Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-42582

ssh-agent not applied in kubernetes container

XMLWordPrintable

      the ssh-agent configuration isn't applied when pipeline is run on a docker container using the kubernetes plugin

       

      as an example, this pipeline works fine:

      sshagent in basic pipeline
      node {
    stage('Pre-Build') {
        sshagent (credentials: ['jenkins-master-ssh']) {
            sh 'ssh -vT -o "StrictHostKeyChecking=no" git@github.com'
        }
    }
}

      the job will fail, but the console output will clearly show the error from github 

      You've successfully authenticated, but GitHub does not provide shell access.

       

      whereas

      sshagent not applied in container 
      podTemplate(label: 'jenkpod', containers: [containerTemplate(name: 'golang', image: 'golang:1.8', ttyEnabled: true, command: 'cat')]) {
    node ('jenkpod') { container('golang') {

        stage('Pre-Build') {
            sshagent (credentials: ['jenkins-master-ssh']) {
                sh 'ssh -vT -o "StrictHostKeyChecking=no" git@github.com'
            }
        }

    } }
}

      fails with public key error:

      debug1: Authentications that can continue: publickey
      debug1: Next authentication method: publickey
      debug1: Trying private key: /root/.ssh/id_rsa
      debug1: Trying private key: /root/.ssh/id_dsa
      debug1: Trying private key: /root/.ssh/id_ecdsa
      debug1: Trying private key: /root/.ssh/id_ed25519
      debug1: No more authentication methods to try.
      Permission denied (publickey).

       

      this seems closely related to -JENKINS-32624 sshagent{} ignored when executed in docker.image().inside

       

        1. ConsoleOutput.txt
          8 kB

          [JENKINS-42582] ssh-agent not applied in kubernetes container

          J Knurek created issue -
          J Knurek made changes -
          Link New: This issue is related to JENKINS-32624 [ JENKINS-32624 ]

          J Knurek added a comment -

          one thing I saw in the logs, is that if `sshagent () {}` is the first command in the container (like the example above), the workspace isn't created yet

          [ssh-agent] Using credentials jenkins-master-ssh
[ssh-agent] Looking for ssh-agent implementation...
Executing shell script inside container [golang] of pod [kubernetes-6f33c7fc5ad644b]
Executing command: ssh-agent -k 
# cd "/home/jenkins/workspace/ssh-fail"
ssh-agent -k 
exit
/bin/sh: 1: cd: can't cd to /home/jenkins/workspace/ssh-fail
# SSH_AGENT_PID not set, cannot kill agent

          fixing that , the ssh-agent plugin still doesn't provide the key as expected

          J Knurek added a comment - one thing I saw in the logs, is that if `sshagent () {}` is the first command in the container (like the example above), the workspace isn't created yet [ssh-agent] Using credentials jenkins-master-ssh [ssh-agent] Looking for ssh-agent implementation... Executing shell script inside container [golang] of pod [kubernetes-6f33c7fc5ad644b] Executing command: ssh-agent -k # cd "/home/jenkins/workspace/ssh-fail" ssh-agent -k exit /bin/sh: 1: cd: can't cd to /home/jenkins/workspace/ssh-fail # SSH_AGENT_PID not set, cannot kill agent fixing that , the ssh-agent plugin still doesn't provide the key as expected
          J Knurek made changes -
          Link New: This issue is related to JENKINS-42851 [ JENKINS-42851 ]

          J Knurek added a comment -

          if env vars are not getting saved, it's possibly the same reason that the ssh-agent doesn't persist 

          J Knurek added a comment - if env vars are not getting saved, it's possibly the same reason that the ssh-agent doesn't persist 
          J Knurek made changes -
          Link New: This issue is related to JENKINS-40647 [ JENKINS-40647 ]

          David Schile added a comment -

          csanchez, Any progress or info on this?  Perhaps I can help with this one.  git ssh also seems to fail the same way.  

          David Schile added a comment - csanchez , Any progress or info on this?  Perhaps I can help with this one.  git ssh also seems to fail the same way.  

          Claes Buckwalter added a comment -

          We hit this last week. When we do "sh 'sudo ps aux'" in the container, we notice that there is an ssh-agent process running. Our theory, which we have not verified, is that if we set the environment variable SSH_AUTH_SOCK to the agent's socket file, it will work.

          Claes Buckwalter added a comment - We hit this last week. When we do "sh 'sudo ps aux'" in the container, we notice that there is an ssh-agent process running. Our theory, which we have not verified, is that if we set the environment variable SSH_AUTH_SOCK to the agent's socket file, it will work.

          Alexander Tolstikov added a comment - - edited

          If you will check available env variables with "printenv" - you will see that SSH_AUTH_SOCK variable is not set as well as other Jenkins env variables, and I believe this is the issue, but I don't know if this is a bug or feature of PodTemplate design.

          Our theory, which we have not verified, is that if we set the environment variable SSH_AUTH_SOCK to the agent's socket file, it will work.
          I can confirm it works.

          Alexander Tolstikov added a comment - - edited If you will check available env variables with "printenv" - you will see that SSH_AUTH_SOCK variable is not set as well as other Jenkins env variables, and I believe this is the issue, but I don't know if this is a bug or feature of PodTemplate design. Our theory, which we have not verified, is that if we set the environment variable SSH_AUTH_SOCK to the agent's socket file, it will work. I can confirm it works.

          Carlos Sanchez added a comment -

          I guess the container step needs to access the enclosing node environment and populate from there
          some possibly related comments
          https://github.com/jenkinsci/kubernetes-plugin/pull/204#issuecomment-324023861

          Carlos Sanchez added a comment - I guess the container step needs to access the enclosing node environment and populate from there some possibly related comments https://github.com/jenkinsci/kubernetes-plugin/pull/204#issuecomment-324023861

            seakip18 Matthew Ludlum
            jknurek J Knurek
            Votes:
            6 Vote for this issue
            Watchers:
            23 Start watching this issue

              Created:
              Updated:
              Resolved: