Jenkins连接JetBrains Space Git仓库时Host key验证失败

问题描述 #

尝试搭建Jenkins流水线，通过SSH克隆JetBrains Space代码仓库时，持续触发「Host key verification failed」错误。相关Jenkinsfile代码如下：

pipeline {
    agent any

    environment {
        DOCKER_BUILDKIT = "1"
    }

    stages {
        stage('Checkout') {
            steps {
                script {
                    withCredentials([sshUserPrivateKey(credentialsId: 'space-ssh-key', keyFileVariable: 'SSH_PRIVATE_KEY')]) {
                        sh '''
                            mkdir -p ~/.ssh
                            echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
                            chmod 600 ~/.ssh/id_rsa
                            git clone ssh://git@git.jetbrains.space/my-proj/main/my-rpoj.git .
                        '''
                    }
                }
            }
        }
        stage('Build Docker Images') {
            steps {
                script {
                    sh 'chmod +x ./build/build-docker-images.kts'
                    sh './build/build-docker-images.kts'
                }
            }
        }
        stage('Deploy Application') {
            steps {
                script {
                    sshagent(['space-ssh-key']) {
                        sh '''
                            scp -r . ${env.DEPLOY_USER}@${env.DEPLOY_SERVER}:/var/www/app
                            ssh ${env.DEPLOY_USER}@${env.DEPLOY_SERVER} << EOF
                              cd /var/www/app
                              docker-compose down
                              docker-compose up -d
                            EOF
                        '''
                    }
                }
            }
        }
    }
}

错误信息如下：

Failed to connect to repository: Command "git ls-remote -h -- ssh://git@git.jetbrains.space/myproj-dev/main/myproj.git HEAD" returned status code 128:
stdout:
stderr: No RSA host key is known for git.jetbrains.space and you have requested strict checking.
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

已验证：Jenkins中SSH私钥配置正确；主机密钥已添加至本地_{/.ssh/known_hosts；在Jenkins服务器上手动执行命令可正常运行。尝试过的操作包括：手动添加主机密钥到}/.ssh/known_hosts；在Jenkinsfile中加入ssh-keyscan步骤添加主机密钥。

解决方案 #

1. 确认Jenkins运行用户的known_hosts包含目标主机密钥 #

Jenkins通常以jenkins用户身份运行，你手动添加的主机密钥可能在自己的用户目录下，而非Jenkins用户的目录。执行以下操作：

• 切换到Jenkins用户：sudo su - jenkins
• 生成并添加主机密钥：ssh-keyscan git.jetbrains.space >> ~/.ssh/known_hosts
• 验证：执行ssh git@git.jetbrains.space，确认主机验证通过

2. 在流水线中显式添加主机密钥到构建环境 #

如果使用临时agent或每次构建环境重置，可在Checkout阶段的脚本中主动添加主机密钥：
修改Checkout阶段的代码如下：

stage('Checkout') {
    steps {
        script {
            withCredentials([sshUserPrivateKey(credentialsId: 'space-ssh-key', keyFileVariable: 'SSH_PRIVATE_KEY')]) {
                sh '''
                    mkdir -p ~/.ssh
                    echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
                    chmod 600 ~/.ssh/id_rsa
                    # 添加JetBrains Space主机密钥到known_hosts
                    ssh-keyscan git.jetbrains.space >> ~/.ssh/known_hosts
                    chmod 644 ~/.ssh/known_hosts
                    git clone ssh://git@git.jetbrains.space/my-proj/main/my-rpoj.git .
                '''
            }
        }
    }
}

3. 解决Jenkins SCM预检查的问题 #

错误信息中的git ls-remote是Jenkins在流水线执行前的SCM预检查，并非来自你写的clone步骤：

• 如果你的Jenkins项目配置了「源代码管理」中的Git仓库，需要在此处配置包含主机密钥验证的SSH凭证，或在Jenkins全局配置中添加git.jetbrains.space的主机密钥
• 另一种方式是移除Jenkins项目的源代码管理配置，完全通过流水线中的Checkout阶段完成代码拉取，避免触发预检查

4. 使用Jenkins插件管理主机密钥 #

• 安装「Known Hosts File Manager」插件，在Jenkins全局配置中添加git.jetbrains.space的主机密钥，让所有流水线自动继承该配置
• 或使用「SSH Agent」插件结合主机密钥凭证，确保流水线中的SSH操作能自动识别主机密钥

内容的提问来源于stack exchange，提问作者llotall