0

I a running Jenkins in an docker container. When spinning off a node in another docker container I receive the message:

[11/18/16 20:46:21] [SSH] Opening SSH connection to 192.168.99.100:32826.
ERROR: Server rejected the 1 private key(s) for Jenkins (credentialId:528bbe19-eb26-4c9f-bae3-82cd1247d50a/method:publickey)
[11/18/16 20:46:22] [SSH] Authentication failed.
hudson.AbortException: Authentication failed.
    at hudson.plugins.sshslaves.SSHLauncher.openConnection(SSHLauncher.java:1217)
    at hudson.plugins.sshslaves.SSHLauncher$2.call(SSHLauncher.java:711)
    at hudson.plugins.sshslaves.SSHLauncher$2.call(SSHLauncher.java:706)
    at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at java.lang.Thread.run(Thread.java:745)
[11/18/16 20:46:22] Launch failed - cleaning up connection
[11/18/16 20:46:22] [SSH] Connection closed.

Using the docker exec -i -t slave_name /bin/bash command I am able to get into the home/jenkins/.ssh directory to confirm the ssh key is where it is expected to be.

Under the CLOUD headnig on my configure page the Test Connection returns

Version = 1.12.3, API Version = 1.24

.

I am running OSX Sierra and attempting to follow the RIOT Games Jenkins-Docker tutorial http://engineering.riotgames.com/news/building-jenkins-inside-ephemeral-docker-container.

Jenkins Master Docker file:

FROM debian:jessie

# Create the jenkins user
RUN useradd -d "/var/jenkins_home" -u 1000 -m -s /bin/bash jenkins

# Create the folders and volume mount points
RUN mkdir -p /var/log/jenkins
RUN chown -R jenkins:jenkins /var/log/jenkins
VOLUME ["/var/log/jenkins", "/var/jenkins_home"]

USER jenkins
CMD ["echo", "Data container for Jenkins"]

Jenkins Slave Dockerfile

FROM centos:7

# Install Essentials
RUN yum update -y && yum clean all

# Install Packages
RUN yum install -y git \
    && yum install -y wget \
    && yum install -y openssh-server \
    && yum install -y java-1.8.0-openjdk \
    && yum install -y sudo \
    && yum clean all

# gen dummy keys, centos doesn't autogen them.
RUN /usr/bin/ssh-keygen -A

# Set SSH Configuration to allow remote logins without /proc write access
RUN sed -ri 's/^session\s+required\s+pam_loginuid.so$/session optional \
    pam_loginuid.so/' /etc/pam.d/sshd

# Create Jenkins User
RUN useradd jenkins -m -s /bin/bash

# Add public key for Jenkins login
RUN mkdir /home/jenkins/.ssh
COPY /files/authorized_keys /home/jenkins/.ssh/authorized_keys
RUN chown -R jenkins /home/jenkins
RUN chgrp -R jenkins /home/jenkins
RUN chmod 600 /home/jenkins/.ssh/authorized_keys
RUN chmod 700 /home/jenkins/.ssh

# Add the jenkins user to sudoers
RUN echo "jenkins  ALL=(ALL)  ALL" >> etc/sudoers

# Set Name Servers to avoid Docker containers struggling to route or resolve DNS names.
COPY /files/resolv.conf /etc/resolv.conf

# Expose SSH port and run SSHD
EXPOSE 22
CMD ["/usr/sbin/sshd","-D"]

I've been working with another individual doing the same tutorial on a Linux box who is stuck at the same place. Any help would be appreciated.

CosetteN
  • 347
  • 1
  • 7
  • 18

1 Answers1

2

The problem you are running into probably has to do with interactive authorization of the host. Try adding the following command to your slave's Dockerfile

RUN ssh-keyscan -H 192.168.99.100 >> /home/jenkins/.ssh/known_hosts

Be sure to add it after you created the jenkins user, preferably after 

USER jenkins

to avoid wrong ownership of the file.

Also make sure to do this when the master host is online, else it will tell you the host is unreachable. If you can't, then get the known_hosts file from the slave after you did it manually and copy it into your slave.

You can verify this. If you attach your console to the docker slave and ssh to the master, it will ask you to trust the server and add it to known hosts.

Rik
  • 3,647
  • 2
  • 25
  • 34
  • I am using `RUN useradd jenkins -m -s /bin/bash` to create the Jenkins user. After this command I've tried adding `ssh-keyscan -H 192.168.99.100 >> /home/jenkins/.ssh/known_hosts` then `RUN ssh-keyscan -H 192.168.99.100 >> /home/jenkins/.ssh/known_hosts`. Both fail to build. The RUN version with `The command '/bin/sh -c ssh-keyscan -H 192.168.99.100 >> /home/jenkins/.ssh/known_hosts' returned a non-zero code: 1` and the without RUN version `Unknown instruction: SSH-KEYSCAN`. I apologize if I'm missing something commonly known. – CosetteN Dec 27 '16 at 19:04
  • Do you get an error (best is to run the command as jenkins or add the known_hosts). And can you ssh from slave to master? If Yes, it should not ask you to add the host to known_hosts – Rik Dec 27 '16 at 19:07
  • You should indeed use `RUN ssh-keyscan...` but it will actually scan the url. So if the master is not online it wont work. What you can do, is after master and slave are running, ssh from slave to master and then copy the known_hosts file and put it in the dockerfile – Rik Dec 27 '16 at 19:10
  • But to check if this would solve your initial problem, bring both master and slave online and ssh once from dlave to master. Then you should not get the error in jenkins anymore – Rik Dec 27 '16 at 19:11
  • You can also try `ssh-keyscan ... > /home/jenkins/.ssh/known_hosts` because maybe the command fails because `>>` tries to append to a file. If file doesn't exist it will also fail – Rik Dec 27 '16 at 20:02