git - 运行 `git clone` 时，`ansible-galaxy install -r requirements.yml` 在私有(private) git 仓库中的角色失败

Question

我已经在我的私有(private)项目中添加了一个 .gitlab-ci.yml。其中一个步骤是从私有(private) gitlab 存储库中获取角色。然而，这失败了

/usr/bin/git clone ssh://git@gitlab.com/papanito/ansible-role-bootstrap.git
papanito.bootstrap failed in directory /root/.ansible/tmp/ansible-
local-1036kia7b4eu/tmpjcyiks12 (rc=128)
ERROR! - you can use --ignore-errors to skip failed roles and finish processing the list.
ERROR: Job failed: exit code 1

在我的机器上运行相同的命令 ansible-galaxy install -r requirements.yml 运行正常。

我在运行命令之前为 ci 用户添加了私钥。所以不确定我还想念什么。

.gitlab-ci.yml

variables:
  SITE: "site.yml"
  PLAYBOOKS: "playbooks/*.yml"

stages:
  - verify

before_script:
  - whoami
  - apt-get update -qy #update system
  - mkdir ~/.ssh
  - chmod 700 ~/.ssh
  - echo $SSHKEY_GITLAB > ~/.ssh/id_rsa # https://docs.gitlab.com/ee/ci/ssh_keys
  - chmod 640 ~/.ssh/id_rsa
  - apt-get install ansible ansible-lint -qy
  - git submodule update --init
  - ansible --version
  - ansible-lint --version
  - git config -l
  - ansible-galaxy install -r requirements.yml

ansible-verify:
  stage: verify
  script:
    - ansible-lint -v $SITE
    - ansible-lint -v $PLAYBOOKS
    - ansible-playbook --syntax-check $SITE
    - ansible-playbook --syntax-check $PLAYBOOKS

requirements.yml

- src: geerlingguy.docker
- src: dev-sec.ssh-hardening
- src: m4rcu5nl.zerotier-one

# own roles
- src: https://git@github.com/papanito/ansible-role-rsyslog.git
  name: papanito.rsyslog
  scm: git
  version: master
- src: git+ssh://git@gitlab.com/papanito/ansible-role-bootstrap.git
  name: papanito.bootstrap
  scm: git
  version: master

日志

$ ansible-galaxy install -r requirements.yml
- downloading role 'docker', owned by geerlingguy
- downloading role from https://github.com/geerlingguy/ansible-role-docker/archive/2.8.1.tar.gz
- extracting geerlingguy.docker to /root/.ansible/roles/geerlingguy.docker
- geerlingguy.docker (2.8.1) was installed successfully
- downloading role 'ssh-hardening', owned by dev-sec
- downloading role from https://github.com/dev-sec/ansible-ssh-hardening/archive/9.3.0.tar.gz
- extracting dev-sec.ssh-hardening to /root/.ansible/roles/dev-sec.ssh-hardening
- dev-sec.ssh-hardening (9.3.0) was installed successfully
- downloading role 'zerotier-one', owned by m4rcu5nl
- downloading role from https://github.com/m4rcu5nl/ansible-role-zerotier/archive/v1.2.3.tar.gz
- extracting m4rcu5nl.zerotier-one to /root/.ansible/roles/m4rcu5nl.zerotier-one
- m4rcu5nl.zerotier-one (v1.2.3) was installed successfully
- extracting papanito.rsyslog to /root/.ansible/roles/papanito.rsyslog
- papanito.rsyslog (master) was installed successfully
 [WARNING] Ansible is being run in a world writable directory (/builds/papanito/infrastructure), ignoring it as an ansible.cfg source. For more information see https://docs.ansible.com/ansible/devel/reference_appendices/config.html#cfg-in-world-writable-dir
 [WARNING]: - papanito.bootstrap was NOT installed successfully: - command
/usr/bin/git clone ssh://git@gitlab.com/papanito/ansible-role-bootstrap.git
papanito.bootstrap failed in directory /root/.ansible/tmp/ansible-
local-1036kia7b4eu/tmpjcyiks12 (rc=128)
ERROR! - you can use --ignore-errors to skip failed roles and finish processing the list.
ERROR: Job failed: exit code 1

Answer 1

Running the same command ansible-galaxy install -r requirements.yml on my machine runs fine.

这意味着您在计算机上的 ~/.ssh/id_rsa 中拥有正确的公钥/私钥，并且您正在使用您的帐户在本地执行它。

如果您在 GitLab 步骤中复制它，请确保检查权限，并可能检查密码和已知主机，as in here或在 the documentation :

  # Paste the PRIVATE key into a gitlab variable. Pay attention to the linebreak at the end when pasting
  - mkdir -p ~/.ssh
  - chmod 700 ~/.ssh
  - echo "$DEPLOY_SERVER_PRIVATE_KEY" | tr -d '\r' > ~/.ssh/id_rsa
  - chmod 600 ~/.ssh/id_rsa
  - eval "$(ssh-agent -s)"
  - ssh-add ~/.ssh/id_rsa
  - ssh-keyscan -H 'your.server.hostname' >> ~/.ssh/known_hosts