ssh - 使用 ssh 获取 gitlab-runner 10.0.2 克隆存储库

Question

我安装了 gitlab，并且正在尝试使用 docker 执行器设置 gitlab-runner。一切正常，直到测试开始运行，然后由于我的项目是私有(private)的并且它们没有启用 http 访问，因此它们在克隆时失败:

Running with gitlab-runner 10.0.2 (a9a76a50)
  on Jupiter-docker (5f4ed288)
Using Docker executor with image fedora:26 ...
Using docker image sha256:1f082f05a7fc20f99a4ccffc0484f45e6227984940f2c57d8617187b44fd5c46 for predefined container...
Pulling docker image fedora:26 ...
Using docker image fedora:26 ID=sha256:b0b140824a486ccc0f7968f3c6ceb6982b4b77e82ef8b4faaf2806049fc266df for build container...
Running on runner-5f4ed288-project-5-concurrent-0 via 2705e39bc3d7...
Cloning repository...
Cloning into '/builds/pmatos/tob'...
remote: Git access over HTTP is not allowed
fatal: unable to access 'https://gitlab.linki.tools/pmatos/tob.git': The requested URL returned error: 403
ERROR: Job failed: exit code 1

我调查过https://docs.gitlab.com/ee/ci/ssh_keys/README.html并决定尝试一下，所以我的 .gitlab-ci.yml 开头为:

image: fedora:26

before_script:
  # Install ssh-agent if not already installed, it is required by Docker.
  # (change apt-get to yum if you use a CentOS-based image)
  - 'which ssh-agent || ( apt-get update -y && apt-get install openssh-client -y )'
  # Run ssh-agent (inside the build environment)
  - eval $(ssh-agent -s)
  # Add the SSH key stored in SSH_PRIVATE_KEY variable to the agent store
  - ssh-add <(echo "$SSH_PRIVATE_KEY")
  # For Docker builds disable host key checking. Be aware that by adding that
  # you are suspectible to man-in-the-middle attacks.
  # WARNING: Use this only with the Docker executor, if you use it with shell
  # you will overwrite your user's SSH config.
  - mkdir -p ~/.ssh
  - '[[ -f /.dockerenv ]] && echo -e "Host *\n\tStrictHostKeyChecking no\n\n" > ~/.ssh/config'

... JOBS...

我正确设置了 SSH_PRIVATE_KEY 等，但问题是项目的克隆发生在 before_script 之前。然后，我尝试使用 -v/home/pmatos/gitlab-runner_ssh:/root/.ssh 启动容器，但克隆仍然尝试使用 HTTP。如何强制容器通过 ssh 克隆？

Answer 1

由于 gitlab CI 的工作方式，CI 需要 https 访问存储库。因此，如果启用 CI，则还需要启用 https 存储库访问。

然而，这不是一个隐私问题，因为使容器 https 可访问并不会阻止 gitlab 检查您是否有权访问它。