Bad owner or permissions on ssh config when using private GIT repo #116
Comments
|
I was able to replicate the issue on the ARM64v8 architecture, but not on the AMD64. I'll have to dig to see why the different builds have different results for ssh keys. I ran a test as similar as possible to yours. This is the config that works for amd and not for arm:apiVersion: tf.isaaguilar.com/v1alpha2
kind: Terraform
metadata:
name: example
namespace: default
spec:
terraformVersion: 1.0.0
# Pull this module to execute
terraformModule:
source: "git@github.com:isaaguilar/simple-aws-tf-modules.git//private-github-module"
# Use kubernetes as a backend which is available for terraform >= v0.13
backend: |-
terraform {
backend "s3" {
region = "us-east-1"
bucket = "my-terraform-state-bucket"
key = "terraform-operator/my/awesome/example.tfstate"
}
}
ignoreDelete: true
# Create a tfvar env for the terraform to use
taskOptions:
- for:
- '*' # The following config affects all task pods
env:
- name: TF_VAR_vpc_name
value: blah
- name: TF_VAR_client_id
value: acme
- name: TF_VAR_environment
value: test
envFrom:
- secretRef:
name: aws-session-credentials # temp creds for my bucket
scmAuthMethods:
- git:
ssh:
sshKeySecretRef:
key: key
name: gitsshkey
namespace: default
host: github.com
keepCompletedPods: true
keepLatestPodsOnly: true
serviceAccount: tf-operator-service-account
The main module is simple: # https://github.com/isaaguilar/simple-aws-tf-modules/blob/master/private-github-module/main.tf
output "static" {
value = "static"
}
module "private" {
// This source is private
source = "git@github.com:isaaguilar/terraform-do-something-awesome.git?ref=main"
}
terraform {
required_version = "> 0.12"
}And indeed my logs match yours: Any help determining why the arm build isn't working is greatly appreciated. |
|
Found the issue. In the arm build I don't have ssh installed. ~/generations/2/main$ ssh
bash: ssh: command not foundFix should be relatively easy, but the |
|
Oh, but in the error you posted, it has to do with |
|
@odise I made some changes in the task scripts to attempt to fix the .ssh dir. I hope this fixes the issue you're having. GalleyBytes/terraform-operator-tasks#9 To make use of the changes, the following additions to the spec may be used: spec:
# ...
taskOptions:
- for: [ init, plan, apply, init-delete, plan-delete, apply-delete ]
script:
source: https://raw.githubusercontent.com/GalleyBytes/terraform-operator-tasks/always-attempt-to-fix-ssh/tf.sh
- for: [ setup ]
script:
source: https://raw.githubusercontent.com/GalleyBytes/terraform-operator-tasks/always-attempt-to-fix-ssh/setup.sh |
|
@isaaguilar this seems to fix the issue. Just to satisfy me curiosity: I think I tried to achieve exactly the same with a |
|
The and the fix uses |
I noticed some weird behaviour when TF code to be deployed is depending on private GIT repositories. The
terraform initstep fails with the following error:Interestingly the
setupstep runs successful although it depends on an internal GIT repository. The error above is a result ofterraform inittrying to download further modules from the same GIT repo.Here is my Terraform manifest:
I defines a
preinitstep to investigate the/home/tfo-runner/.sshdirectory and found this:All attempts to change the permissions within
preinitfailed ininitwith same result.I'm using the Helm chart v0.2.15 from https://galleybytes.github.io/helm-charts which installs
terraform-operator:v0.9.0-pre3.The text was updated successfully, but these errors were encountered: