Terragrunt/-form clone in Gitlab pipeline when using git::ssh://git@ for module source

Question

I have a pipeline where I want to run terragrunt. I so far run everything local and use ssh to authenticate against Gitlab. Therefore, in my Terraform modules, I also use a git::ssh URL like below.

module "data_org" {
  source = "git::ssh://[email protected]/bar/xdf/terraform_modules.git//modules/data_org?ref=develop"
}

Now, I do not know how to port this to a Gitlab pipeline. I would prefer using short-lived pipeline credentials like the Gitlab job token, but do not know how to make use of it. Did anybody know how to use this with Terraform?

What I come across already:

Update 2023-10-26 https: I tested git config --global url.https://gitlab-ci-token:${CI_JOB_TOKEN}@git.foobar.de.insteadOf ssh://[email protected] and got a bit further. Now I get the error "not found" for the repository, and I assume the problem is the .git suffix at the end. I do not know how to get rid of it yet but hope this is solvable.

I haven't tried with SSH but with HTTPS this seems to be a plausible solution.. You could add a stage before terraform init to update the ~/.gitconfig file.. — harshavmb
– harshavmb, Commented Oct 26, 2023 at 7:35
TO lxop secrets for git may be an option but rather complex. This would be my last resort. TO harashavmb if this works with job tokens, this would be wonderful. I try it out later in the day. — lony
– lony, Commented Oct 26, 2023 at 7:54

lony · Accepted Answer · 2023-12-08 09:51:50Z

3

Credits to @harshavmb from the comment above for his recommendation of insteadOf which solved the problem.

The solution was twofold

a) Using git config --global url.https://gitlab-ci-token:${CI_JOB_TOKEN}@git.foobar.de.insteadOf ssh://[email protected] so my ssh URL was rewritten to an HTTP one using the Gitlab job token to authenticate.
b) Allow access needs to happen from the target repos side. Meaning I want to clone repo A but my pipeline and the job token is in repo B. To allow access I have to allow access in repo A so B can "access" it. The settings are under Settings->CI/CD->Token Access.

edited Dec 8, 2023 at 9:51

answered Oct 26, 2023 at 12:05

lony

7,94913 gold badges72 silver badges109 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Nicollas Braga Over a year ago

Hey Lony I think you could accept your own answer, it fits perfectly. Maybe also add a reference to @harshavamb links as it explains that .insteadOf is required and a reserved world for the command. I was a bit in doubt if insteadOf was a mistake, example or part of the command and had to go check his link to make sure.

lony Over a year ago

Did so and hope it helps other readers as well. Thanks for your feedback!

Collectives™ on Stack Overflow

Terragrunt/-form clone in Gitlab pipeline when using git::ssh://git@ for module source

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related