/workspace"
+    )]
+    ssh_workspace: String,
     #[arg(
         long = "kubernetes-iron-proxy-image",
         env = "KUBERNETES_IRON_PROXY_IMAGE",
@@ -2020,6 +2032,15 @@ impl IronProxyArgs {
             })
             .collect::<Result<_, ServerError>>()?;
         config.database_port = self.database_port;
+        if self.ssh_enabled {
+            config
+                .extra_env
+                .insert("IRON_SSH_ENABLED".into(), "1".into());
+            config
+                .extra_env
+                .insert("IRON_SSH_WORKSPACE".into(), self.ssh_workspace.clone());
+        }
+
         self.source.apply_to_config(&mut config);
         config.fragments = harness_fragments;
         config.env_from_secret_names = self.env_from_secret_names();

crates/centaur-proxy-sync/src/integration_tests.rs

@@ -70,6 +70,7 @@ impl Fixture {
         let pool = database().await?;
         let unique = format!("{:032x}", rand_suffix());
         let state = AppState {
+            ssh_targets: vec![],
             pool: pool.clone(),
             encryption: Arc::new(ActiveRecordEncryption::new(PRIMARY_KEY, SALT)),
             jwt_secret: enabled.then(|| JWT_SECRET.to_owned()),

crates/centaur-proxy-sync/src/main.rs

@@ -4,6 +4,7 @@ mod database;
 #[cfg(test)]
 mod integration_tests;
 mod models;
+mod ssh;
 mod telemetry;
 mod tokens;
 
@@ -125,6 +126,12 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         .ok()
         .and_then(|url| host_from_url(&url));
     let state = AppState {
+        ssh_targets: ssh::target_policies(
+            env::var("CENTAUR_SSH_TARGETS")
+                .or_else(|_| env::var("CENTAUR_EE_SSH_TARGETS"))
+                .ok()
+                .as_deref(),
+        )?,
         pool,
         encryption: Arc::new(ActiveRecordEncryption::new(&primary_key, &salt)),
         jwt_secret: env::var("CENTAUR_JWT_SIGNING_SECRET")
@@ -152,6 +159,7 @@ fn router(state: AppState) -> Router {
         .route("/healthz", get(|| async { StatusCode::OK }))
         .route("/metrics", get(metrics))
         .route("/api/v1/proxy/sync", post(sync))
+        .route("/api/v1/proxy/ssh/authorize", post(ssh::authorize))
         .layer(middleware::from_fn(log_request))
         .with_state(state)
 }

crates/centaur-proxy-sync/src/models.rs

@@ -10,6 +10,7 @@ use crate::cache::SyncCache;
 
 #[derive(Clone)]
 pub(crate) struct AppState {
+    pub(crate) ssh_targets: Vec<crate::ssh::TargetPolicy>,
     pub(crate) pool: PgPool,
     pub(crate) encryption: Arc<ActiveRecordEncryption>,
     pub(crate) jwt_secret: Option<String>,