hermes: preserve node SSH account ownership

services/hermes/node-ssh-access.yaml

@@ -55,10 +55,14 @@ spec:
                   home="/host-home/${user}"
                   [ -d "${home}" ] || continue
                   found=1
-                  install -d -m 0700 -o "$(stat -c %u "${home}")" -g "$(stat -c %g "${home}")" "${home}/.ssh"
+                  identity="$(awk -F: -v name="${user}" '$1 == name {print $3 ":" $4; exit}' /host-etc/passwd)"
+                  [ -n "${identity}" ] || identity="$(stat -c %u:%g "${home}")"
+                  uid="${identity%%:*}"
+                  gid="${identity##*:}"
+                  install -d -m 0700 -o "${uid}" -g "${gid}" "${home}/.ssh"
                   touch "${home}/.ssh/authorized_keys"
                   grep -qxF "${key}" "${home}/.ssh/authorized_keys" || printf '%s\n' "${key}" >> "${home}/.ssh/authorized_keys"
-                  chown "$(stat -c %u "${home}"):$(stat -c %g "${home}")" "${home}/.ssh/authorized_keys"
+                  chown "${uid}:${gid}" "${home}/.ssh/authorized_keys"
                   chmod 0600 "${home}/.ssh/authorized_keys"
                 done
                 [ "${found}" = 1 ] || { echo "no supported node SSH account found" >&2; return 1; }
@@ -77,6 +81,9 @@ spec:
           volumeMounts:
             - name: host-home
               mountPath: /host-home
+            - name: host-passwd
+              mountPath: /host-etc/passwd
+              readOnly: true
             - name: tmp
               mountPath: /tmp
           resources:
@@ -91,6 +98,10 @@ spec:
           hostPath:
             path: /home
             type: Directory
+        - name: host-passwd
+          hostPath:
+            path: /etc/passwd
+            type: File
         - name: tmp
           emptyDir:
             sizeLimit: 8Mi

testing/tests/test_hermes_cli_lanes.py

@@ -981,6 +981,12 @@ def test_owner_agent_has_pinned_dedicated_node_ssh_access():
     assert "cat /vault/secrets/node-ssh-public-key" in reconciler
     assert "grep -qxF" in reconciler
     assert "for user in atlas oceanus" in reconciler
+    assert "/host-etc/passwd" in reconciler
+    assert "chown \"${uid}:${gid}\"" in reconciler
+    host_passwd = next(
+        item for item in pod["volumes"] if item["name"] == "host-passwd"
+    )
+    assert host_passwd["hostPath"] == {"path": "/etc/passwd", "type": "File"}
 
 
 def test_owner_agent_tracks_no_ssh_identity_or_host_key_material():