如何通过SSH为Gitlab运行器启用克隆？

2 回答

• 2

  根据：

  https://docs.gitlab.com/ee/ci/ssh_keys/README.html

  你需要：

  • 使用ssh-keygen创建新的SSH密钥对

  • 将私钥作为秘密变量添加到项目中

  • 在作业期间运行ssh-agent以加载私钥 .

  示例gitlab_ci.yml：

  before_script:
    # Install ssh-agent if not already installed, it is required by Docker.
    # (change apt-get to yum if you use a CentOS-based image)
    - 'which ssh-agent || ( apt-get update -y && apt-get install openssh-client -y )'
  
    # Run ssh-agent (inside the build environment)
    - eval $(ssh-agent -s)
  
    # Add the SSH key stored in SSH_PRIVATE_KEY variable to the agent store
    - ssh-add <(echo "$SSH_PRIVATE_KEY")
  
    # For Docker builds disable host key checking. Be aware that by adding that
    # you are suspectible to man-in-the-middle attacks.
    # WARNING: Use this only with the Docker executor, if you use it with shell
    # you will overwrite your user's SSH config.
    - mkdir -p ~/.ssh
    - '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config'
    # In order to properly check the server's host key, assuming you created the
    # SSH_SERVER_HOSTKEYS variable previously, uncomment the following two lines
    # instead.
    # - mkdir -p ~/.ssh
    # - '[[ -f /.dockerenv ]] && echo "$SSH_SERVER_HOSTKEYS" > ~/.ssh/known_hosts'
  

  回复于 2024-04-19T18:10:41+08:00
• 3

  作为gitlab的新手，我发现了一种内置的方法来更改默认的克隆过程（尽管here is a recent comment about how it can be done） .

  通过disabling the automatic cloning process，您可以通过在 before_script 中编写自己的克隆过程来完全有效地覆盖其行为 . 仅出于示例的目的，下面显示了如何为HTTP克隆实现此目的，但可以适用于 ssh 克隆（if you're trying to use HTTP cloning you should use the built-in cloning process and the config.toml）：

  • 创建一个名为“gitlab-runner”的新用户并生成他们的用户身份验证令牌供以后使用（或者在您的情况下，您将生成ssh密钥） .

  • 通过在项目或组设置中添加以下变量来禁用跑步者的克隆过程： .../settings/ci_cd

  key：GIT_STRATEGY

  Value ：无

  • 在 before_script 中克隆您的仓库，例如：

  before_script:
    ## clean the working directory
    - BUILD_DIR=/home/gitlab-runner/builds/$RUNNER_TOKEN/0
    - CLONE_DIR="$BUILD_DIR/$CI_PROJECT_PATH"
    - cd $BUILD_DIR
    - rm -rf $CLONE_DIR
    - mkdir -p $CLONE_DIR
  
    ## clone the project each time (inefficient, consider performing fetch instead if it already exists)
    - git clone http://gitlab-runner:$GITLABRUNNER_USER_AUTH_TOKEN@server:8888/${CI_PROJECT_PATH}.git $CLONE_DIR
    - cd $CLONE_DIR
  

  注意：以下是我在步骤2中配置的相关变量，而不是在脚本中对它们进行硬编码：

  • RUNNER_TOKEN ："Runner Token"在您尝试运行的特定运动员的Admin "Runners"菜单中列出的值 .

  • GITLABRUNNER_USER_AUTH_TOKEN ：这是您在步骤1中生成的身份验证令牌 .

  回复于 2024-04-19T18:10:41+08:00