Offer only the deployment key when ssh-ing to instances

Net::SSH fills in identity sources the caller does not name: every
IdentityFile from ~/.ssh/config, which it tries ahead of :key_data, and
every identity held by a reachable ssh-agent. On a workstation with a
'Host *' block or a loaded agent that is enough extra identities to
exhaust the target sshd's MaxAuthTries, so the server disconnects and
the example dies with 'Too many authentication failures'.

Pin the identity set to the key BATs was given. :keys_only on its own
does not do it: it filters agent identities but leaves the ones the
config file contributed, so :keys has to be cleared as well. Parsing of
~/.ssh/config stays on, so directives such as ProxyJump and Port keep
working.

Author: wayne

lib/bat/bosh_helper.rb

@@ -63,6 +63,16 @@ def ssh(host, user, command, options = {})
       raise 'Need to set ssh :private_key' if options[:private_key].nil?
       ssh_options[:key_data] = [options[:private_key]]
 
+      # Offer the deployment's key and nothing else. Net::SSH otherwise adds
+      # every IdentityFile from ~/.ssh/config, which it tries before :key_data,
+      # plus every identity loaded in the ssh-agent. Enough extra identities
+      # exhaust the target sshd's MaxAuthTries and it disconnects the example
+      # with "Too many authentication failures". :keys_only alone is not
+      # enough: it filters agent identities but not the config file's.
+      ssh_options[:keys] = []
+      ssh_options[:keys_only] = true
+      ssh_options[:use_agent] = false
+
       @logger.info("--> ssh options: #{ssh_options.inspect}")
 
       if options[:gateway_host] && options[:gateway_username]

spec/bat/bosh_helper_spec.rb

@@ -49,6 +49,20 @@
     end
   end
 
+  describe '#ssh' do
+    it 'offers the given private key and no other identity' do
+      captured = nil
+      allow(Net::SSH).to receive(:start) { |_host, _user, options| captured = options }
+
+      bosh_helper.ssh('10.0.0.1', 'vcap', 'echo hello', private_key: 'private')
+
+      expect(captured[:key_data]).to eq(['private'])
+      expect(captured[:keys]).to eq([])
+      expect(captured[:keys_only]).to be(true)
+      expect(captured[:use_agent]).to be(false)
+    end
+  end
+
   describe 'persistent_disk' do
     let(:job_name) { 'some-job' }
     let(:job_index) { 'some-index' }