DevOps portal — Virtual machines

Virtual machines → Request VM gets your team a VM, built by the automation from the standard template for its operating system.

Requesting a VM

Field	Notes
Owning team	The team the VM belongs to
Purpose	Lowercase letters and digits (stockapp). The form shows the name it will get, srv-…
Environment	dev, qa or prod
Size	Small: 2 vCPU, 4 GB, 40 GB disk. Medium: 4 vCPU, 8 GB, 60 GB. Large: 8 vCPU, 16 GB, 120 GB
Operating system	The templates on offer, Linux and Windows
SSH keys (Linux, optional)	Public keys for the ops login, one per line. See SSH keys

The preview shows the approvals it needs.

	dev, qa	prod
New VM, resize	A team owner	A team owner, then platform
Decommission	A team owner	A team owner, then platform

The team owner step is skipped when you're an owner yourself. Platform approves VMs in the portal, not GitLab.

Once approved the VM is built; the change finishes when it's running. Disks only grow: a resize can make a disk bigger, never smaller.

In the drawer: start, shut down and reboot (developers outside prod, owners in prod), Change VM to resize, and Decommission. A decommissioned VM is stopped and destroyed after a grace period (7 days); until then you can Restore it.

Connecting

The VM's Connect tab has its hostname, IP address and the command to use. Connect over the VPN. Production access is time-limited: Request access on the Connect tab, and another owner of the team approves it.

LinuxWindows

One login, ops, signs in with an SSH key. There's no password.

ssh ops@<vm hostname>

ops has passwordless sudo.

Remote desktop as the built-in Administrator:

mstsc /v:<vm hostname>

Reveal the password on the Connect tab (developers outside prod, owners in prod; it asks for your second factor). Every reveal is logged. It's also in 1Password, vault PIG-Infra-VM-Admin, item <vm> admin.

SSH keys

Linux VMs take OpenSSH public keys (the .pub file) for the ops login:

• ssh-ed25519, ecdsa-sha2-nistp256/384/521, security keys (sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com) and ssh-rsa.
• One key per line, no options in front of the key. A comment at the end is fine.
• Up to 20 keys per VM through the portal.

Paste them in the SSH keys box when you request the VM, or later with Change SSH keys in the VM's drawer. That lists the keys added through the portal by name, type, comment and fingerprint (never the key itself): tick Remove on the ones to take off, paste new ones under Add keys. Keys set by platform aren't listed or changed.

Every key is root

ops has passwordless sudo, so anyone whose key is on the VM has root on it. That's why key changes need approval: in prod, another team owner (even if you are one) and then platform; in dev and qa, a team owner as for a resize.

Once the change is done, the automation applies the keys to the VM within a few minutes. A stopped VM gets them after it's started and the automation has configured it.

The old way in, short-lived SSH certificates from step-ca, is gone: use SSH keys.