为什么 Jenkins 无法通过 SSH 连接到代理？

Question

我正在本地 Ubuntu 工作站上设置新的 Jenkins 环境进行测试。 我一直在尝试遵循一些教程，例如 https://www.jenkins.io/doc/book/using/using-agents/，但我在通过 SSH 从主服务器连接到代理时遇到问题。

master 在 Docker 容器中运行版本 2.479.2，我已采取以下步骤在第二个 Docker 容器中设置代理：

1. 在主机工作站上生成 ssh 密钥：

   ssh-keygen -f jenkins_key

2. 在 Jenkins Web 应用程序中，使用以下设置创建凭据：

设置	价值
亲切	带私钥的 SSH 用户名
范围	全球
身份证	詹金斯
用户名	詹金斯
私钥	直接输入，Key包含jenkins_key的内容

3. 运行以下命令创建代理：

   docker run --name jenkins-agent -d --rm -p 4444:22 -e "JENKINS_AGENT_SSH_PUBKEY=<<SSH Public Key>>" jenkins/ssh-agent

   ，其中

   <<SSH Public Key>>

   是jenkins_key.pub的内容，看起来像

   ssh-ed25519 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX myuser@computername

4. 在 Jenkins Web 应用程序中，添加具有以下设置的新节点：

设置	价值
节点名称	代理1
类型	永久代理
远程根目录	/家/詹金斯
标签	代理1
使用方法	尽可能使用这个节点
启动方法	通过 SSH 启动代理
主持人	Ubuntu 工作站（Docker 主机）的 IP 地址
凭证	詹金斯
主机密钥验证策略	手动信任密钥验证策略
高级 -> 端口	4444

当代理尝试启动时，我看到尝试连接时出现错误：

SSHLauncher{host='XXX.XXX.XXX.XXX', port=4444, credentialsId='jenkins', jvmOptions='', javaPath='', prefixStartSlaveCmd='', suffixStartSlaveCmd='', launchTimeoutSeconds=60, maxNumRetries=10, retryWaitTime=15, sshHostKeyVerificationStrategy=hudson.plugins.sshslaves.verifiers.ManuallyTrustedKeyVerificationStrategy, tcpNoDelay=true, trackCredentials=true}
[12/02/24 05:48:28] [SSH] Opening SSH connection to XXX.XXX.XXX.XXX:4444.
Connect timed out
SSH Connection failed with IOException: "Connect timed out", retrying in 15 seconds. There are 10 more retries left.
Connect timed out
SSH Connection failed with IOException: "Connect timed out", retrying in 15 seconds. There are 9 more retries left.
Connect timed out
SSH Connection failed with IOException: "Connect timed out", retrying in 15 seconds. There are 8 more retries left.
Connect timed out
SSH Connection failed with IOException: "Connect timed out", retrying in 15 seconds. There are 7 more retries left.
Connect timed out
SSH Connection failed with IOException: "Connect timed out", retrying in 15 seconds. There are 6 more retries left.
Connect timed out
SSH Connection failed with IOException: "Connect timed out", retrying in 15 seconds. There are 5 more retries left.
Connect timed out
SSH Connection failed with IOException: "Connect timed out", retrying in 15 seconds. There are 4 more retries left.
Connect timed out
SSH Connection failed with IOException: "Connect timed out", retrying in 15 seconds. There are 3 more retries left.
Connect timed out
SSH Connection failed with IOException: "Connect timed out", retrying in 15 seconds. There are 2 more retries left.
Connect timed out
SSH Connection failed with IOException: "Connect timed out", retrying in 15 seconds. There are 1 more retries left.
Connect timed out
ERROR: Connection is not established!
java.lang.IllegalStateException: Connection is not established!
    at PluginClassLoader for trilead-api//com.trilead.ssh2.Connection.getRemainingAuthMethods(Connection.java:989)
    at PluginClassLoader for ssh-credentials//com.cloudbees.jenkins.plugins.sshcredentials.impl.TrileadSSHPublicKeyAuthenticator.getRemainingAuthMethods(TrileadSSHPublicKeyAuthenticator.java:89)
    at PluginClassLoader for ssh-credentials//com.cloudbees.jenkins.plugins.sshcredentials.impl.TrileadSSHPublicKeyAuthenticator.canAuthenticate(TrileadSSHPublicKeyAuthenticator.java:81)
    at java.base/java.util.stream.ReferencePipeline$2$1.accept(Unknown Source)
    at java.base/java.util.stream.ReferencePipeline$2$1.accept(Unknown Source)
    at java.base/java.util.stream.ReferencePipeline$3$1.accept(Unknown Source)
    at java.base/java.util.Spliterators$IteratorSpliterator.tryAdvance(Unknown Source)
    at java.base/java.util.stream.ReferencePipeline.forEachWithCancel(Unknown Source)
    at java.base/java.util.stream.AbstractPipeline.copyIntoWithCancel(Unknown Source)
    at java.base/java.util.stream.AbstractPipeline.copyInto(Unknown Source)
    at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source)
    at java.base/java.util.stream.FindOps$FindOp.evaluateSequential(Unknown Source)
    at java.base/java.util.stream.AbstractPipeline.evaluate(Unknown Source)
    at java.base/java.util.stream.ReferencePipeline.findFirst(Unknown Source)
    at PluginClassLoader for ssh-credentials//com.cloudbees.jenkins.plugins.sshcredentials.SSHAuthenticator.newInstance(SSHAuthenticator.java:222)
    at PluginClassLoader for ssh-credentials//com.cloudbees.jenkins.plugins.sshcredentials.SSHAuthenticator.newInstance(SSHAuthenticator.java:173)
    at PluginClassLoader for ssh-slaves//hudson.plugins.sshslaves.SSHLauncher.openConnection(SSHLauncher.java:882)
    at PluginClassLoader for ssh-slaves//hudson.plugins.sshslaves.SSHLauncher.lambda$launch$0(SSHLauncher.java:441)
    at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
    at java.base/java.lang.Thread.run(Unknown Source)

Answer 1

该日志看起来可能是防火墙问题。 您可以进入控制器并访问代理上的端口 4444 吗？ （注意，我正在处理在 WS2019 VM 上运行的 Jenkins 2.462.2 控制器的 SSH 问题，并尝试连接在 Ubuntu 22.04 VM 上运行的 Docker 代理。我可以连接，但日志始终显示被拒绝的密钥，无论我是否有RSA、ED25519，或者你有什么。）