Gitlab CICD使用ssh executor

前言

之所以使用ssh executor是为了代替shell executor。因为shell executor不太好取消流水线，往往要等到超时了才能终止。
关于修改配置文件的操作可能不太规范，具体没有研究过。

具体操作

1. 修改Gitlab Runner为使用gitlab-runner用户执行，避免修改root相关配置

参考如下

[Unit]
Description=GitLab Runner
ConditionFileIsExecutable=/usr/bin/gitlab-runner

After=network.target

[Service]
StartLimitInterval=5
StartLimitBurst=10
ExecStart=/usr/bin/gitlab-runner "run" "--config" "/home/gitlab-runner/config.toml" "--working-directory" "/home/gitlab-runner"
User=gitlab-runner
Group=gitlab-runner

Restart=always

RestartSec=120
EnvironmentFile=-/etc/sysconfig/gitlab-runner

[Install]
WantedBy=multi-user.target

2. 将配置文件改到gitlab-runner用户目录下，避免读取配置文件失败

sudo mv /etc/gitlab-runner/config.toml /home/gitlab-runner
sudo chown gitlab-runner /home/gitlab-runner/config.toml
sudo chgrp gitlab-runner /home/gitlab-runner/config.toml
# 保持原来的路径有效
sudo ln -sf /home/gitlab-runner/config.toml /etc/gitlab-runner/config.toml

3. 生成密钥

sudo -u gitlab-runner ssh-keygen -t ed25519

4. 添加公钥到authorized_keys

cat .ssh/id_ed25519.pub >> .ssh/authorized_keys

5. 添加ssh服务器的公钥到known_hosts

正常情况每次连接一台行服务器，会提示你是否记录当前的服务器指纹（防止中间人攻击）
这里相当于提前记录指纹，否则到时候cicd会出错

sudo -u gitlab-runner bash

ssh-keyscan -H localhost >> ./.ssh/known_hosts

6. 修改toml.config，启用ssh executor

完整文件参考:

concurrent = 2
check_interval = 0
connection_max_age = "15m0s"
shutdown_timeout = 0

[session_server]
  session_timeout = 1800

[[runners]]
  name = "Ubuntu-Test"
  url = #"gitlab服务器地址"
  id = 1
  token = #"服务器token"
  token_obtained_at = 2025-10-27T07:19:10Z
  token_expires_at = 0001-01-01T00:00:00Z
  executor = "ssh"
  [runners.ssh]
    host = "localhost"           # 或 127.0.0.1
    port = "22"
    user = "gitlab-runner"       # 使用 gitlab-runner 用户
    password = ""
    identity_file = "/home/gitlab-runner/.ssh/id_ed25519"
    # disable_strict_host_key_checking = true
  [runners.cache]
    MaxUploadedArchiveSize = 0
    [runners.cache.s3]
    [runners.cache.gcs]
    [runners.cache.azure]

关键段:

  [runners.ssh]
    host = "localhost"           # 或 127.0.0.1
    port = "22"
    user = "gitlab-runner"       # 使用 gitlab-runner 用户
    password = ""
    identity_file = "/home/gitlab-runner/.ssh/id_ed25519"
    # disable_strict_host_key_checking = true        # 如果不添加公钥到known_hosts则需要设置为true

7. 重启服务

sudo systemctl daemon-reload
sudo systemctl restart gitlab-runner.service