Spring Cloud Config Server using SSH key for Git and running in Docker

Question

I found many questions and tutorials before finally putting this all together. Wanted to document it so somebody else can save many hours of frustration.

I am trying to get a private git repository on BitBucket to work with Spring Boot Config Server using deploy keys and have it run in Docker. I am running into many issues.

1. How to actually configure using the application.yml files.

I cant seem to figure out where I should put the SSH info. All tutorials seem to be for https.

2. How to provide the private key to the configuration. For Dev the syntax for inline in YML is a pain. For production, you have to provide it via an environment variable, which is another syntax chore.

I keep getting an error that the private key is invalid.

3. How to get the Docker container to trust the host key without that pesky "do you trust this guy" prompt.

There seems to be several ways to make this work, but only one that worked for me.

Answer 1

First piece is the configuration. You want to ignore the standard private key and use one provided as an environment variable. (SSH_KEY). Also, the git repo is an EV (GIT_URL) but you can hardcode if you want.

spring:
  cloud:
    config:
      server:
        git:
          uri:  ${GIT_URL}
          ignore-local-ssh-settings: true
          private-key: ${SSH_KEY}

Part 2 is tricky. For Dev, you want the key inline, so you need to use a pipe to prefix the block in YAML. (Note this key is throw away as in I just generated it and have now thrown it away)

private-key: |
                    -----BEGIN RSA PRIVATE KEY-----
                    MIIEpAIBAAKCAQEAszmCR06LVHk/kNYV6LoYgEfHlK4rp75sCsRJ7rdAbWNED+yB
                    bneOm5gue0LGIhT7iTP9D7aN6bKVHv1SBconCA7Pa2NMA9epcMT5ecJc8ndpZOFn
                    iqM77jmMMPvj8EIC06w5oK5zoYwpGotYQFHllf8M+20HtW2fZdPYAYwLcVdmc5tI
                    vLoS+10qw5D3X9zrwk2Cbt37Iqnz1cHOQq+g7sxgVgt18aIKKeg0JslaGqSlWMoT
                    ICUMHj89E4BMHj8ND8otSXHL+VhN+ghd7w1MpckxLWBsNs1+G1FuiJEVAtRq/j+8
                    SOilxgifvI1LqpZ5kO01XFlmkcuN4NMT03qpcwIDAQABAoIBAB5oQGk2sz7mv1kk
                    aV0tzaBeDUd1cWSpUw1UljKRFrY4ZEDLYH5MfH57iE9TWehIZRC3KFU1JMikitZS
                    JktjK9IbKSfQFgKE4XOHh8gXqMteZRw/feCwpydYzic1ZUvK903QZ4qSbn3XGNYv
                    FA79lhUny50Qt4EZkzSkh35js0FMSR9VmyXENxN6IgXUZyoaNAATr44Vkd488BY2
                    7PvdOniemo8/8p4Ij0Aq9Q7rOtm77ZXjyFRX5mDTi2ndSllMEhVcWXHSii+ukbvF
                    117Ns+8M7VWroNfRzI+Ilm/Xz/ePOLlNoYcY0h5+QM9vMPTX9Cpl5WofgOMK1sKd
                    mSdI4ukCgYEA12kcu0aDyIrEPHcyaT9izSFply0Uon2QKS9EQn6cr83vaEGViamh
                    f5q1coYouGnsLfbgKolEMKsYtbmJvInPFDCdc2x0Fmc207Wp1OECsN+HwElEXkrs
                    uPDpGQgs5odjN5Grue9837920oG3UBBdVDAKly2dTOcvoWW+88seFSUCgYEA1P7f
                    p78HDMQ8zTy5+3Rd4+lmJjPsY618XxSQ80j8Elrhi/DyTMA0XGc5c3cKRPmSj+JD
                    GN34WQbw7JO2mKM7YJs+tkSBeTKce8F3cZQy1jy3LNHCtfXylOxmxOFKynV5h2b/
                    jno+pGdmAPK5yvnGASd2eujtzt+AL07XiD2LnLcCgYEAsFRz131WfP/SuShdlLf1
                    WbODKuQVIxojuwLdHo1kF6k805v0G/dGoxzycOgPRz41vj57q3Yn4qr8FC3n6PTq
                    FT3idUyPDpO41r67Ye469KxWBHo1Q/aTJqTWOs5tatvixOcyqoa3MrUZQCI8+4YZ
                    z8Nvt+b3/66zV6vhDtHzMx0CgYAvWW2M0+mUS/ecRHivzqGkrdkYewh87C8uz9qd
                    SsdGqU9kla63oy7Ar+3Unkz5ImYTeGAkIgw4dlOOtBOugPMNOdXKHRaPQ9IHrO2J
                    oUFf4OVzoDnhy4ge1SLPd6nxsgXPNPVwzfopABdr9Ima9sWusgAjuK5NA+ByI9vE
                    HLJxpwKBgQCTM938cdx457ag1hS6EaEKyqljS1/B8ozptB4cy3h0hzw0crNmW84/
                    1Lt9MJmeR4FrWitQkkVLZL3SrYzrP2i+uDd4wVVD5epvnGP/Bk6g05/eB9LgDRx/
                    EeBgS282jUBkXZ6WpzqHCcku3Avs3ajzsC1WaEYx0tCiBxSkiJlaLQ==
                    -----END RSA PRIVATE KEY-----

On the production front, you need to use a bash variable at the command prompt to store your key before you pass it to the Docker command that runs your container. Example:

$ pem=$( cat path_to_key )
$ docker run -e "SSH_KEY=$pem" configserver

At this point you should have the application taken care of. Now all you need is to get past the ssh host not trusted problem. For this, add these lines in your Dockerfile. Replace "bitbucket.org" with whatever host you want. These commands create the ssh config directory, fix the permissions, and then create and populate the knownhosts file.

RUN mkdir -p /root/.ssh
RUN chmod 700 /root/.ssh
RUN ssh-keyscan bitbucket.org > /root/.ssh/known_hosts

Answer 2

I wanted to add a further twist on this, that would hopefully remove the need to mess around with SSH keys in the YAML file (or in env variables), which is usually A Bad Idea.

This revolves around the SSH Config file, so if the app does not have access to it, or it cannot be modified, this won't work (but I cannot think of any real-world situation in which this would apply, including Cloud deployments: either AWS Cloudformation templates, or Kubernetes ConfigMaps would provide useful workarounds).

The issue revolves (for the most part) around the (rather inexplicable) limitation of not being able to specify a private key file in the Spring Config application properties.

In your ~/.ssh/config file, you can add the following:

Host git-config
    HostName github.myserver.example.com
    User someone
    IdentityFile /path/to/private_key

(I need to connect to a private GitHub Enterprise server and the user associated with the SSH key is not the same as the application server is being run under: this works just fine; if that's not the case, simply use github.com for the HostName, and omit the User)

Then, instead of using the actual GitHub URI, something like:

[email protected]:my-team/config-properties-demo.git

you replace git-config for the host:

spring:
  cloud:
    config:
      server:
        git:
          uri: git@git-config:my-team/config-properties-demo.git
          strictHostKeyChecking: false

It is indeed a bit cumbersome, but relatively easy to automate. A much preferable option would be for Spring Config to add another option that points to the private key material:

spring:
  cloud:
    config:
      server:
        git:
          uri: [email protected]:my-team/config-properties-demo.git
          user: someone
          private_key_file: /path/to/private_key
          strictHostKeyChecking: false

I guess this is one for the "enhancement requests" section...