Getting gitlab-runner 10.0.2 cloning repo using ssh

Question

I have a gitlab installation and I am trying to setup a gitlab-runner using a docker executor. All ok until tests start running and then since my projects are private and they have no http access enabled, they fail at clone time with:

Running with gitlab-runner 10.0.2 (a9a76a50)
  on Jupiter-docker (5f4ed288)
Using Docker executor with image fedora:26 ...
Using docker image sha256:1f082f05a7fc20f99a4ccffc0484f45e6227984940f2c57d8617187b44fd5c46 for predefined container...
Pulling docker image fedora:26 ...
Using docker image fedora:26 ID=sha256:b0b140824a486ccc0f7968f3c6ceb6982b4b77e82ef8b4faaf2806049fc266df for build container...
Running on runner-5f4ed288-project-5-concurrent-0 via 2705e39bc3d7...
Cloning repository...
Cloning into '/builds/pmatos/tob'...
remote: Git access over HTTP is not allowed
fatal: unable to access 'https://gitlab.linki.tools/pmatos/tob.git': The requested URL returned error: 403
ERROR: Job failed: exit code 1

I have looked into https://docs.gitlab.com/ee/ci/ssh_keys/README.html and decided to give it a try so my .gitlab-ci.yml starts with:

image: fedora:26

before_script:
  # Install ssh-agent if not already installed, it is required by Docker.
  # (change apt-get to yum if you use a CentOS-based image)
  - 'which ssh-agent || ( apt-get update -y && apt-get install openssh-client -y )'
  # Run ssh-agent (inside the build environment)
  - eval $(ssh-agent -s)
  # Add the SSH key stored in SSH_PRIVATE_KEY variable to the agent store
  - ssh-add <(echo "$SSH_PRIVATE_KEY")
  # For Docker builds disable host key checking. Be aware that by adding that
  # you are suspectible to man-in-the-middle attacks.
  # WARNING: Use this only with the Docker executor, if you use it with shell
  # you will overwrite your user's SSH config.
  - mkdir -p ~/.ssh
  - '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config'

... JOBS...

I setup the SSH_PRIVATE_KEY correctly, etc but the issue is that the cloning of the project happens before before_script. I then tried to start the container with -v /home/pmatos/gitlab-runner_ssh:/root/.ssh but still the cloning is trying to use HTTP. How can I force the container to clone through ssh?

Paulo Matos · Accepted Answer · 2018-04-13 12:34:20Z

1

Due to the way gitlab CI works, CI requires https access to the repository. Therefore if you enable CI, you need to have https repo access enabled as well.

This is however, not an issue privacy wise as making the container https accessible doesn't stop gitlab from checking if you're authorized to access it.

answered Apr 13, 2018 at 12:34

Paulo Matos

1,67418 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

VonC Over a year ago

OK, this seems more accurate than my answer. +1

VonC · Accepted Answer · 2017-10-13 20:49:35Z

0

I then tried to start the container with -v /home/pmatos/gitlab-runner_ssh:/root/.ssh but still the cloning is trying to use HTTP

Try at least if possible within your container to add a

git config --global url.ssh://[email protected] https://

(assuming the ssh user is git)

That would make any clone of any https URL use ssh.

answered Oct 13, 2017 at 20:49

VonC

1.4m569 gold badges4.8k silver badges5.7k bronze badges

1 Comment

Paulo Matos Over a year ago

That's not possible unfortunately because the container is created a new each time gitlab-runner starts a new pipeline build.

Collectives™ on Stack Overflow

Getting gitlab-runner 10.0.2 cloning repo using ssh

2 Answers 2

1 Comment

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related