[Bug]: `--ssh-identity` Flag in `dstack apply` is Ignored

[movchan74]

Steps to reproduce

1. Run the following command to apply a deployment using a custom SSH identity file:

   dstack apply -f app.dstack.yaml --ssh-identity ./id_rsa

2. Observe that instead of using the specified SSH identity file (./id_rsa), dstack defaults to the user’s key at:

   /home/aleksandr/.dstack/ssh/id_rsa
   

3. This occurs even though --ssh-identity was explicitly provided in the command.

Actual behaviour

• dstack apply ignores the --ssh-identity flag and continues using the default key at /home/aleksandr/.dstack/ssh/id_rsa.
• Repo configuration does not contain the correct path to the SSH identity file.
• This issue can be traced to repo_config, which does not correctly store the specified identity file.

Expected behaviour

• The --ssh-identity flag should override the default key and use the specified SSH key (./id_rsa).
• The correct SSH key should be passed to the run configuration, allowing for proper authentication.

dstack version

0.18.41

Server logs

Additional information

• My goal is to use my own SSH key so I can connect from any other server or user using:

  dstack attach <run_name> --ssh-identity ./id_rsa

• Since dstack apply does not set the correct SSH key, dstack attach does not work as expected when trying to connect from another server.

[jvstme]

@movchan74, --ssh-identity is part of the repo options.

Other repo options

$ dstack apply --help
...

Repo Options:
  -P, --repo REPO       The repo to use for the run. Can be a local path or a Git repo URL.
  --repo-branch REPO_BRANCH
                        The repo branch to use for the run
  --repo-hash REPO_HASH
                        The hash of the repo commit to use for the run
  --no-repo             Do not use any repo for the run
  -t, --token OAUTH_TOKEN
                        An authentication token to access a private Git repo
  --git-identity SSH_PRIVATE_KEY
                        The private SSH key path to access a private Git repo
  --ssh-identity SSH_PRIVATE_KEY
                        The private SSH key path for SSH tunneling
  --local               Do not use Git

Repo options are only respected if --repo is passed. They are a shorthand for initializing the repo without calling dstack init explicitly.

So to set the SSH key, you can do this:

$ dstack apply -f app.dstack.yaml --ssh-identity ./id_rsa --repo .

Or this, which is equivalent:

$ dstack init --ssh-identity ./id_rsa
$ dstack apply -f app.dstack.yaml 

[jvstme]

But I agree that the behavior described in the issue is counterintuitive. Here is what we could do to improve it:

• Prevent repo options from being ignored. Either:
  • show an error if any repo options are passed without --repo;
  • or assume --repo . if any repo options are passed.
• Consider making --ssh-identity a run option rather than a repo option, so that it is possible to override the key for a run without associating that key with the repo.

[movchan74]

@jvstme, thanks for the explanation. It is counterintuitive that the --ssh-identity option is tied to repo settings. The help text clearly indicates that it's for SSH tunneling, so having it only work when a repo is specified feels off.

As you mentioned, making --ssh-identity a run option would allow us to override the SSH key for a run without binding it to a repo. I fully support moving it to run options or, at the very least, updating the documentation to clarify its intended behavior.

Another point why it should be a run option. dstack attach also has --ssh-identity option, but it is definitely a run option.

[peterschmidt85]

@jvstme Do we have an update on it?

[jvstme]

@peterschmidt85, no. There is an explanation of how to achieve the desired behavior. The proposed UX improvements are in the backlog as part of this issue

[github-actions]

This issue is stale because it has been open for 30 days with no activity.

[un-def]

Fixed via #3023 in 0.19.26