Jenkins: how to configure initial admin with ssh publickey by script? - jenkins

Question

I have this groovy script to initialize my Jenkins server:
def hudsonRealm = new HudsonPrivateSecurityRealm(false) ;
hudsonRealm.createAccount('admin','admin')
instance.setSecurityRealm(hudsonRealm)
def strategy = new FullControlOnceLoggedInAuthorizationStrategy()
instance.setAuthorizationStrategy(strategy)
This will create a "admin/admin" user at initial startup of my Jenkins instance.
How do I complete this to add my SSH public key to the user "admin"?
The objective is to be able to use the "ssh admin#jenkins" to run commands after the config, like explained here: https://www.jenkins.io/doc/book/managing/cli/#ssh
PS: I know I can do it manually through the web interface, I am looking for a mean to do that by script.

Answer 1

I found this set of scripts here: https://gist.github.com/nigimaster/6a014c62b444fe7a7744304d66881451
I post here the full commands with comments:
//
// Create initial admin with username/password = admin/password
//
// thanks to https://gist.github.com/hayderimran7/50cb1244cc1e856873a4
//
def hudsonRealm = new HudsonPrivateSecurityRealm(false) ;
hudsonRealm.createAccount('admin','password')
instance.setSecurityRealm(hudsonRealm)
def strategy = new FullControlOnceLoggedInAuthorizationStrategy()
instance.setAuthorizationStrategy(strategy)
//
// Add ssh key to admin
//
// thanks to #nigimaster https://gist.github.com/nigimaster/6a014c62b444fe7a7744304d66881451
//
def user = hudson.model.User.get('admin')
user.addProperty(new org.jenkinsci.main.modules.cli.auth.ssh.UserPropertyImpl(
/** your public key content: ssh-rsa AA... */
))
user.save()
//
// Allow connection over ssh
//
// thanks to https://github.com/jenkins-infra/jenkins-infra/blob/staging/dist/profile/files/buildmaster/enable-ssh-port.groovy
//
def sshConfig = instance.getDescriptor('org.jenkinsci.main.modules.sshd.SSHD')
sshConfig.port = 22
sshConfig.save()
This file is saved at /usr/share/jenkins/ref/init.groovy.d/customize.groovy (at least in the docker file).
Security advice: you should parametrize your groovy file to not have the passwords stored in it. Public key should not be a problem.

Answer 2

Using "Configuration as code", this is possible with this config:
jenkins:
authorizationStrategy:
loggedInUsersCanDoAnything:
allowAnonymousRead: false
securityRealm:
local:
allowsSignup: false
users:
- id: admin
name: ${ADMIN_USER}
password: ${ADMIN_PASSWORD}
properties:
- sshPublicKey:
authorizedKeys: ${readFile:/conf/generated/authorized_keys}
security:
sSHD:
port: 22
See https://github.com/jenkinsci/configuration-as-code-plugin