Support host certificates in gitlab-sshd
Summary
We need to add config support for the host_cert_files
parameter for gitlab-sshd
. This was added in gitlab-org/gitlab-shell!661 (merged).
host_cert_files
contains a list of signed certificates for the server's host keys. This is equivalent to OpenSSH's HostCertificate
parameter.
The idea here is that some certificate authority signs off on the server's keys, and gitlab-sshd
publishes these certificates so clients don't have to rely on manual fingerprint checking.
There will likely be one certificate per host key used. We'll probably want to pass the content of the public keys in as a Kubernetes secret, and then save them to a mount that gitlab-sshd
can access.