<p>I want to use SSH Authentication with Spring boot cloud config server.  Up to now, I've been running the config server in a docker container on docker swarm with no issues.</p>
<p>My organization recently decided to move everything to Openshift 3.  I am trying to get the config server deployed however I'm running into issues authenticating to Gitlab using SSH.  In the docker image, I used before I just copied the public and private SSH keys into /root/.ssh and it worked but it's not working at all in my Fabric8 generated S2I image on Openshift.</p>
<p>In Openshift I created a generic kubernetes secret called <code>cfgssh</code> which consists of the id_rsa and id_rsa.pub keys (base64 encoded)
I then mounted the secret to /root/.ssh in my deployment config/containers.  This doesn't work I'm guessing as to the user that the application is run as doesn't have read access to /root/.ssh?  This always ends up in configServer crashing after an auth exception.</p>
<p>I am able to run spring cloud configserver locally and on docker swarm without any auth issues so it's definitely not a cloud configserver config issue.</p>
<p>Has anyone else encountered/found a way around this?</p>
<p>My config is below.</p>
<p>Maven fabric8 deployment fragment:</p>
<pre class="lang-yaml prettyprint-override"><code>spec:
  replicas: 4
  template:
    spec:      
      containers:
        - env:
          - name: SPRING_PROFILES_ACTIVE
          value: qa
          volumeMounts:
            - name: cfgssh
              mountPath: ~/.ssh
              readOnly: true
          livenessProbe:
            httpGet:
              path: /actuator/health
              port: 8080
              scheme: HTTPS
            initialDelaySeconds: 180
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              path: /actuator/health
              port: 8080
              scheme: HTTPS
            initialDelaySeconds: 60
            timeoutSeconds: 5
          resources:
            requests:
              memory: &quot;64Mi&quot;
            limits:
              memory: &quot;256Mi&quot;
          env:
            - name: JAVA_OPTIONS
              value: &quot;-Xms64M -Xmx256M&quot;
      volumes:
        - name: cfgssh
          secret:
            secretName: cfgssh
            items:              
              - key: id_rsa
                path: id_rsa
              - key: id_rsa.pub
                path: id_rsa.pub
</code></pre>

<p>Assuming that it's using the ssh client in the container (you didn't specify the image that you are using), my guess is that whatever user that you are running as is not <code>root</code>. You can just check what the default user is for the container by exec-ing into it</p>
<pre class="lang-sh prettyprint-override"><code>$ kubectl exec -it &lt;pod-name&gt; -c &lt;container-name&gt; sh
$ whoami
</code></pre>
<p>Having said that, mounting on <code>~/.ssh</code> should work (you check when you exec into the pod/container). So I think you might have the wrong permissions for your <code>id_rsa</code> file. (They need to be <code>0600</code>). Make sure of that in your <code>volumes</code> section:</p>
<pre class="lang-yaml prettyprint-override"><code>      volumes:
        - name: cfgssh
          secret:
            secretName: cfgssh
            defaultMode: 0600 &lt;= add this
            items:              
              - key: id_rsa
                path: id_rsa
              - key: id_rsa.pub
                path: id_rsa.pub
</code></pre>
<p>Reference: <a href="https://kubernetes.io/docs/concepts/configuration/secret/#secret-files-permissions" rel="nofollow noreferrer">secrets file permissions</a>.</p>
