Your CI/CD tool needs access to code and server, for linting, testing and deploying.
Setup up access on the various devices in a secure manner can be very time consuming. It is important to make use of available technology to make our lives easier.
Jenkins needs access
You will have created credentials for Jenkins – by creating a SSH key pair for your jenkins user. Ensure that that public key have access to the code on your version control platform (as a deploy key).
Now jenkins will be able to get your code and run various tests on it. The problem now is deployment.
Use Jenkins’s SSH credentials to Deploy
We are using ansible to deploy (from the jenkins box). So now jenkins needs access to wherever you are deploying the code to. You would do an ssh-copy-id to get it there.
But there is another problem, when ansible runs the git module to clone the repo you will get an error that the user does not have access.
Correct, the user on the box you are deploying to does not have access to the code. Now you could add that box as another deploy key but now when scaling out to many boxes you will have a hell of alot of ssh credentials to manage.
The best thing to do is use the jenkins user’s cerentials that log into your target box to get the code. This is done with SSH Agent forwarding.
The first thing we will need is the jenkins SSH agent plugin.
Then enable the SSH agent for your job:
Then install the Jenkins ansible plugin and configure it.
Finally you need to tell ansible to use SSH Agent forwarding, otherwise it just won’t do it:
mkdir /etc/ansible
vi /etc/ansiible/ansible.cfg
Add the following config there:
defaults]
host_key_checking = False
[ssh_connection]
ssh_args = -o ForwardAgent=yes -o ControlMaster=auto -o ControlPersist=60s
Of course, it is better to ensure host_key_checking is done.
Now everything should work.