Question

我对这一切都不熟悉，但我猜我会使用SSH密钥......但是怎么样？

git '/home/vagrant/foo' do
    repository 'me@repo.domain.com:/usr/git/app.git'

    reference 'master'
    action :sync

    user "vagrant"
    group "vagrant"
end

Answer 1

这对我有用：

1 - 生成SSH密钥对（公共+私有）

您要添加到git个回购

的公钥

2 - 生成加密密钥

openssl rand -base64 512 > encrypted_data_bag_secret

3 - 使用刀

创建加密数据包

$ knife data bag create private_keys git_key --secret-file encrypted_data_bag_secret

这将打开您最喜欢的编辑器（vim），然后您需要添加您的私钥：

{
  "name": "data_bag_item_private_keys_git_key",
  "json_class": "Chef::DataBagItem",
  "chef_type": "data_bag_item",
  "data_bag": "private_keys",
  "raw_data": {
    "id": "git_key",
    "private": "Add HERE you private key, replace the newlines by \n"     <===== this is going to be a very long string of caracters
  }
}

重要说明：用\ n

替换私钥的换行符

4 - 在您的食谱中：

secret = Chef::EncryptedDataBagItem.load_secret("/vagrant/encrypted_data_bag_secret")
git_key = Chef::EncryptedDataBagItem.load( "private_keys", "git_key", secret)
#git_key = Chef::DataBagItem.load( "private_keys_not_encrypted", "git_key")
file "/home/otto/.ssh/id_rsa" do
  content git_key['private'] 
  owner "otto"
  group "otto"
  mode 00600
  action [:delete, :create]
end

5 - 查看加密数据包

$ knife data bag show private_keys git_key
id:      git_key
private:
  cipher:         aes-256-cbc
  encrypted_data: osuRPsasdfasdfasdfasdfaKutAXYrklKwn+zAgtlQZsFZNRKCyDf1Lc
  2jtRZeGye0WHEKbVCtO7+arpytY7jNA4prOsK6iF1+cJsKcIBDtiNuurt80V
  ljGJ5RNfvAtW5HJb2P7Sw75RyQQruKha0fsbyWTKwyssXnXZbmGxEFb+Vz4m
  vEiU0tVk7/M04zAw34beEfnmAKNAae4TAgrlYg8bdQcxBi6zIdj5AW1VGBsh
  xaxFdfEXvNcSwMBX9w3Yyj7xVzI7fj3QHqnJl/p4VKhwoOlCahbJqh3A72xc
  l0mg0aPYfASulVuLm6U+KywzonOOVqXpeNYPtz+bW5v6Wa4cIM3aJ0JcObDw
  BNqe0goDRHjz6YJBKW9RT5EiRJPZbdNWJaEZhEawW/e9lyLq/A44sZhC+m0I
  ...
  [FILTERED]
  ...
  6RA/9XxH7pGJpJtxVYGWSQB1diHcpaT1Vg7RT48L7WZJjJcK0ZQHYZpXfIB2
  jUfIM3VY3ceD12unbZPI6FifdFq74qlr0fF4WM6V7WhJTgx3V3xCYLkjnhD9
  9mchWqaBa9oYNoflSR0vl21j2gywDG0LPI5bbgTU+Gu5A+XsGirW/FYfKS28
  08+B64Qvep0axtocs3GN2hOb

  iv:             dTFABrasdfasdfaLh5bNIJeUWQ==

  version:        1

6 - 将您的公钥添加到您的节点

cookbook_file "/home/otto/.ssh/id_rsa.pub" do
  source "id_rsa.pub"     <=== Contains the public key
  mode "0644"
end

cookbook_file "/home/otto/.ssh/known_hosts" do
  source "known_hosts" <=== BitBucket host
  mode "0644"               
end

7 - 确认您可以连接到BitBucket

$ ssh -T git@bitbucket.org 
The authenticity of host 'bitbucket.org ([FILTERED])' can't be established.
RSA key fingerprint is [FILTERED].
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'bitbucket.org,[FILTERED]' (RSA) to the list of known hosts.
authenticated via a deploy key.

You can use git or hg to connect to Bitbucket. Shell access is disabled.

重要提示：在此命令结束时，您将需要添加到食谱中的known_hosts文件。将其复制到食谱的files/default文件夹。

在此之后，我即将git clone我的存储库。

我想我已经准确记录了我的所作所为，但随时可以放弃你的问题。

当我使用Chef进行git克隆时如何进行身份验证？

1 个答案: