openssh-formula/openssh/files/default/ssh_known_hosts

{#
# vi:syntax=jinja
#}

{#- Generates one known_hosts entry per given key #}
{%- macro known_host_entry(host, host_names, keys, include_localhost, omit_ip_address) %}

{#-   Get IPv4 and IPv6 addresses from the DNS #}
{%-   if not (omit_ip_address is sameas true or host in omit_ip_address) %}
{%-     set ip4 = salt['dig.A'](host) -%}
{%-     set ip6 = salt['dig.AAAA'](host) -%}
{%-   else %}
{%-     set ip4 = [] -%}
{%-     set ip6 = [] -%}
{%-   endif %}

{#-   The host names to use are to be found within the dict 'host_names'. #}
{#-   If there are none, the host is used directly. #}
{%-   set names = host_names.get(host, host) -%}
{%-   set names = [names] if names is string else names %}
{%-   if include_localhost and host == grains['id'] %}
{%-     do names.append('localhost') %}
{%-     do names.append('127.0.0.1') %}
{%-     do names.append('::1') %}
{%-   endif -%}

{#-   Extract the hostname from the FQDN and add it to the names. #}
{%-   if use_hostnames is iterable -%}
{%-     for name in names | sort -%}
{%-       if salt["match.{}".format(hostnames_tgt_type)](hostnames_target, minion_id=name) -%}
{%-         set hostname = name.split('.')|first -%}
{%-         if hostname not in names -%}
{%-           do names.append(hostname) -%}
{%-         endif -%}
{%-       endif -%}
{%-     endfor -%}
{%-   endif -%}

{#-   Append IP addresses and aliases (if they are not already present) #}
{%-   for ip in (ip4 + ip6)|sort -%}
{%-     do names.append(ip) -%}
{%-     for alias in aliases_ips.get(ip, []) -%}
{%-       if alias not in names -%}
{%-         do names.append(alias) -%}
{%-       endif -%}
{%-     endfor -%}
{%-   endfor -%}

{#-   Write one line per key; join the names together #}
{%-   for line in keys.split('\n') -%}
{%-     if line -%}
{{        ','.join(names) }} {{ line }}
{%      endif -%}
{%-   endfor -%}
{%- endmacro -%}

{#- Pre-fetch pillar data #}
{%- set target = salt['pillar.get']('openssh:known_hosts:target', "*.{}".format(grains['domain'])) -%}
{%- set tgt_type = salt['pillar.get']('openssh:known_hosts:tgt_type', 'glob') -%}
{%- set keys_function = salt['pillar.get']('openssh:known_hosts:mine_keys_function', 'public_ssh_host_keys') -%}
{%- set hostname_function = salt['pillar.get']('openssh:known_hosts:mine_hostname_function', 'public_ssh_hostname') -%}
{%- set use_hostnames = salt['pillar.get']('openssh:known_hosts:hostnames', False) -%}
{%- set hostnames_target_default = '*' if grains['domain'] == '' else "*.{}".format(grains['domain']) -%}
{%- set hostnames_target = salt['pillar.get']('openssh:known_hosts:hostnames:target', hostnames_target_default) -%}
{%- set hostnames_tgt_type = salt['pillar.get']('openssh:known_hosts:hostnames:tgt_type', 'glob') -%}
{%- set include_localhost = salt['pillar.get']('openssh:known_hosts:include_localhost', False) -%}
{%- set omit_ip_address = salt['pillar.get']('openssh:known_hosts:omit_ip_address', []) -%}

{#- Lookup IP of all aliases so that when we have a matching IP, we inject the alias name
    in the SSH known_hosts entry -#}
{%- set aliases = salt['pillar.get']('openssh:known_hosts:aliases', []) -%}
{%- set aliases_ips = {} -%}
{%- for alias in aliases -%}
  {%- for ip in salt['dig.A'](alias) + salt['dig.AAAA'](alias) -%}
    {%- do aliases_ips.setdefault(ip, []).append(alias) -%}
  {%- endfor -%}
{%- endfor -%}

{#- Salt Mine #}
{%- set host_keys = salt['mine.get'](target, keys_function, tgt_type=tgt_type) -%}
{%- set host_names = salt['mine.get'](target, hostname_function, tgt_type=tgt_type) -%}

{#- Salt SSH (if any) #}
{%- for minion_id, minion_host_keys in salt['pillar.get'](
  'openssh:known_hosts:salt_ssh:public_ssh_host_keys',
  {}
).items() -%}
{%-   if salt["match.{}".format(tgt_type)](target, minion_id=minion_id) -%}
{%      do host_keys.update({minion_id: minion_host_keys}) %}
{%-   endif -%}
{%- endfor -%}
{%- for minion_id, minion_host_names in salt['pillar.get'](
  'openssh:known_hosts:salt_ssh:public_ssh_host_names',
  {}
).items() -%}
{%-   if salt["match.{}".format(tgt_type)](target, minion_id=minion_id) -%}
{%      do host_names.update({minion_id: minion_host_names}) %}
{%-   endif -%}
{%- endfor %}

{#- Static Pillar data #}
{%- do host_keys.update(salt['pillar.get']('openssh:known_hosts:static',
    {}).items()) -%}

{#- Loop over targetted minions -#}
{%- for host, keys in host_keys| dictsort -%}
{{ known_host_entry(host, host_names, keys, include_localhost, omit_ip_address) }}
{%- endfor -%}