Tekton、プライベートなGitレポジトリを扱う方法と仕組みについて

# https://github.com/tektoncd/catalog/blob/main/task/git-clone/0.5/git-clone.yaml
  workspaces:
    - name: output
      description: The git repo will be cloned onto the volume backing this Workspace.
    - name: ssh-directory
      optional: true
      description: |
        A .ssh directory with private key, known_hosts, config, etc. Copied to
        the user's home before git commands are executed. Used to authenticate
        with the git remote when performing the clone. Binding a Secret to this
        Workspace is strongly recommended over other volume types.        

# https://github.com/tektoncd/catalog/blob/main/task/git-clone/0.5/git-clone.yaml
  steps:
    - name: clone
      image: "$(params.gitInitImage)"
      env:
      ...
      - name: WORKSPACE_SSH_DIRECTORY_BOUND
        value: $(workspaces.ssh-directory.bound)
      - name: WORKSPACE_SSH_DIRECTORY_PATH
        value: $(workspaces.ssh-directory.path)
      ...

# https://github.com/tektoncd/catalog/blob/main/task/git-clone/0.5/git-clone.yaml
if [ "${WORKSPACE_SSH_DIRECTORY_BOUND}" = "true" ] ; then
  cp -R "${WORKSPACE_SSH_DIRECTORY_PATH}" "${PARAM_USER_HOME}"/.ssh
  chmod 700 "${PARAM_USER_HOME}"/.ssh
  chmod -R 400 "${PARAM_USER_HOME}"/.ssh/*
fi

kind: Secret
apiVersion: v1
metadata:
  name: my-ssh-credentials
data:
  id_rsa: <base64でエンコードされた秘密鍵>
  known_hosts: <base64ででエンコードされたknown_hosts>

apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: my-pipeline 
spec:
  workspaces:
    - name: shared-workspace
    - name: ssh-cred
  #...
  tasks:
    - name: fetch-repository
      taskRef:
        name: git-clone
      workspaces:
        - name: output
          workspace: shared-workspace
        - name: ssh-directory
          workspace: ssh-cred
      params:
        - name: url
          value: $(params.git-url)
        - name: deleteExisting
          value: "true"
        - name: revision
          value: $(params.git-revision)

apiVersion: v1
kind: Secret
metadata:
  name: my-ssh
  annotations:
    tekton.dev/git-0: github.com
type: kubernetes.io/ssh-auth
stringData:
  ssh-privatekey: <private-key>
  known_hosts: <known-hosts>

$ kubectl get sa pipeline -o yaml
apiVersion: v1
imagePullSecrets:
- name: pipeline-dockercfg-5hww7
kind: ServiceAccount
metadata:
  creationTimestamp: "2022-01-24T07:01:01Z"
  name: pipeline
  namespace: cicd-demo
  ownerReferences:
  - apiVersion: operator.tekton.dev/v1alpha1
    blockOwnerDeletion: true
    controller: true
    kind: TektonInstallerSet
    name: rbac-resources
    uid: a90a96f6-5ca5-4823-b3bd-46e21d8161b8
  resourceVersion: "145756"
  uid: 40c66ae7-9a4a-46ea-bc4e-7a8224f12402
secrets:
- name: pipeline-token-fp78s
- name: pipeline-dockercfg-5hww7
- name: my-ssh

## sleep-task.yaml
apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: sleep-task
spec:
  steps:
    - name: sleep
      image: fedora:latest
      command: ["sleep"]
      args: ["3600"]

## sleep-task-run.yaml
apiVersion: tekton.dev/v1beta1
kind: TaskRun
metadata:
  name: sleep-task-run
spec:
  taskRef:
    name: sleep-task

$ kubectl apply -f sleep-task.yaml
task.tekton.dev/sleep-task created

$ kubectl apply -f sleep-task-run.yaml
taskrun.tekton.dev/sleep-task-run created

$ kubectl get pod
NAME                             READY   STATUS      RESTARTS   AGE
sleep-task-run-pod-spz2n         1/1     Running     0          25s

$ kubectl exec -it sleep-task-run-pod-spz2n -- bash
[root@sleep-task-run-pod-slq52 ~]#
[root@sleep-task-run-pod-slq52 ~]# ls -l /tekton/creds-secrets/my-ssh/
total 0
lrwxrwxrwx. 1 root 1000670000 21 Jan 24 09:21 ssh-privatekey -> ..data/ssh-privatekey
[root@sleep-task-run-pod-slq52 ~]#
[root@sleep-task-run-pod-slq52 ~]# ls -al /tekton/creds/.ssh/
total 8
drwxr-sr-x. 2 root 1000670000   80 Jan 24 14:36 .
drwxrwsrwt. 4 root 1000670000   80 Jan 24 14:36 ..
-rw-------. 1 root 1000670000   98 Jan 24 14:36 config
-rw-------. 1 root 1000670000 1675 Jan 24 14:36 id_my-ssh
[root@sleep-task-run-pod-slq52 ~]#
[root@sleep-task-run-pod-slq52 ~]# #のちほど説明するが、ホームディレクトリにクレデンシャル等がコピーされている
[root@sleep-task-run-pod-slq52 ~]# ls -al /root/.ssh/
total 8
drwx------. 2 root root   37 Jan 24 09:21 .
dr-xr-x---. 1 root root   33 Jan 24 09:21 ..
-rw-------. 1 root root   98 Jan 24 09:21 config
-rw-------. 1 root root 1675 Jan 24 09:21 id_my-ssh
[root@sleep-task-run-pod-slq52 ~]#
[root@sleep-task-run-pod-slq52 ~]# cat /root/.ssh/config
Host github.com
    HostName github.com
    Port 22
    IdentityFile /tekton/creds/.ssh/id_my-ssh
[root@sleep-task-run-pod-slq52 ~]#
[root@sleep-task-run-pod-slq52 ~]# cat /root/.ssh/id_my-ssh
-----BEGIN RSA PRIVATE KEY-----
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-----END RSA PRIVATE KEY-----

  containers:
  - args:
    - -wait_file
    - /tekton/downward/ready
    - -wait_file_content
    - -post_file
    - /tekton/tools/0
    - -termination_path
    - /tekton/termination
    - -step_metadata_dir
    - /tekton/steps/step-sleep
    - -step_metadata_dir_link
    - /tekton/steps/0
    - -docker-cfg=pipeline-dockercfg-5hww7
    - -ssh-git=my-ssh=github.com
    - -entrypoint
    - sleep
    - --
    - "3600"
    command:
    - /tekton/tools/entrypoint

	// Copy credentials we're expecting from the legacy credentials helper (creds-init)
	// from secret volume mounts to /tekton/creds. This is done to support the expansion
	// of a variable, $(credentials.path), that resolves to a single place with all the
	// stored credentials.
	builders := []credentials.Builder{dockercreds.NewBuilder(), gitcreds.NewBuilder()}
	for _, c := range builders {
		if err := c.Write("/tekton/creds"); err != nil {
			log.Printf("Error initializing credentials: %s", err)
		}
	}

  // Copy any creds injected by the controller into the $HOME directory of the current
  // user so that they're discoverable by git / ssh.
  if err := credentials.CopyCredsToHome(credentials.CredsInitCredentials); err != nil {
  	log.Printf("non-fatal error copying credentials: %q", err)
  }