26

When deploying an application with Chef, I've got the code base set to be cloned from a private github repository with the following resource:

git '/mnt/application' do
    repository '[email protected]:organization/repository'

    reference 'master'
    action :sync

    user node.application.user
    group node.application.user
end

However, after scanning the documentation for the git resource, I can't see how you supply the key file for authentication. I'm also confused as to how to store this key in a data bag, as the file contains a bunch of new lines. Any ideas?

1
  • I have detailed the workflow here
    – zabumba
    Feb 10, 2015 at 13:45

7 Answers 7

27
ssh_wrapper "ssh -i /some/path/id_rsa"

In case someone comes across this, the above didn't work for me, I kept getting the error:

error: cannot run ssh -i /some/path/id_rsa: No such file or directory

What specifying ssh_wrapper does is it sets the GIT_SSH environment variable, and it turns out you can't provide parameters in the GIT_SSH environment variable (see Git clone with custom SSH using GIT_SSH error).

Instead, you would need to write your script to a file first, then set GIT_SSH to it.

So:

file "/some/path/git_wrapper.sh" do
  owner "your_user"
  mode "0755"
  content "#!/bin/sh\nexec /usr/bin/ssh -i /some/path/id_rsa \"$@\""
end

And change the git resource part to:

git "/opt/mysources/couch" do
  repository "git://git.apache.org/couchdb.git"
  reference "master"
  action :sync
  ssh_wrapper "/some/path/git_wrapper.sh"
end
3
  • 2
    This was my experience too. Same problem, same solution.
    – Noah Gibbs
    Dec 8, 2014 at 13:00
  • 6
    Also it's useful to add -o "StrictHostKeyChecking=no" parameter to ssh to skip host key check.
    – Poma
    Apr 25, 2015 at 14:03
  • 1
    This answer is useful for what it does detail, but it lacks an explanation of how to get the private key onto the node. Of course, that can be done manually, but before that happens this will fail. Jun 16, 2017 at 17:22
12

We use the similar setup for Mercurial, but it should be the same with Git, I hope.

We use ssh keys to authenticate. The key is stored in encrypted databag (with newlines replaced by "\n"). First of all this private key is created on the node from databag.

git_key = Chef::EncryptedDataBagItem.load( "private_keys", "git_key" )
file "/some/path/id_rsa" do
  content git_key['private']
end

And then use it when connecting to git repository using ssh_wrapper:

git "/opt/mysources/couch" do
  repository "git://git.apache.org/couchdb.git"
  reference "master"
  action :sync
  ssh_wrapper "ssh -i /some/path/id_rsa" #the path to our private key file
end
3
  • Hey Draco, this is new to me, I am reading the doc but I am struggling a little. It would be great help for a newbie like me if you could detail (spoon feed) how you store the SSH key in an encrypted databag. Hope you find time for this.
    – zabumba
    May 13, 2014 at 13:53
  • ` knife data bag create private_keys git_key --secret-file ~/.ssh/id_rsa` is this how you do it?
    – zabumba
    May 13, 2014 at 15:22
  • 1
    content git_key[:private] didn't work for me, BUT content git_key['private'] did
    – zabumba
    May 13, 2014 at 21:06
1

if you are in a linux distribution store your ssh key in <your home directory>/.ssh and add github.com to <your home directory>/.ssh/known_hosts

You can add github.com to known_hosts using the following command

ssh-keyscan -H github.com >> <your home directory>/.ssh/known_hosts

After doing this you can clone your repo using git resource of chef

1
  • Vineeth - I think they mean for GitHub (and other) private repos that use an SSH key for authentication and won't let you clone without it.
    – Noah Gibbs
    Dec 8, 2014 at 13:01
1

I went through same problem, Only thing I was missing was this command then everything went well:

GIT_SSH_COMMAND="ssh -i ~/.ssh/bitbucket_rsa"

Reference and for my whole steps can be found at my blog: http://www.sadafnoor.com/blog/simplest-way-to-write-your-chef-cookbook-that-git-clone-private-repo-using-bitbucket-deploy-key/

0
0

Based on the hint by sadaf2605, this was the easiest way for me – I just had to make sure to set the correct user/group as well as turn off StrictHostKeyChecking:

git '/path/to/destination' do
  environment 'GIT_SSH_COMMAND' => 'ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i /path/to/private_key'
  repository '[email protected]:your/repo.git'
  reference 'master'
  action :sync
  user 'vagrant'
  group 'vagrant'
end
0

I fixed it for myself by specifying ssh key in ~/.ssh/config

Host chef.example.com
 HostName chef.example.com
 IdentityFile ~/.ssh/chef.pem

The ~/.ssh/chef.pem being the same key I use to ssh into server.

-1

You should try this cookbook https://github.com/poise/application_git. It solves the problem that you mentioned.

With this cookbook, you can use application_git resource, specifiyng the private key:

application_git '/srv/myapp' do
  repository '[email protected]:organization/repository'
  deploy_key '/some/path/id_rsa'
end
0

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.