Add support for specifying a SSH key per git repository

[larstobi]

Using a Puppetfile with modules in private git repositories using SSH requires using a SSH private key.

Using the "deploy key" feature in Github and Github Enterprise will grant access to repositories for machines. It disallows duplicate SSH keys accross the entire site. Each repository needs to have it's separate deploy key.

This could be solved by generating multiple keys, one per repository, and speficying the SSH key to git when fetching.

Example config:

mod 'site-nrpe',
    :git => 'git@github.com:organization/puppet-site-nrpe.git',
    :sshkey_path => '/var/opt/lib/r10k/.ssh/puppet-site-nrpe_id_rsa'

What do you think?

[adrienthebo]

👍 for this behavior. However the last time I played with Github deploy keys I think there had to be some special environment variable magic to do this on a per-repo basis.

In addition this would need to be done for the Puppetfile as well as top level sources, right?

[Ancillas]

Can't this be managed using an SSH config file? Does it make sense for it
to be managed by r10k?

Greg

On May 28, 2013, at 12:04 AM, Adrien Thebo notifications@github.com wrote:

[image: 👍] for this behavior. However the last time I played with Github
deploy keys I think there had to be some special environment variable magic
to do this on a per-repo basis.

In addition this would need to be done for the Puppetfile as well as top
level sources, right?

—
Reply to this email directly or view it on
GitHubhttps://github.com//issues/37#issuecomment-18529833
.

[larstobi]

Ancillas: I think maybe your approach is better. It may be out of r10k's area of responsibility.

For instance, sharing the Puppetfile between puppet masters and developers, presents problems if it contains sshkey_paths to keys, which may not exist everywhere, and r10k shouldn't generate keys.

[adrienthebo]

@larstobi to follow up on this do you think this sort of functionality is still needed, or can we close this issue out?

[larstobi]

@adrienthebo yes, I think this functionality is better served by an SSH config file, as @Ancillas suggested.