GitLab CI/CD集成Kaniko与SSH密钥构建Go镜像遇OPENSSH错误求助

我尝试通过GitLab CI/CD和Kaniko构建Golang项目镜像，项目依赖需要SSH密钥访问的私有Git仓库，执行go mod download或go build时会用到该密钥。操作步骤如下：

1. 用ssh-keygen生成密钥对，公钥添加至私有GitLab仓库
2. 在GitLab创建CI变量PRIVATE_KEY，存入私钥内容
3. 通过Kaniko executor的build-arg参数将PRIVATE_KEY传递至构建环境
4. 在Dockerfile中将传入的KEY写入~/.ssh/id_ed25519

但构建失败，Kaniko抛出错误：Error: unknown command "OPENSSH" for "executor"，我并未使用OPENSSH命令，对此感到困惑。

我的配置文件 #

.gitlab-ci.yml

build-image:
  stage: build_image
  image:
    name: xxxxx/kaniko-executor:release
    entrypoint: [""]
  script:
    - pwd
    - echo "start build images"
    - mkdir -p ~/.docker/
    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}" > ~/.docker/config.json
    - cat ~/.docker/config.json   
    - cd $CI_PROJECT_DIR

    - IMAGE=$IMAGE_BASE/golang-test:$CI_COMMIT_SHORT_SHA
    - echo "generate docker image $IMAGE"
    - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/docker/Dockerfile --destination $IMAGE --validate-image --build-arg KEY=$PRIVATE_KEY

  after_script:
    - echo "build images completed."
  when: on_success
  only:
    - tags

Dockerfile

FROM  xxxxxx/golang:1.19.9-alpine as builder
# use KEY to hold the PRIVATE_KEY
ARG KEY
ENV CGO_ENABLED=0
ENV GOPRIVATE=xxxxxx
ENV GOPROXY=https://goproxy.cn,direct
RUN apk update
RUN apk add git openssh gcc g++
RUN git config --global url."git@xxxxx:".insteadOf https://xxxxx

# put the PRIVATE_KEY to .ssh
RUN mkdir -p ~/.ssh
RUN echo $KEY
RUN echo $KEY > ~/.ssh/id_ed25519
RUN chmod 600 ~/.ssh/id_ed25519
RUN ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts
RUN ssh-keyscan -t rsa xxxxx >> ~/.ssh/known_hosts

RUN mkdir -p /app
WORKDIR /app

COPY ./* ./
RUN go mod download
RUN go build

FROM xxxxxx/alpine-base:0.1
RUN mkdir -p /home/work/bin/golang-test
WORKDIR /home/work
COPY --from=builder /app/golang-test /home/work/bin/golang-test/
COPY --from=builder /app/deploy/* /home/work/bin/golang-test/
RUN ls -l /home/work/bin/golang-test/

CMD ["/home/work/bin/golang-test/start.sh"] 

错误原因分析 #

SSH私钥是多行文本（开头为-----BEGIN OPENSSH PRIVATE KEY-----），直接通过--build-arg KEY=$PRIVATE_KEY传递时，Shell会把私钥的换行符解析为命令分隔符，导致Kaniko executor误将私钥第一行的“OPENSSH”当作要执行的命令，从而触发报错。

解决步骤 #

方法1：通过上下文传递SSH私钥（推荐） #

这种方式避免了命令行传递多行文本的问题，更安全可靠：

1. 修改.gitlab-ci.yml，在执行Kaniko前将私钥写入上下文目录的临时文件：

build-image:
  stage: build_image
  image:
    name: xxxxx/kaniko-executor:release
    entrypoint: [""]
  script:
    - pwd
    - echo "start build images"
    - mkdir -p ~/.docker/
    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}" > ~/.docker/config.json
    - cat ~/.docker/config.json   
    - cd $CI_PROJECT_DIR

    # 新增：将私钥写入上下文目录的临时文件，设置安全权限
    - echo "$PRIVATE_KEY" > ./docker/ssh-key
    - chmod 600 ./docker/ssh-key

    - IMAGE=$IMAGE_BASE/golang-test:$CI_COMMIT_SHORT_SHA
    - echo "generate docker image $IMAGE"
    - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/docker/Dockerfile --destination $IMAGE --validate-image

  after_script:
    - echo "build images completed."
    # 清理临时私钥文件，避免泄露
    - rm -f ./docker/ssh-key
  when: on_success
  only:
    - tags

2. 修改Dockerfile，从上下文复制私钥，不再使用build-arg：

FROM  xxxxxx/golang:1.19.9-alpine as builder
ENV CGO_ENABLED=0
ENV GOPRIVATE=xxxxxx
ENV GOPROXY=https://goproxy.cn,direct
RUN apk update
RUN apk add git openssh gcc g++
RUN git config --global url."git@xxxxx:".insteadOf https://xxxxx

# 从上下文复制私钥到指定路径
RUN mkdir -p ~/.ssh
COPY docker/ssh-key ~/.ssh/id_ed25519
RUN chmod 600 ~/.ssh/id_ed25519
RUN ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts
RUN ssh-keyscan -t rsa xxxxx >> ~/.ssh/known_hosts

RUN mkdir -p /app
WORKDIR /app

COPY ./* ./
RUN go mod download
RUN go build

# 构建完成后立即删除私钥，避免留在镜像层
RUN rm -f ~/.ssh/id_ed25519

FROM xxxxxx/alpine-base:0.1
RUN mkdir -p /home/work/bin/golang-test
WORKDIR /home/work
COPY --from=builder /app/golang-test /home/work/bin/golang-test/
COPY --from=builder /app/deploy/* /home/work/bin/golang-test/
RUN ls -l /home/work/bin/golang-test/

CMD ["/home/work/bin/golang-test/start.sh"] 

方法2：转义私钥的换行符（不推荐，易出问题） #

如果必须使用build-arg，需要先将私钥的换行符转义为\n，再传递：

# 在.gitlab-ci.yml中修改build-arg传递方式
- /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/docker/Dockerfile --destination $IMAGE --validate-image --build-arg KEY="$(echo "$PRIVATE_KEY" | sed 's/\n/\\n/g')"

然后在Dockerfile中用echo -e解析转义的换行符：

RUN echo -e $KEY > ~/.ssh/id_ed25519

GitLab CI/CD + Kaniko + SSH密钥集成最佳实践 #

• 优先使用GitLab项目访问令牌替代SSH密钥：在私有Git仓库创建项目访问令牌（权限设为read_repository），通过HTTPS方式传递令牌，无需处理SSH配置：

  RUN git config --global url."https://oauth2:${PRIVATE_TOKEN}@xxxxx/".insteadOf https://xxxxx/
  

  将PRIVATE_TOKEN作为GitLab CI变量传递，更简洁安全。

• 构建后强制清理敏感信息：在Dockerfile的builder阶段完成依赖下载和编译后，立即删除SSH密钥或访问令牌，避免敏感数据留在镜像层中。

• 最小化镜像层：合并多个RUN命令，减少镜像层数的同时，避免敏感信息被留在历史层（例如将SSH配置、依赖下载的命令合并为一个RUN块）。

• 使用GitLab CI的SSH代理（自托管Runner场景）：利用GitLab CI的ssh-agent服务启动代理并添加私钥，Kaniko构建时通过挂载代理套接字复用SSH连接，减少重复配置。

内容的提问来源于stack exchange，提问作者L.Maple