<p>I have a CI system set up using the <a href="https://github.com/helm/charts/tree/master/stable/jenkins" rel="nofollow noreferrer">stable Jenkins Helm chart</a> with the BlueOcean plugin.</p>

<p>In my SCM system (BitBucket Server), I have a Jenkins build user created with SSH keys configured.</p>

<p>What I'd like to do is bootstrap the Jenkins install with the SSH key so that when configuring a BlueOcean pipeline, authentication is handled seamlessly.  As it is, I have to go in to the repository I want to build and add access for the SSH key generated by BlueOcean.  This is obviously not ideal as it adds an additional manual step for <em>each</em> build pipeline to be configured.</p>

<p>The Jenkins Helm chart documentation specifies an <code>Agent.volumes</code> value in <code>values.yaml</code> that can be used to mount, for instance, a Kubernetes secret containing the SSH keys.  However, this is <em>agent</em> configuration, so presumably would allow for SCM authentication from a build agent (e.g., from a Jenkinsfile).  What I want to do is bootstrap the keys into Jenkins <em>master</em>.</p>

<p>I see that there is a <code>Master.CredentialsXmlSecret</code> which allows for a Kubernetes secret containing a Credentials XML file, but the documentation on this is sparse (or non-existent).</p>

<p>Has anyone set up Jenkins on Kubernetes/Helm with this kind of SSH configuration?</p>

<p>*Edit: So I have managed to produce a correct <code>credentials.xml</code> file by logging in to Jenkins and manually setting up the SSH keys, then copying the produced <code>credentials.xml</code> file, running it through <code>base64</code> encoding, adding it as a Kubernetes secret and then binding it to <code>Master.CredentialsXmlSecret</code> in the Jenkins Helm chart's <code>values.yaml</code>.  After doing that, my Jenkins instance loads up with the <code>credentials.xml</code> file in place (<code>/var/jenkins_home/credentials.xml</code>).  The Credentials don't appear to be loading into the Jenkins UI correctly but I think I'm on the right track.</p>

LiquidPony
<p>You can probably set it up with an API call to bitbucket to set up the SSH key. Something like this with API 1.0</p>

<pre><code>$ curl --user &lt;USER&gt;:&lt;PASSWORD&gt; -X POST \
  https://bitbucket.org/api/1.0/users/&lt;USER&gt;/ssh-keys \
  --data-urlencode "key=&lt;PUBLIC_KEY&gt;" \
  --data-urlencode "label=&lt;LABEL&gt;"
</code></pre>

<p>Documented <a href="https://confluence.atlassian.com/bitbucket/ssh-keys-resource-296911735.html" rel="nofollow noreferrer">here</a>, or API 2.0:</p>

<pre><code> $ curl -X POST -H "Content-Type: application/json" \
   -d '{"key": "ssh-ed25519 ...."}' \
   https://api.bitbucket.org/2.0/users/&lt;USER&lt;/ssh-keys
</code></pre>

<p>Documented <a href="https://developer.atlassian.com/bitbucket/api/2/reference/resource/users/%7Busername%7D/ssh-keys" rel="nofollow noreferrer">here</a></p>

<p>Not sure what type of permissions you are looking for but you may want <a href="https://developer.atlassian.com/bitbucket/api/2/reference/resource/repositories/%7Busername%7D/%7Brepo_slug%7D/pipelines_config/ssh/key_pair" rel="nofollow noreferrer">a repo SSH key pair</a> for Jenkins Blue Ocean pipelines.</p>

<p>In either case, you will have to build your custom docker image with an <a href="https://docs.docker.com/engine/reference/builder/#entrypoint" rel="nofollow noreferrer">entrypoint</a> script that picks up the ssh key generated and posts it wherever you want to post it.</p>
