Origin: About the ssh support in router

[thincal]

After deployed the gerrit following below definitions in openshift, I want to do the git clone like this:

git clone ssh://[email protected]:29418/hello-gerrit

it reports error:

Cloning into 'hello-gerrit'...
ssh: connect to host gerrit.example.com port 29418: No route to host
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

might be I should change to use the route about 29418 like this:

git clone ssh://[email protected]/hello-gerrit

it will report to need the password:

Cloning into 'hello-gerrit'...
[email protected]'s password: 

What do you think about that ? are there any suggestions or thoughts ? many thanks.

P.S.
The gerrit pod is exposing the container ports as bellow:

ports:
  - containerPort: 8080
    protocol: TCP
  - containerPort: 29418
    protocol: TCP

The service definition as here

apiVersion: v1
kind: Service
metadata:
  name: gerrit
  labels:
    app: gerrit
spec:
  ports:
  - name: web-tcp
    port: 8080
    protocol: TCP
    targetPort: 8080
  - name: ssh-tcp
    port: 29418
    protocol: TCP
    targetPort: 29418
  selector:
    name: gerrit-server
  sessionAffinity: None
  type: ClusterIP

The gerrit route definition as here

apiVersion: v1
kind: Route
metadata:
  name: gerrit
spec:
  host: gerrit.example.com
  port:
    targetPort: web-tcp
  to:
    kind: Service
    name: gerrit

The gerrit-ssh route definition as here

apiVersion: v1
kind: Route
metadata:
  name: gerrit-ssh
spec:
  host: gerrit-ssh.example.com
  port:
    targetPort: ssh-tcp
  to:
    kind: Service
    name: gerrit

[thincal]

so there is no way to support the ssh in openshift, right ?

[mfojtik]

@thincal I think what you need here is to set the source secret for the git server.

[thincal]

@mfojtik thanks for your info, the section describe how to let openshift build access the external git repo. My case is that the git repo is running as a service inside the openshift, how to git clone it through the ssh protocol.

[mfojtik]

@thincal if you can create the secret with SSH key you can use to authenticate against that SSH server and use it as SourceSecret, then you should be able to clone from that ssh+git server.

[thincal]

for example: git clone ssh://[email protected]:29418/hello-gerrit, so it even works with a specified port number 29418? since the router only can route the traffic on 80 and 443 port...

P.S. the gerrit.example.com service is running on the openshift platform.

[mfojtik]

@thincal oh, you cannot pass the SSH traffic via 'router', but the service name should work inside cluster, so the build pod that fetch the sources should be able to use ssh://admin@gerrit:29418/hello-gerrit

[mfojtik]

@rajatchopra @mrunalp do you guys know if it is possible to use SSH via router? I think only HTTP(s) protocols are allowed right now.

[rajatchopra]

@mfojtik ssh will not work through the router today. It's not about http only, the problem with TCP routing is figuring out which app it is meant for.

[thincal]

@rajatchopra @mfojtik
so that does it mean the services can't be accessed by ssh:// protocol ? why is there this limitation by the router ? could you share the reason behind ?
You know if deploying a Git server inside the OpenShift, but it's very common to use the ssh for git clone.

[rajatchopra]

If it is TLS with SNI headers present then no problem, only thing that we listen on port 443 only (not 22 or anything else)

[thincal]

thanks! so what is your recommended way to deploy the git server with ssh protocol support?

[thincal]

@deads2k @mfojtik so is there any plan/consideration to support the ssh:// in router (OpenShift origin)?
thanks.

[rajatchopra]

There are no plans for a special support for ssh in the openshift router. There are plans to support tcp routing soon which should cover ssh too. See this work: #9454
The only alternative until then is to have ssh tunnel through https. The client needs to provide SNI though (e.g. use ssh with stunnel).

Please do not hesitate to re-open the issue if anything is unresolved.