jenkinsci / nomad-plugin

Nomad cloud plugin for Jenkins
https://plugins.jenkins.io/nomad/
MIT License
56 stars 41 forks source link

SSH auth support with Docker driver #21

Closed zstyblik closed 6 years ago

zstyblik commented 7 years ago

Hello,

my apologies, but it's unclear to me whether SSH authentication is or isn't supported for Jenkins slaves when Docker driver is used.

Thank you.

zstyblik commented 7 years ago

The answer is no, SSH authentication is not supported at the moment. Now that some time has passed, I see it as a nice to have feature which has its pros, easier firewall management, but probably isn't essential. Also, it's possible it would complicate code logic a lot, but I'm unable to say due to inexperience with Java, nomad and Jenkins plugin programming.

jovandeginste commented 6 years ago

@zstyblik What is your use case for SSH authentication?

zstyblik commented 6 years ago

Actually, since this plugin doesn't support SSH auth, it's none. However, I had to open up firewall and unrestricted access to Jenkins from all nomad hosts. I don't use auth in Jenkins itself. If I did, it might have been a bit different, although eg. /computer isn't amongst URIs which shouldn't require auth. SSH auth simply has its advantages. One of them is that you can have your Jenkins behind the firewall and allow communication from Jenkins towards nomad, or any host in this matter, but this isn't required the other way around.

zstyblik commented 6 years ago

You know, maybe I have use-case after all. jNLP is proving to be really troublesome kind. First, there was issue with flow. Ok, that's bug in some kind of application.

Now, I'm getting org.jenkinsci.remoting.protocol.NetworkLayer.onRecvClosed and I'm simply unable to run one Android build for no obvious reason. It can be the same issue as with flow, but I honestly doubt it. With another batch job, jenkins slave simply times-out regardless of pinger. I admit, this has been caused by heavy network maintenance, but still ... does pinger thread work after all?

After reading quite a lot stack-overflow posts and jenkins bugs my conclusion is:

In other words, it could be feature worth the shot ... at some of time.