Secure Git Repositories

Use SSH keys to secure Git repositories that contain configuration information. Git-based configuration sources allow you to define the name of a Kubernetes secret in the same namespace containing your private SSH key.

Procedure

  1. Create an SSH key pair with the following command:
    ssh-keygen -t ed25519
    You are prompted to enter a location to save the keys. The default is an .ssh directory in your home directory.
  2. (Optional) Supply a passphrase.
  3. Create a known_hosts file within the secret allowing access to the Git repository server. This file can be created using the following command:
    ssh-keyscan -H gitlab.acme.com >> known_hosts
  4. Create the secret from the private key file, the known_hosts file, and the passphrase (if you specified one when creating the SSH key) with the following command:
    kubectl create secret generic acme-gitlab-sshkey --from-file id_ed25519 --from-file known_hosts --from-literal=passphrase=mypassphrase

What to do next

If you are unable to use SSH keys for securing access to your Git repository, use the repositoryCredentials.secretName property to reference a Kubernetes secret, the contents of which are copied to ~/.config/git within the initContainer. This can include a credentials file that can be used to store your Git repository user credentials. See Git documentation for more information.