#!/usr/bin/env bash set -euo pipefail WGET() { wget --retry-connrefused -t 15 --waitretry=10 --header='Metadata-Flavor: Google' "$@" } # When dealing with cryptographic keys, we want to keep things private. umask 077 mkdir -p /root/.ssh echo "Fetching authorized keys..." WGET -O /tmp/auth_keys http://metadata.google.internal/computeMetadata/v1/instance/attributes/sshKeys # Read keys one by one, split in case Google decided # to append metadata (it does sometimes) and add to # authorized_keys if not already present. touch /root/.ssh/authorized_keys while IFS='' read -r line || [[ -n "$line" ]]; do keyLine=$(echo -n "$line" | cut -d ':' -f2) IFS=' ' read -r -a array <<<"$keyLine" if [[ ${#array[@]} -ge 3 ]]; then echo "${array[@]:0:3}" >>/tmp/new_keys echo "Added ${array[*]:2} to authorized_keys" fi done