Git clone on jenkins master，复制到slave

Question

我已经设置了一个运行 jenkins 的 CI 服务器和一个带有我们生产环境副本的从服务器。不过，我遇到了一个讨厌的小问题:Jenkins 显然在从服务器上运行 git clone，这意味着每个从服务器都应该将其公钥添加到 GitHub。

对我来说，这听起来像是一个非常奇怪的架构设计。 我希望主服务器(拥有我所有的凭据)clone/checkout 并将工作区复制到从服务器。但是经过相当长的一段时间谷歌搜索我还没有找到一种方法来做到这一点。我找到了 Copy to slave plugin但这并不能阻止从站在 git clone 上失败。

我希望有人知道实现此目的的方法，因为为每个从属设置 GitHub 公钥听起来很荒谬。

Answer 1

Jenkins apparently runs git clone on the slave which would mean that every slave should have it's publickey added to GitHub.

为什么不用一个 deployment key (供所有 Jenkins 代理使用)访问您的存储库？

A deploy key is an SSH key that is stored on the server and grants access to a single repository on GitHub.
This key is attached directly to the repository instead of to a user account.

Pros

• Anyone with access to the server has access to deploy the repository
• Users don't have to change their local SSH settings

Cons

• Deploy keys only grant access to a single repository, more complex projects may have many repositories to pull to the same server
• The key has full read/write access to the repository
• Deploy keys are usually not protected by a passphrase, making the key easily accessible if the server is compromised

---

另一种方法是使用 Credentials Jenkins plugin (在 February 2012 中初始化)，它允许在 Jenkins master 中存储凭据。

A single point for managing each credential. Change it in one place and you are done.

As of version 1.5, the plugin now supports categorizing credentials into different "domains" in order to allow plugins to restrict the choice of credentials to only those that are appropriate.

When a plugin is asking for a list of credentials, it can add some specifications about where and how the credential will be used.

凭证域配置示例: