jenkinsci / jenkinsci/google-compute-engine-plugin

Should document incompatibility with OS Login

Open
#527 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
58
Forks
97
PR merge metrics
No merged PRs in 30d

Description

### Describe your use-case which is not covered by existing documentation.

If a GCP project is using [OS Login](https://cloud.google.com/compute/docs/oslogin) the GCE guest agent skips inserting the SSH host key in the instance [guest attributes](https://cloud.google.com/compute/docs/metadata/manage-guest-attributes#enable_attributes) (which by te way may also need to be enabled).

So, in a project with a project-wide GCE metadata that enables OS Login, the jenkins nodes started by the plugin will not be able to publish their SSH host key as a guest attribute and the jenkins controller won't be able to connect to them (failing because of a `WARNING` validating the host SSH key which in itself not very pretty).

A possible setup is disabling OS Login globally for the GCP project and enabling it for the jenkins controller machine (in its metadata) if it is needed and in the same GCP project. Without OS Login, IAM identities will not be able to login in worker nodes unless the nodes are prepared beforehand with authorized SSH keys. I'm not sure if changing the worker node metadata with the authorized SSH keys may reflect immediately in the actually authorized keys, as I'm not usually logging in interactively with statically assigned keys.

### Reference any relevant documentation, other materials or issues/pull requests that can be used for inspiration.

_No response_

### Are you interested in contributing to the documentation?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.