英文:
Jenkins SSH Agent in Kubernetes cannot SSH to Kubernetes master node - Host key verification failed - Using SSH Agent Plugin
问题
背景
我已经成功在Kubernetes集群内运行了Jenkins,并且它也连接到集群以创建部署。
我正在尝试使用SSH Agent插件来部署某些内容。我理解我需要使用它来SSH到运行集群主节点的实际机器,然后可以使用以下命令执行部署:
kubectl create -f deployment.yaml
到目前为止的进展
我已经安装了SSH Agent插件并在Jenkins中存储了SSH私钥。
我还将相应的公钥放在了集群主节点的/home/pi/.ssh文件夹和authorized_keys文件中。
我能够从另一台机器成功进行SSH连接。
问题
当执行Pipeline时,它显示正在将SSH密钥添加到slave SSH Agent pod中。
[ssh-agent] Using credentials pi (SSH credentials for the master node.)
[ssh-agent] Looking for ssh-agent implementation...
[ssh-agent] Exec ssh-agent (binary ssh-agent on a remote machine)
...
Running ssh-add (command line suppressed)
Identity added: /home/jenkins/agent/workspace/Deployment@tmp/private_key_123123123123132.key (pi@pi1)
[ssh-agent] Started.
但是当我尝试从Jenkins slave(SSH Agent)进行SSH连接时,它显示密钥无法验证。
+ ssh pi@10.0.0.125 id
Host key verification failed.
请求
有人可以告诉我如何解决这个问题吗?我做错了什么?
附加细节
我正在使用如下简化的Pipeline进行测试:
// 启动Pipeline
pipeline {
// 定义它将在哪个代理上运行
agent {
// kubernetes = Jenkins中的Kubernetes云
kubernetes{
}
}
// 开始声明Pipeline的阶段
stages {
// 阶段#3 - 使用SSH代理将图像部署到生产Kubernetes集群
stage('Deploy to Kubernetes Cluster'){
steps {
sshagent(['RPi-SSH']) {
script {
sh 'id'
sh 'ssh pi@10.0.0.125 id'
sh 'ssh pi@10.0.0.125 ls'
}
}
}
}
}
}
通过这个Pipeline,我可以看到第一个id
是SSH Agent节点中jenkins
的ID。当它尝试SSH连接到主节点时,它就会失败。
英文:
Background
I have managed to run Jenkins inside a Kubernetes cluster. It is also connected to the cluster to create deployments.
I am trying to deploy something using the SSH Agent Plugin. My understanding is that I need it to SSH into the actual machine running the master node of the cluster, and then I can execute the deployment with the command:
kubectl create -f deployment.yaml
Progress so far
I have installed the SSH Agent plugin and stored the SSH Private Key in Jenkins.
I've also put the appropriate Public Key in the cluster's master node's /home/pi/.ssh folder and authorized_keys file.
I am able to SSH from another machine successfully to it.
Problem
When the Pipeline is executed, it says that it is adding the SSH-Key to the slave SSH Agent pod.
[ssh-agent] Using credentials pi (SSH credentials for the master node.)
[ssh-agent] Looking for ssh-agent implementation...
[ssh-agent] Exec ssh-agent (binary ssh-agent on a remote machine)
...
Running ssh-add (command line suppressed)
Identity added: /home/jenkins/agent/workspace/Deployment@tmp/private_key_123123123123132.key (pi@pi1)
[ssh-agent] Started.
But when I try to SSH from the Jenkins slave (SSH Agent), it says that the key cannot be verified.
+ ssh pi@10.0.0.125 id
Host key verification failed.
Request
Could anybody point me how to fix this issue? What am I doing wrong?
Additional Details
I am testing with a slimmed down pipeline like this:
// Start the Pipeline
pipeline {
// Define the agent where it will run
agent {
// kubernetes = kubernetes cloud in Jenkins
kubernetes{
}
}
// Start declaring the stages of the pipeline
stages {
// Stage #3 - Deploy the image to the production kubernetes cluster using an SSH agent
stage('Deploy to Kubernetes Cluster'){
steps {
sshagent(['RPi-SSH']) {
script {
sh 'id'
sh 'ssh pi@10.0.0.125 id'
sh 'ssh pi@10.0.0.125 ls'
}
}
}
}
}
}
With this pipeline, I can see that first id is the id of 'jenkins' in the SSH Agent node.
When it tries to SSH to the master node, it just fails.
答案1
得分: 0
可能你尝试连接的主机不在你的known_hosts
文件中。理想情况下,它们应该在其中,但实际上没有人会费心去做,只需在第一次连接时通过将以下开关添加到你的ssh
命令来添加它们:
ssh -oStrictHostKeyChecking=accept-new pi@10.0.0.125 id
你可能会看到建议将StrictHostKeyChecking
设置为no
。在这种情况下,可能并不重要,因为我们正在处理瞬态容器,它们的known_hosts
文件在流水线完成后将会消失,但一旦你在其他地方使用它,其他开发人员可能会复制粘贴这个到可能重要的其他上下文中,所以...就这样。
英文:
Probably the hosts you are trying to connect to are not in your known_hosts
file. Ideally they should be, but in reality nobody bothers with that, just add them the first time you connect by adding this switch to your ssh
command:
ssh -oStrictHostKeyChecking=accept-new pi@10.0.0.125 id
You will find recommendations to set StrictHostKeyChecking
to no
. It probably doesn't matter in this context, since we are dealing with transient containers and their known_hosts
files will disappear once the pipeline is done, but once you use it once other developers will just copy paste this to other contexts where it might matter, so... there you go.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论