Added Passwordless SSH access
Details
| Detail name | Value |
|---|---|
| Changelog Number | 27976 |
| Type | Improvement |
| Status | Open |
Background
Commands c4 host play and c4 update cluster connect to the cluster nodes over SSH using the key in CCC_HOST_KEY_PAIR_FILE. Previously it did not check whether that key was passphrase-protected. If it was, and the key wasn't available through a running ssh-agent, the run could behave inconsistently depending on terminal and agent state — stalling on an interactive passphrase prompt or failing partway through with unclear errors, and reaching only some nodes.
Improvement
c4 host play and c4 update cluster now detect up front whether the SSH key is passphrase-protected:
- An unencrypted key is used directly, as before.
- A passphrase-protected key must already be loaded in a running ssh-agent. c4 uses the agent for authentication and never sees or stores the passphrase itself. If the key is not loaded in an agent, the install/update stops immediately with a clear, actionable error: Key '<keyfile>' is passphrase-protected but is not loaded in an ssh-agent. Add it first: ssh-add <keyfile>.
c4 also now always passes IdentitiesOnly=yes with the configured key, so only that key is offered.
Changed behavior
If you use a passphrase-protected SSH key, you must load it into a running ssh-agent (ssh-add <keyfile>) before running install/update. A passphrase-protected key that is not in an agent now causes "c4 host play" and "c4 update cluster" to abort immediately with an explicit error, rather than proceeding. c4 will not prompt for the passphrase. This especially affects non-interactive / CI / automation runs: ensure the key is either unencrypted or pre-loaded into an ssh-agent, otherwise the run will fail at startup.
