I have a Jenkins instance set up in a Kubernetes cluster. This instance is running parallel to a hashicorp vault used for Jenkins Config as Code (JCasC). The hashicorp vault contains a path of a kv2 engine, which holds a value for an ssh key.
When we deploy jenkins, we fetch the ssh key value and set it as a credential via the credentials plugin. We then use this in the scm to create a multibranch pipeline.
My issue is this: When running the scan, the scm tries to use the ssh key to scan the remote repository. However, this is failing with the following error:
stderr: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: UNPROTECTED PRIVATE KEY FILE! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions for '/var/jenkins_home/caches/gitabc123/jenkins-git-abc123.key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
I've tried shelling into the pod running jenkins to chmod this directory, but this doesn't work (at least in kubernetes, I don't think I have the permissions to chmod). The second problem, is that these key are only generated to connect, where new key files are generated on each attempt.
It seems the credentials plugin isn't setting the permissions correctly. Any ideas on how to fix this? Is there some configuration required in the credentials plugin? My second guess is that we need to store this ssh key in a different format. However, I also tried to manually insert this key in jenkins, and I am getting the same error.