Re: [Fuego] Unable to connect gerrit server from within docker container via Gerrit Trigger plugin

I'm glad it worked out!

Regards,
 -- Tim


> -----Original Message-----
> From: Dhinakar Kalyanasundaram 
> 
> Thank you very much for the response, I can understand your situation.
> 
> Please find my comments inline.
> 
> Regards,
> 
> Dhinakar
> 
> --------- Original Message ---------
> 
> Sender : [email protected] <[email protected]>
> 
> Date : 2019-11-04 22:59 (GMT+5:30)
> 
> Title : RE: Unable to connect gerrit server from within docker container via
> Gerrit Trigger plugin
> 
> 
> 
> > -----Original Message-----
> > From: Dhinakar Kalyanasundaram
> >
> > Hi Tim,
> >
> > Any idea about this issue?
> >
> > Generally speaking, how to do authentication via ssh key for Jenkins
> running
> > inside the container from an external server such as Gerrit.
> >
> > The issue is the Gerrit server is looking for Jenkins user and
> > '/var/lib/jenkins/.ssh/id_rsa.pub'  path in the Linux host but they are
> actually
> > available inside the container.
> 
> Hey Dhinakar,
> 
> Sorry I didn't respond earlier.  Last week I was traveling and at conferences.
> 
> I don't know anything about Gerrit, but I'm a little bit confused.
> 
> Above, it sounds like Gerrit is trying to talk to Jenkins, and needs access to
> /var/lib/jenkins/.ssh/id_rsa.pub.  But in the previous message (below),
> it sounds like the jenkins plugin for gerrit is trying to contact gerrit.
> 
> The direction of communication matters a lot.  I'm not sure if gerrit is trying
> to contact jenkins, or jenkins (via one of its plugins) is trying to contact gerrit.
> 
> [Dhinakar response]
> - Jenkins runs inside fuego container, there is not Jenkins installed on host
> pc. [FUEGO PC]
> - 'Gerrit Trigger' plugin is installed in Jenkins to connect to gerrit server which
> is another server on our LAN [GERRIT Server]
> - Communication is between Jenkins inside fuego container [FUEGO PC] <->
> [Gerrit Server]
> - Public key of Jenkins has been added to Gerrit Server
> - Private key of Jenkins is available in /var/lib/jenkins/.ssh/ inside fuego
> container [FUEGO PC]
> Here are a few questions:
>  - does the gerrit plugin (a jenkins plugin) make the connection between
> itself and a gerrit server somewhere?
> [Dhinakar response]
> - Gerrit plugin tries to connect to gerrit server [Gerrit Server] and
> authenticate the Jenkins user in [FUEGO PC]
> 
>  - is the gerrit server running locally or remotely?
> [Dhinakar response]
> - Gerrit server is a separate server on our LAN
> 
>  - do you have jenkins running on your host, independent of the one in the
> Fuego docker container?
> (The reason for asking this is it affects the possible solutions to the problem).
> [Dhinakar response]
> - There is no Jenkins installed on host
> 
> I assume the Jenkins plugin you are using is this one:
> https://wiki.jenkins.io/display/JENKINS/Gerrit+Trigger
> 
> I tried to follow the link to the gerrit documentation on setting up keys, but
> the link on the above
> page doesn't work.  It sounds like you are supposed to generate a key using
> gerrit, and give gerrit
> the public key and jenkins the private key, but it's not clear to me without
> being able to read
> the docs.
> 
> Any additional information would  be helpful.
> 
> As an aside, the solution may be involve using a volume mount for
> /var/lib/jenkins on the host,
> but that may not be possible if you have a separate instance of jenkins
> running outside the
> docker container.
> 
> I would expect this should be able to work by just copying the correct files
> into the various
> locations (either inside the container or on the host), but I'm not positive.
> 
> Sorry to not be more help.
>  -- Tim
> 
> [Dhinakar response]
> - I managed to figure out the issue. Our gerrit server is not able to
> authenticate 'jenkins' user
> running inside fuego container. Since there are many Jenkins server on the
> network each will have
> their own 'jenkins' user. So I avoided creating a 'jenkins' user on our gerrit
> server.
> Instead only for authentication purpose I provided my gerrit user id in 'Gerrit
> plugin username field'.
> SSH keyfile path was kept as '/var/lib/jenkins/.ssh/id_rsa' only.
> It managed to authenticate successfully.
> So far everything looks fine, I am able to see the repositories, branches etc.
> hosted on our gerrit server.
> 
> Thank you very much once again for taking your time to write back to me
> even though you don't have
> much idea about gerrit. I really appreciate that.
> 
> > --------- Original Message ---------
> >
> > Sender : Dhinakar Kalyanasundaram <[email protected]> Staff
> > Engineer/FDS SW /SSIR/Samsung Electronics
> >
> > Date : 2019-10-31 19:59 (GMT+5:30)
> >
> > Title : Unable to connect gerrit server from within docker container via
> Gerrit
> > Trigger plugin
> >
> >
> >
> > Dear Fuego Users,
> >
> >
> >
> > I am trying to connect to gerrit server by installing and configuring the
> 'gerrit
> > plugin' but I get 'Permission denied (publickey) issue.
> >
> > The issue is only from within the docker, from my Linux host I am able to
> > connect.
> >
> >
> >
> > Then I tried from within the container, as jenkins user, as shown below.
> >
> >
> >
> > jenkins@linux-2030047407:~$ <mailto:jenkins@linux-2030047407:~$>  ssh -
> p
> > 29418 [email protected] <mailto:[email protected]>
> > Permission denied (publickey).
> >
> >
> > I have added the public key of Jenkins user
> '/var/lib/jenkins/.ssh/id_rsa.pub'
> > in my gerrit server.
> >
> > OpenSSHServer was not installed by default in the container (Debian
> > stretch), so I installed it and also configured '/etc/ssh/sshd_config' file.
> >
> > (Set PermitRootLogin, PubkeyAuthentication PasswordAuthentication to
> > yes).
> >
> > But still I am not able to connect to 'gerrit server' from within docker
> > container.
> >
> > Any tips to solve this issue will be highly appreciated.
> >
> >
> >
> > Thanks in advance.
> >
> >
> >
> > Note:
> >
> > FYI, In the Jenkins->Gerrit Trigger plugin configuration, under 'Gerrit
> > Connection Settting' I get the following error, when I try 'Test Connection'.
> >
> > Connection error : com.jcraft.jsch.JSchException: Auth fail
> >
> >
> >
> > Regards,
> >
> > Dhinakar
> >
> >
> >
> >
> >
> >
> >
> > <https://protect2.fireeye.com/url?k=92556745-cfcbfcaf-9254ec0a-
> 0cc47a6cba04-
> fb1e466294ad62c6&u=http://ext.samsung.net/mail/ext/v1/external/status/
> update?userid=dhina
> >
> kar.k&do=bWFpbElEPTIwMTkxMTA0MTAwODE3ZXBjbXM1cDI0YWVmMDk4
> >
> MmY2Zjk1MGJiM2UwNTM4MGUzYTM3ZWE1ZSZyZWNpcGllbnRBZGRyZXNz
> > PVRpbS5CaXJkQHNvbnkuY29t>
> 
> 
> 
> <http://ext.samsung.net/mail/ext/v1/external/status/update?userid=dhina
> kar.k&do=bWFpbElEPTIwMTkxMTA1MTUyMDIzZXBjbXM1cDUwMWY2ZmJlN
> TY0MGIxZmE3ZWRkYTlkYzQ2N2EzNDFiNCZyZWNpcGllbnRBZGRyZXNzPVRpb
> S5CaXJkQHNvbnkuY29t>