1. Answers
  2. Providing SSH keys for Git repositories access within pods

How Do I Provide SSH Keys for Git Repositories Access Within Pods?

Introduction

Accessing private Git repositories from within Kubernetes pods often requires the use of SSH keys. This is essential for automating deployments and managing code securely. In this guide, we’ll explore how to provide SSH keys to Kubernetes pods using Kubernetes Secrets, ensuring secure and efficient access to your repositories.

Step-by-Step Explanation

To securely provide SSH keys to Kubernetes pods, follow these structured steps:

  1. Create a Kubernetes Secret:

    • Store the SSH private key securely in a Kubernetes Secret. This secret will be mounted into the pod, allowing it to access private Git repositories.

  2. Create a Kubernetes Pod:

    • Define a pod that mounts the secret as a volume. This setup allows the pod to utilize the SSH key for Git operations.

Detailed Steps

  1. Create a Kubernetes Secret:

    • Define the SSH private key within your application code.
    • Use Pulumi to create a Kubernetes Secret to store this key. The secret will be referenced in the pod configuration.

  2. Create a Kubernetes Pod:

    • Define a Kubernetes Pod specification that includes a container running a Git client.
    • Mount the SSH key secret as a volume within the pod.
    • Configure the container to use the SSH key for accessing the Git repository.

Pulumi Program

Below is a Pulumi program demonstrating how to implement the above steps:

import * as pulumi from "@pulumi/pulumi";
import * as k8s from "@pulumi/kubernetes";

// Define the SSH private key
const sshPrivateKey = `-----BEGIN OPENSSH PRIVATE KEY-----
YOUR_PRIVATE_KEY_HERE
-----END OPENSSH PRIVATE KEY-----`;

// Create a Kubernetes Secret to store the SSH private key
const sshKeySecret = new k8s.core.v1.Secret("ssh-key-secret", {
    metadata: {
        name: "ssh-key-secret",
    },
    stringData: {
        "ssh-privatekey": sshPrivateKey,
    },
});

// Create a Kubernetes Pod that uses the SSH key to access a Git repository
const pod = new k8s.core.v1.Pod("git-ssh-pod", {
    metadata: {
        name: "git-ssh-pod",
    },
    spec: {
        containers: [
            {
                name: "git-container",
                image: "alpine/git",
                command: ["sh", "-c", "git clone git@github.com:your/repo.git /repo && sleep 3600"],
                volumeMounts: [
                    {
                        name: "ssh-key-volume",
                        mountPath: "/root/.ssh",
                        readOnly: true,
                    },
                ],
                env: [
                    {
                        name: "GIT_SSH_COMMAND",
                        value: "ssh -i /root/.ssh/ssh-privatekey -o StrictHostKeyChecking=no",
                    },
                ],
            },
        ],
        volumes: [
            {
                name: "ssh-key-volume",
                secret: {
                    secretName: "ssh-key-secret",
                    items: [
                        {
                            key: "ssh-privatekey",
                            path: "ssh-privatekey",
                            mode: 0o600,
                        },
                    ],
                },
            },
        ],
    },
});

// Export the name of the pod
export const podName = pod.metadata.name;

Key Points

  • Security: The SSH key is stored securely as a Kubernetes Secret, minimizing exposure.
  • Ease of Use: By using Pulumi, the creation and management of Kubernetes resources are automated and streamlined.
  • Flexibility: The pod configuration allows for easy customization of Git operations.

Conclusion

By following this guide, you can securely manage SSH keys within Kubernetes pods to access private Git repositories. This method leverages Kubernetes Secrets and Pulumi to ensure your keys are safely stored and accessible only where necessary, enhancing both security and operational efficiency.

Deploy this code

Want to deploy this code? Sign up for a free Pulumi account to deploy in a few clicks.

Sign up

New to Pulumi?

Want to deploy this code? Sign up with Pulumi to deploy in a few clicks.

Sign up