KM498 ✅ Use ed25519 key algorithm for ArgoCD deploy key

[yngvark]

Description

Changes deploy key to use ed25519 algorithm for SSH keys.

Unfortunately, the Golang standard library haven't yet implemented support for marshalling a ed25519 private key into the OpenSSH format, which is required by Git, hence ArgoCD. To do this, I have copied the implementation from https://github.com/mikesmitty/edkey and documented its use. Also wrote a simple test to attempt to verify that produced private key is secure. The documentation includes a link to the issue (see link below) that tracks the implemenation of support for the OpenSSH format.

Background: golang/go#37132

Motivation and Context

https://trello.com/c/9GxBElfD/498-argocd-stops-working-2022-03-15-due-to-old-format-of-deploy-key

How to prove the effect of this PR?

Verify old key

• In AWS console, open SSM -> Parameter store, search for "private" to find the privatekey for your cluster (something like /okctl/x/github/deploykeys/oslokommune/x/privatekey)
• Show the secret, it should should a 4096 bit long RSA key

Remove and reapply ArgoCD

• cluster declaration -> argoCD: false
• okctl apply cluster ...
• cluster declaration -> argoCD: true
• okctl apply cluster ...

Verify new key

• Refresh the secret in SSM. It should now show a much shorter key, as ed25519 keys are much shorter.
• In https://github.com/oslokommune/your-iac-repo/settings/keys, you can verify that you have a new deploy key
• In ArgoCD, choose an App and click "synchronize". This should trigger using the new key.

Also, in okctl state -> github, the public key should now start with "ed25519".

Additional info

The upgrade for this is in: oslokommune/okctl-upgrade#14

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.
• I have updated the release notes (for the next release).

[deifyed]

LGTM. Can't say I feel comfortable QA'ing crypto related functions. Maybe ensure theres other eyes on this as well?

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

[codecov]

Codecov Report

Merging #894 (694eea3) into master (ab281a2) will increase coverage by 2.32%.
The diff coverage is 35.94%.

@@            Coverage Diff             @@
##           master     #894      +/-   ##
==========================================
+ Coverage   44.19%   46.52%   +2.32%     
==========================================
  Files         277      239      -38     
  Lines        7811     7347     -464     
==========================================
- Hits         3452     3418      -34     
+ Misses       4359     3929     -430     

Impacted Files	Coverage Δ
pkg/api/core/service_component.go	0.00% <0.00%> (ø)
pkg/api/core/service_kube.go	10.34% <0.00%> (-1.20%)	⬇️
pkg/api/core/service_objectstorage.go	0.00% <0.00%> (ø)
pkg/api/parameter_api.go	0.00% <ø> (ø)
pkg/apis/okctl.io/v1alpha1/cluster_v1alpha1.go	66.66% <ø> (+6.66%)	⬆️
...client/core/service_application_postgres_client.go	0.00% <0.00%> (ø)
pkg/client/core/service_argocd_client.go	0.00% <0.00%> (ø)
pkg/client/core/service_certificate_client.go	0.00% <0.00%> (ø)
pkg/client/core/service_cluster_client.go	0.00% <0.00%> (ø)
pkg/client/core/service_component.go	0.00% <0.00%> (ø)
... and 34 more