Spring Cloud Config Server using SSH key for Git and running in Docker
First piece is the configuration. You want to ignore the standard private key and use one provided as an environment variable. (SSH_KEY). Also, the git repo is an EV (GIT_URL) but you can hardcode if you want.
spring:
cloud:
config:
server:
git:
uri: ${GIT_URL}
ignore-local-ssh-settings: true
private-key: ${SSH_KEY}
Part 2 is tricky. For Dev, you want the key inline, so you need to use a pipe to prefix the block in YAML. (Note this key is throw away as in I just generated it and have now thrown it away)
private-key: |
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAszmCR06LVHk/kNYV6LoYgEfHlK4rp75sCsRJ7rdAbWNED+yB
bneOm5gue0LGIhT7iTP9D7aN6bKVHv1SBconCA7Pa2NMA9epcMT5ecJc8ndpZOFn
iqM77jmMMPvj8EIC06w5oK5zoYwpGotYQFHllf8M+20HtW2fZdPYAYwLcVdmc5tI
vLoS+10qw5D3X9zrwk2Cbt37Iqnz1cHOQq+g7sxgVgt18aIKKeg0JslaGqSlWMoT
ICUMHj89E4BMHj8ND8otSXHL+VhN+ghd7w1MpckxLWBsNs1+G1FuiJEVAtRq/j+8
SOilxgifvI1LqpZ5kO01XFlmkcuN4NMT03qpcwIDAQABAoIBAB5oQGk2sz7mv1kk
aV0tzaBeDUd1cWSpUw1UljKRFrY4ZEDLYH5MfH57iE9TWehIZRC3KFU1JMikitZS
JktjK9IbKSfQFgKE4XOHh8gXqMteZRw/feCwpydYzic1ZUvK903QZ4qSbn3XGNYv
FA79lhUny50Qt4EZkzSkh35js0FMSR9VmyXENxN6IgXUZyoaNAATr44Vkd488BY2
7PvdOniemo8/8p4Ij0Aq9Q7rOtm77ZXjyFRX5mDTi2ndSllMEhVcWXHSii+ukbvF
117Ns+8M7VWroNfRzI+Ilm/Xz/ePOLlNoYcY0h5+QM9vMPTX9Cpl5WofgOMK1sKd
mSdI4ukCgYEA12kcu0aDyIrEPHcyaT9izSFply0Uon2QKS9EQn6cr83vaEGViamh
f5q1coYouGnsLfbgKolEMKsYtbmJvInPFDCdc2x0Fmc207Wp1OECsN+HwElEXkrs
uPDpGQgs5odjN5Grue9837920oG3UBBdVDAKly2dTOcvoWW+88seFSUCgYEA1P7f
p78HDMQ8zTy5+3Rd4+lmJjPsY618XxSQ80j8Elrhi/DyTMA0XGc5c3cKRPmSj+JD
GN34WQbw7JO2mKM7YJs+tkSBeTKce8F3cZQy1jy3LNHCtfXylOxmxOFKynV5h2b/
jno+pGdmAPK5yvnGASd2eujtzt+AL07XiD2LnLcCgYEAsFRz131WfP/SuShdlLf1
WbODKuQVIxojuwLdHo1kF6k805v0G/dGoxzycOgPRz41vj57q3Yn4qr8FC3n6PTq
FT3idUyPDpO41r67Ye469KxWBHo1Q/aTJqTWOs5tatvixOcyqoa3MrUZQCI8+4YZ
z8Nvt+b3/66zV6vhDtHzMx0CgYAvWW2M0+mUS/ecRHivzqGkrdkYewh87C8uz9qd
SsdGqU9kla63oy7Ar+3Unkz5ImYTeGAkIgw4dlOOtBOugPMNOdXKHRaPQ9IHrO2J
oUFf4OVzoDnhy4ge1SLPd6nxsgXPNPVwzfopABdr9Ima9sWusgAjuK5NA+ByI9vE
HLJxpwKBgQCTM938cdx457ag1hS6EaEKyqljS1/B8ozptB4cy3h0hzw0crNmW84/
1Lt9MJmeR4FrWitQkkVLZL3SrYzrP2i+uDd4wVVD5epvnGP/Bk6g05/eB9LgDRx/
EeBgS282jUBkXZ6WpzqHCcku3Avs3ajzsC1WaEYx0tCiBxSkiJlaLQ==
-----END RSA PRIVATE KEY-----
On the production front, you need to use a bash variable at the command prompt to store your key before you pass it to the Docker command that runs your container. Example:
$ pem=$( cat path_to_key )
$ docker run -e "SSH_KEY=$pem" configserver
At this point you should have the application taken care of. Now all you need is to get past the ssh host not trusted problem. For this, add these lines in your Dockerfile. Replace "bitbucket.org" with whatever host you want. These commands create the ssh config directory, fix the permissions, and then create and populate the knownhosts file.
RUN mkdir -p /root/.ssh
RUN chmod 700 /root/.ssh
RUN ssh-keyscan bitbucket.org > /root/.ssh/known_hosts
I wanted to add a further twist on this, that would hopefully remove the need to mess around with SSH keys in the YAML file (or in env variables), which is usually A Bad Idea.
This revolves around the SSH Config file, so if the app does not have access to it, or it cannot be modified, this won't work (but I cannot think of any real-world situation in which this would apply, including Cloud deployments: either AWS Cloudformation templates, or Kubernetes ConfigMaps would provide useful workarounds).
The issue revolves (for the most part) around the (rather inexplicable) limitation of not being able to specify a private key file in the Spring Config application properties.
In your ~/.ssh/config
file, you can add the following:
Host git-config
HostName github.myserver.example.com
User someone
IdentityFile /path/to/private_key
(I need to connect to a private GitHub Enterprise server and the user associated with the SSH key is not the same as the application server is being run under: this works just fine; if that's not the case, simply use github.com
for the HostName
, and omit the User
)
Then, instead of using the actual GitHub URI, something like:
[email protected]:my-team/config-properties-demo.git
you replace git-config
for the host:
spring:
cloud:
config:
server:
git:
uri: git@git-config:my-team/config-properties-demo.git
strictHostKeyChecking: false
It is indeed a bit cumbersome, but relatively easy to automate. A much preferable option would be for Spring Config to add another option that points to the private key material:
spring:
cloud:
config:
server:
git:
uri: [email protected]:my-team/config-properties-demo.git
user: someone
private_key_file: /path/to/private_key
strictHostKeyChecking: false
I guess this is one for the "enhancement requests" section...