Config SSH key_data causing net-ssh issue with secrets from password manager
I'm running Kamal version 2.12.0 in a Rail project. I am managing my SSH keys in a secrets manager (1Password) rather than with local ssh key files. In my Kamal secrets, I have a SSH_PRIVATE_KEY secret defined and running kamal secrets print confirms this is set. In my deploy.yml I've told Kamal to use this private key:
# Use SSH key provided from secrets
ssh:
key_data:
- SSH_PRIVATE_KEYWhen I try to deploy though, I get an SSH error indicating in incorrect key:
ERROR (NoMethodError): Exception while executing on host [IP ADDR]: undefined method 'public_key' for an instance of OpenSSL::PKey::PKey
SSH_PRIVATE_KEY is defined in my secrets as follows:
SSH_PRIVATE_KEY=$(kamal secrets extract "private key" ${SSH_SECRETS})This results in the following formatting if I run kamal config:
:ssh_options:
:key_data:
- |-
-----BEGIN PRIVATE KEY-----
G4doCfzkkUVXb1iJxj7DApR+kMZlqtnwBHvg8c51Di9JkipRBlTTo5JFAu1X1yaecMEbUx
6CLxkjht9erQXTyw==
-----END PRIVATE KEY-----For whatever reason, the indentation formatting of this key is what is causing the error. To debug I copied the key into a string instead in my secrets file:
SSH_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----
G4doCfzkkUVXb1iJxj7DApR+kMZlqtnwBHvg8c51Di9JkipRBlTTo5JFAu1X1yaecMEbUx
6CLxkjht9erQXTyw==
-----END PRIVATE KEY-----"This also fails, HOWEVER, if I then introduce indentation as follows, it works fine:
:ssh_options:
:key_data:
- |-
-----BEGIN PRIVATE KEY-----
G4doCfzkkUVXb1iJxj7DApR+kMZlqtnwBHvg8c51Di9JkipRBlTTo5JFAu1X1yaecMEbUx
6CLxkjht9erQXTyw==
-----END PRIVATE KEY-----The issue seems to lie in how the key is passed to net-ssh, where for some reason having an extra ignored character (like a space or a dash) at the beginning of each line.
To demonstrate this even better, here is the temporary solution I have found to work around this where I use sed to prepend a dash to each line in the key:
SSH_PRIVATE_KEY=$((kamal secrets extract "private key" ${SSH_SECRETS}) | sed 's/^/-/')
:ssh_options:
:key_data:
- |-
------BEGIN PRIVATE KEY-----
-G4doCfzkkUVXb1iJxj7DApR+kMZlqtnwBHvg8c51Di9JkipRBlTTo5JFAu1X1yaecMEbUx
-6CLxkjht9erQXTyw==
------END PRIVATE KEY-----Source: basecamp/kamal