jenkins添加拉取代码的证书

使用jenkins构建制品，拉取代码需要添加rsa私钥，步骤如下：

1. 生成证书

$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:qMunNGrr4mi8dKPpszw0hVMK90kvCYaSHxygt69Rumk root@april
The key's randomart image is:
+---[RSA 2048]----+
|.=..             |
|* *..            |
|++== +           |
| =.o= ..         |
|  + ... S        |
| o + .           |
|o.+o=            |
|==EO.o.          |
|=&%.+o           |
+----[SHA256]-----+
$ 
$ ls
authorized_keys  id_rsa  id_rsa.pub

其中id_rsa为私钥，id_rsa.pub为公钥

2. 布置公钥

将id_rsa.pub的内容放到gitlab/gitlab/gitee
然后就可以如下拉取代码了

$ git clone git@gitee.com:fromdtor/hello-world.git
Cloning into 'hello-world'...
Warning: Permanently added the ECDSA host key for IP address '154.213.2.253' to the list of known hosts.
remote: Enumerating objects: 3, done.
remote: Counting objects: 100% (3/3), done.
remote: Compressing objects: 100% (2/2), done.
remote: Total 3 (delta 0), reused 0 (delta 0), pack-reused 0
Receiving objects: 100% (3/3), done.

注意这一行，待会会用到

Warning: Permanently added the ECDSA host key for IP address '154.213.2.253' to the list of known hosts.

3. jenkins添加流水线

第一步：流水线定义使用 Pipeline script from SCM
然后选择git并填写仓库地址，填写完以后会报错如下图，因为没有证书

报错

第二步：添加证书

1
2
3
添加完以后依然会报错

jenkins stderr: No ECDSA host key is known for gitee.com and you have requested strict checking.

这是因为ssh连接陌生机器需要确认，将clone代码的机器上的known_hosts复制到运行jenkins服务账号的～/.ssh目录下即可

# ps aux | grep jenkins
root@april:~# ps aux | grep jenkins
jenkins  10106  0.1 25.4 2753696 498056 ?      Ssl  Aug14   7:31 /usr/bin/java -Djava.awt.headless=true -jar /usr/share/java/jenkins.war --webroot=/var/cache/jenkins/war --httpPort=8080
root     22337  0.0  0.0  14436  1100 pts/1    S+   10:08   0:00 grep --color=auto jenkins
root@april:~#
root@april:~#
root@april:~# cat /etc/passwd | grep jenkins
jenkins:x:112:121:Jenkins,,,:/var/lib/jenkins:/bin/bash
root@april:~#

以上命令可以看到运行jenkins服务的账号为jenkins，其home为/var/lib/jenkins

root@april:/var/lib/jenkins/.ssh# ls
known_hosts

已经复制过来，错误消失