Possible to add a single workspace SSH key for many pipeline deployments?

Question

I have a server with many different projects running on it, and am wondering if there's a way to configure an SSH user at the workspace level to run deployments.

It's a pain to generate a new key for each repo and add to authorized_keys for my deployment user, and if I ever needed to invalidate those keys, I would need to go through every repo and generate a new one.

I'm just hoping there's an easier way to do this. The other alternative I thought of was to save a key as a workspace environment variable, and then pass it to the various pipelines that way, but it seems there are security issues with this method, so I was hoping to avoid it.

Thanks in advance!

bobby jenrow_drpaod · Answer

@Syahrul That makes sense to me. Thanks!

Syahrul · Answer

Thanks @bobby jenrow

You can use workspace variables to add the utilise that can be utilised with all pipeline builds within your workspace. You can find them at

https://bitbucket.org/<WorkspaceName>/workspace/settings/pipelines/account-variables

However, it's important to note that currently, there is no single SSH key for workspace-level usage that can be employed across multiple pipelines. The SSH key provided under workspace settings is primarily intended for pushing changes to Bitbucket and is not meant for deployment purposes.

Therefore, I recommend utilizing the workspace variables for your current needs.

Regards,
Syahrul

bobby jenrow_drpaod · Answer

I want to deploy any number of repositories to a single server that I control.

In order to do that with pipelines, I set up an SSH key in each repository, register the ip address / fingerprint, and use it within my Bitbucket pipelines file. Then I need to go to my server and add the public key to my deployment user's ~/.ssh/authorized_keys

It would be nice to be able to set the SSH key up as a workspace variable that can be used from any bitbucket pipeline yml within the workspace. This way, when we migrate servers, we don't have to go back  into each repo individually and update the project with a new key.