Jenkinsfile with docker agent not able to load ssh key

user_16400139 0
Viewed 380

I have a simple pipeline:

pipeline {
    agent {
        docker {
            image 'python:3.8-alpine3.15'
        }
    }
...
steps {
       withCredentials([sshUserPrivateKey(credentialsId: "repo", keyFileVariable: 'keyfile')]){
             sh '''
             set +x
             eval `ssh-agent -s`
             ssh-add ${keyfile}
             git clone git@gitlab.com/blabla
             '''

      }
   }
}

The errored output is:

Masking supported pattern matches of $keyfile
Agent pid 53
+ ssh-add **** (blabla@blabla.com)
...
Host key verification failed.
fatal: Could not read from remote repository.

I have tried the same steps with the same key step by step on the same machine and it works, the problem resides on the withCredentials binding. It is not viable to change to ssh-agent plugin.

Does anybody know what is wrong and why I can't load the credentials succesfully?

jenkins-pipeline docker ssh-keys jenkins
1 Answers

After lots of debugging, what worked for me was:

  • SSH Agent implementation (plugin download required, not good)
pipeline {
    agent {
        docker {
            image 'python:3.8-alpine3.15'
        }
    }
...
steps {
       sshagent(credentials: ['repo']) {
             sh '''
             set +x
             mkdir ~/.ssh
             ssh-keyscan gitlab.com >> ~/.ssh/known_hosts
             git clone git@gitlab.com/blabla
             pip install -r requirements.txt
             '''
      }
   }
}

Finally I ended up using sshagent plugin, otherwise if you need to use withCredentials plugin you should consider:

  • Vanilla Implementation (no extra plugin download, good)
pipeline {
    agent {
        docker {
            image 'python:3.8-alpine3.15'
        }
    }
...
steps {
       withCredentials([sshUserPrivateKey(credentialsId: "repo", keyFileVariable: 'keyfile')]) {
             sh '''
             set +x
             mkdir ~/.ssh
             ssh-keyscan gitlab.com >> ~/.ssh/known_hosts
             eval `ssh-agent -s`
             ssh-add ${keyfile}
             git clone git@gitlab.com/blabla
             pip install -r requirements.txt
             '''
      }
   }
}

Personally I consider the implementation with withCredentials much more approachable because you do not depend on external plugin.

External references:

With those two implementations, you should not have any problem when passing ssh keys onto a pipeline which is ran inside a docker container.

Free software.

user_164001390
Related