4

I have the following jenkinsfile

pipeline {
    agent {
        dockerfile {
            args "-u root -v /var/run/docker.sock:/var/run/docker.sock"
        }
    }
    environment {
        ESXI_CREDS = credentials('ESXI_CREDS')
        PACKER_LOG = 1
    }
    stages {
        stage('Build Base image') {
            steps {
               sh "ansible-galaxy install -r ./requirements.yml"
        }
    }
}

reference.yml

- src:     
  ssh://tfsserver/_git/ansible-sshd
  scm: git
  name: ansible-sshd

Which uses the following Dockerfile

FROM hashicorp/packer:full

RUN apk --no-cache add git openssh-client rsync jq py2-pip py-boto py2-six py2-cryptography py2-bcrypt py2-asn1crypto py2-jsonschema py2-pynacl py2-asn1 py2-markupsafe py2-paramiko py2-dateutil py2-docutils py2-futures py2-rsa py2-libxml2 libxml2 libxslt && \
    apk --no-cache add gcc python2-dev musl-dev linux-headers libxml2-dev libxslt-dev && \
    pip install ansible jsonmerge awscli boto3 hvac ansible-modules-hashivault molecule python-gilt python-jenkins lxml openshift docker docker-compose mitogen yamale ansible-lint && \
    apk del gcc python2-dev musl-dev linux-headers libxml2-dev libxslt-dev

USER root

ENTRYPOINT []

When running the jensfile build above it appears get stuck on authentication with our tfs server and get the following error

+ ansible-galaxy install -r ./requirements.yml
[WARNING]: - ansible-sshd was NOT installed successfully: - command
/usr/bin/git clone
ssh://tfsserver/_git/ansible-sshdtmp5VN20Z (rc=128)
ERROR! - you can use --ignore-errors to skip failed roles and finish processing the list.

I am using git with tfs and I don't know how i can authenticate the agent with the git repo, also don't really want have to store the private key on the build agent and volume map it to the docker container not even sure if that would work I have even tried dynamicaly adding the private key to the container during build but it does not appear to work

 withCredentials([sshUserPrivateKey(credentialsId: 'tfs', keyFileVariable: 'keyfile')]) {
   sh "mkdir -p ~/.ssh && cp ${keyfile} ~/.ssh/id_rsa"
   sh "ansible-galaxy install -r ./requirements.yml"
 }
Madu Alikor
  • 2,544
  • 4
  • 21
  • 36

1 Answers1

0

I had the same problem but ended up solving using sed.

withCredentials([usernamePassword(credentialsId: 'GIT_AUTHENTICATION', passwordVariable: 'password', usernameVariable: 'username')])
{
    sh "sed -i 's/${git_url}/${username}:${password}@${git_url}/g' roles/requirements.yml"
    sh "ansible-galaxy install -c -r roles/requirements.yml -p roles/"
    sh "ansible-playbook site.yml -i ${inventory}"
}

Most remote repositories allow url authentication or oAuth tokens url, both work the same way:

{protocol}://${username}:${password}@{gitl_url}/${repo}

example:

https://username:password@github.com/username/repository.git

If your password has special characters use https://www.urlencoder.org/ and remember just use it with withCredentials, so that it obfuscates sensitive data.

Jroger
  • 259
  • 3
  • 17