search

jenkinsci / openstack-cloud-plugin

Provision nodes from OpenStack on demand
https://plugins.jenkins.io/openstack-cloud
MIT License
47 stars 84 forks source link

Controller fails to connect to agents via SSH if the ssh key is not Ed25519 #361

Closed mrahman1-godaddy closed 1 year ago

mrahman1-godaddy commented 1 year ago

Jenkins and plugins versions report

Environment ```text Jenkins: 2.375.3 OS: Linux - 5.14.0-162.18.1.el9_1.x86_64 Java: 11.0.18 - Red Hat, Inc. (OpenJDK 64-Bit Server VM) --- ace-editor:1.1 active-directory:2.30 ant:475.vf34069fef73c antisamy-markup-formatter:155.v795fb_8702324 apache-httpcomponents-client-4-api:4.5.13-138.v4e7d9a_7b_a_e61 artifactory:3.18.0 authentication-tokens:1.4 aws-credentials:191.vcb_f183ce58b_9 aws-java-sdk:1.12.215-339.vdc07efc5320c aws-java-sdk-cloudformation:1.12.215-339.vdc07efc5320c aws-java-sdk-codebuild:1.12.215-339.vdc07efc5320c aws-java-sdk-ec2:1.12.215-339.vdc07efc5320c aws-java-sdk-ecr:1.12.215-339.vdc07efc5320c aws-java-sdk-ecs:1.12.215-339.vdc07efc5320c aws-java-sdk-elasticbeanstalk:1.12.215-339.vdc07efc5320c aws-java-sdk-iam:1.12.215-339.vdc07efc5320c aws-java-sdk-logs:1.12.215-339.vdc07efc5320c aws-java-sdk-minimal:1.12.215-339.vdc07efc5320c aws-java-sdk-ssm:1.12.215-339.vdc07efc5320c aws-okta:1.0.1 bootstrap4-api:4.6.0-5 bootstrap5-api:5.2.0-1 bouncycastle-api:2.26 branch-api:2.1046.v0ca_37783ecc5 build-pipeline-plugin:1.5.8 build-timeout:1.28 built-on-column:1.1 caffeine-api:2.9.3-65.v6a_47d0f4d1fe checks-api:1.7.5 cloud-stats:267.v577e3742c282 cloudbees-folder:6.800.v71307ca_b_986b clover:4.13.0 cobertura:1.17 code-coverage-api:2.0.4 command-launcher:81.v9c2cb_cb_db_392 commons-lang3-api:3.12.0-36.vd97de6465d5b_ conditional-buildstep:1.4.2 config-file-provider:3.10.0 credentials:1214.v1de940103927 credentials-binding:523.vd859a_4b_122e6 data-tables-api:1.11.4-4 display-url-api:2.3.7 docker-commons:1.19 docker-workflow:1.28 durable-task:496.va67c6f9eefa7 echarts-api:5.4.0-1 envinject:2.866.v5c0403e3d4df envinject-api:1.199.v3ce31253ed13 external-monitor-job:191.v363d0d1efdf8 font-awesome-api:6.2.0-3 forensics-api:1.13.0 git:5.0.0 git-client:4.1.0 git-server:1.11 github:1.37.0 github-api:1.303-400.v35c2d8258028 github-branch-source:1701.v00cc8184df93 github-organization-folder:1.6 gradle:2.3 handlebars:3.0.8 http_request:1.16 instance-identity:142.v04572ca_5b_265 ionicons-api:31.v4757b_6987003 ivy:2.2 jackson2-api:2.13.4.20221013-295.v8e29ea_354141 jakarta-activation-api:2.0.1-2 jakarta-mail-api:2.0.1-2 javadoc:217.v905b_86277a_2a_ javax-activation-api:1.2.0-5 javax-mail-api:1.6.2-6 jaxb:2.3.7-1 jdk-tool:1.5 jenkins-multijob-plugin:623.v03401733c9a_9 jjwt-api:0.11.5-77.v646c772fddb_0 jquery:1.12.4-1 jquery-detached:1.2.1 jquery3-api:3.6.0-4 jsch:0.1.55.2 junit:1160.vf1f01a_a_ea_b_7f ldap:2.10 lockable-resources:2.15 mailer:448.v5b_97805e3767 matrix-auth:3.1.6 matrix-project:785.v06b_7f47b_c631 maven-plugin:3.18 mina-sshd-api-common:2.9.2-50.va_0e1f42659a_a mina-sshd-api-core:2.9.2-50.va_0e1f42659a_a momentjs:1.1.1 okhttp-api:4.9.3-108.v0feda04578cf openstack-cloud:2.63 pam-auth:1.8 parameterized-trigger:2.45 pipeline-build-step:2.18 pipeline-github-lib:38.v445716ea_edda_ pipeline-graph-analysis:195.v5812d95a_a_2f9 pipeline-groovy-lib:591.v3a_7f422b_d058 pipeline-input-step:448.v37cea_9a_10a_70 pipeline-milestone-step:101.vd572fef9d926 pipeline-model-api:2.2081.v3919681ffc1e pipeline-model-declarative-agent:1.1.1 pipeline-model-definition:2.2081.v3919681ffc1e pipeline-model-extensions:2.2081.v3919681ffc1e pipeline-rest-api:2.24 pipeline-stage-step:293.v200037eefcd5 pipeline-stage-tags-metadata:2.2081.v3919681ffc1e pipeline-stage-view:2.24 pipeline-utility-steps:2.12.1 plain-credentials:143.v1b_df8b_d3b_e48 plugin-util-api:2.17.0 popper-api:1.16.1-3 popper2-api:2.11.5-2 pyenv-pipeline:2.1.2 resource-disposer:0.21 run-condition:1.5 saltstack:3.2.2 scm-api:631.v9143df5b_e4a_a script-security:1229.v4880b_b_e905a_6 slack:631.v40deea_40323b snakeyaml-api:1.30.1 snow:1.1.2 ssh-credentials:305.v8f4381501156 ssh-slaves:2.854.v7fd446b_337c9 sshd:3.237.v883d165a_c1d3 structs:324.va_f5d6774f3a_d timestamper:1.22 token-macro:321.vd7cc1f2a_52c8 trilead-api:2.84.v72119de229b_7 variant:1.4 windows-slaves:1.8.1 workflow-aggregator:590.v6a_d052e5a_a_b_5 workflow-api:1208.v0cc7c6e0da_9e workflow-basic-steps:948.v2c72a_091b_b_68 workflow-cps:3618.v13db_a_21f0fcf workflow-cps-global-lib:581.ve633085a_8a_87 workflow-durable-task-step:1139.v252a_e12e8463 workflow-job:1268.v6eb_e2ee1a_85a workflow-multibranch:716.vc692a_e52371b_ workflow-scm-step:400.v6b_89a_1317c9a_ workflow-step-api:639.v6eca_cd8c04a_a_ workflow-support:839.v35e2736cfd5c ws-cleanup:0.44 ```

What Operating System are you using (both controller, and any agents involved in the problem)?

AlmaLinux 9

Reproduction steps

  1. Create a jenkins controller
  2. Create the SSH key using RSA
  3. Add ssh public key to the agent using init-script
  4. Try and spawn the agents using GUI
  5. It will fail
  6. Go to step 2 and re-generate key using ssh-keygen -t ed25519
  7. Add pub key to init-script
  8. Works!

Expected Results

I expected the controller to connect to the agent without any issues and spawn VMs.

Actual Results

The controller would complain that:

This agent is offline because Jenkins failed to launch the agent process on it.

Looking at the ssh logs on the agent's machine would yield:

sshd[7645]: Connection closed by jenkins [preauth]

Anything else?

Either there is a bug that doesn't allow rsa keys to be used or something else should be made explicit in the documentation and/or fixed to mention usage of ed25519 keys.

olivergondza commented 1 year ago

The cause will not be RSA key alone. They are heavily used without any problem for years, so it will be some more specific aspect of it you have run into, and you do not see that for ed25519 keys.

Please share the preamble (------ BEGIN ???) of both the working and non-working key. Also share the exact command you used to generate you RSA key.

mrahman1-godaddy commented 1 year ago

Apologies, I was unable to replicate this. So will close this issue.