With Gitlab, in the CI/CD pipeline, how can I dynamically create and save SSH key pairs as CI/CD project variables?

3 min read 04-10-2024

With Gitlab, in the CI/CD pipeline, how can I dynamically create and save SSH key pairs as CI/CD project variables?

Dynamically Generating SSH Key Pairs in GitLab CI/CD

Generating and managing SSH keys is a crucial part of many development workflows, especially when working with remote servers or services. In GitLab CI/CD, you often need to authenticate to external systems for tasks like deploying code or accessing databases. This article will guide you through dynamically creating and saving SSH key pairs as CI/CD project variables within your GitLab pipeline, making your workflow more efficient and secure.

The Problem: Manually Managing Keys

Traditionally, managing SSH keys in CI/CD involved manually creating and storing keys within the GitLab project's settings or hardcoding them within the CI/CD script. These methods pose several challenges:

Security risks: Storing keys directly in project settings exposes them to potential security vulnerabilities, making them accessible to unauthorized users.
Complexity: Manually managing key pairs for multiple environments or jobs within a pipeline can be cumbersome and error-prone.
Lack of control: Hardcoding keys within scripts makes it difficult to rotate or update them easily.

The Solution: Dynamic Key Generation and Variable Storage

Dynamically generating and storing SSH keys within GitLab's CI/CD environment offers a robust solution to these issues:

Generate keys within the pipeline: Use a dedicated job to create the key pair securely within the CI/CD runner environment.
Securely store keys as variables: Store the generated public and private keys as project variables, accessible only within the pipeline.
Use keys for deployments or other tasks: Leverage these variables within subsequent jobs to authenticate to external services.

Code Example: Generating and Storing Key Pairs

stages:
  - generate_keys
  - deploy

variables:
  SSH_KEY_NAME: "my-project-key"

generate_keys:
  stage: generate_keys
  image: alpine:latest
  script:
    - apk add openssh-client
    - ssh-keygen -t rsa -b 4096 -N "" -f /tmp/$SSH_KEY_NAME
    - echo "PRIVATE_KEY=$(cat /tmp/$SSH_KEY_NAME)" | tee >> $CI_PROJECT_DIR/.gitlab-ci/ssh-keys.sh
    - echo "PUBLIC_KEY=$(cat /tmp/$SSH_KEY_NAME.pub)" | tee >> $CI_PROJECT_DIR/.gitlab-ci/ssh-keys.sh
  artifacts:
    paths:
      - $CI_PROJECT_DIR/.gitlab-ci/ssh-keys.sh
  environment:
    name: $CI_COMMIT_REF_SLUG
    url: $CI_COMMIT_REF_NAME

deploy:
  stage: deploy
  image: nginx:latest
  script:
    - source $CI_PROJECT_DIR/.gitlab-ci/ssh-keys.sh
    - ssh -i /tmp/$SSH_KEY_NAME user@$HOST 'deploy_command'

Explanation:

generate_keys job: This job generates the RSA key pair with a specified length (4096 bits) and stores the public and private keys in a temporary file.
ssh-keys.sh script: The generated keys are appended to this script file, which will be used in subsequent jobs to retrieve them.
artifacts section: Ensures the ssh-keys.sh script is passed as an artifact to the next stage.
deploy job: This job retrieves the keys from the artifact, uses them to connect to the remote server, and executes the deployment command.

Best Practices

Use a separate job for key generation: This ensures a clean separation between key management and deployment tasks.
Store keys as project variables: This approach is more secure than storing keys directly in project settings.
Rotate keys regularly: Implement a mechanism to rotate SSH keys periodically for enhanced security.
Use a dedicated service for key management: Consider leveraging a dedicated service like HashiCorp Vault for centralized key management and rotation.

Benefits of Dynamic Key Generation

Enhanced security: Generating keys within the CI/CD environment reduces exposure to potential vulnerabilities.
Simplified key management: Dynamic generation eliminates the need for manual key creation and storage.
Improved flexibility: Easily adjust key lengths, algorithms, or rotation schedules as needed.
Automated workflows: Integrate key generation and management seamlessly into your CI/CD pipeline.

By implementing dynamic SSH key generation and storage within your GitLab CI/CD workflows, you can streamline your development processes, enhance security, and simplify key management tasks.