如何使用密钥保险库中的SSH密钥将私有Git存储库克隆到Kubernetes Pod中？

Question

我正在尝试使用SSH密钥进行身份验证，将一个私有的Git存储库(GitLab)克隆到一个Kubernetes Pod中。我已经把我的密钥存储在一个secret中。这是执行所需任务的Job的yaml文件。

这里还有同样的问题，但没有给出确切的解决方案：

在Kubernetes Pod中克隆安全的Git仓库

执行后的init容器日志：

fetch http://dl-cdn.alpinelinux.org/alpine/v3.7/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.7/community/x86_64/APKINDEX.tar.gz
v3.7.1-66-gfc22ab4fd3 [http://dl-cdn.alpinelinux.org/alpine/v3.7/main]
v3.7.1-55-g7d5f104fa7 [http://dl-cdn.alpinelinux.org/alpine/v3.7/community]
OK: 9064 distinct packages available
OK: 23 MiB in 23 packages
Cloning into '/tmp'...
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

对于公共仓库完美运行的YAML文件：

apiVersion: batch/v1
kind: Job
metadata:
  name: nest-build-kaniko
  labels:
    app: nest-kaniko-example
spec:
  template:
    spec:
      containers:
        -
          image: 'gcr.io/kaniko-project/executor:latest'
          name: kaniko
          args: ["--dockerfile=/workspace/Dockerfile",
                "--context=/workspace/",
                "--destination=aws.dest.cred"]
          volumeMounts:
            -
              mountPath: /workspace
              name: source
            -
              name: aws-secret
              mountPath: /root/.aws/
            -
              name: docker-config
              mountPath: /kaniko/.docker/
      initContainers:
        -
          name: download
          image: alpine:3.7
          command: ["/bin/sh","-c"]
          args: ['apk add --no-cache git && git clone https://github.com/username/repo.git /tmp/']
          volumeMounts:
            -
              mountPath: /tmp
              name: source
      restartPolicy: Never
      volumes:
        -
          emptyDir: {}
          name: source
        -
          name: aws-secret
          secret:
            secretName: aws-secret
        -
          name: docker-config
          configMap:
            name: docker-config

使用 git-sync 克隆私有存储库后的 YAML 文件：

apiVersion: batch/v1
kind: Job
metadata:
  name: nest-build-kaniko
  labels:
    app: nest-kaniko-example
spec:
  template:
    spec:
      containers:
        -
          image: 'gcr.io/kaniko-project/executor:latest'
          name: kaniko
          args: ["--dockerfile=/workspace/Dockerfile",
                "--context=/workspace/",
                "--destination=aws.dest.cred"]
          volumeMounts:
            -
              mountPath: /workspace
              name: source
            -
              name: aws-secret
              mountPath: /root/.aws/
            -
              name: docker-config
              mountPath: /kaniko/.docker/
      initContainers:
        -
          name: git-sync
          image: gcr.io/google_containers/git-sync-amd64:v2.0.4
          volumeMounts:
            -
              mountPath: /git/tmp
              name: source
            -
              name: git-secret
              mountPath: "/etc/git-secret"
          env:
            - name: GIT_SYNC_REPO
              value: "[e-mail]:username/repo.git"
            - name: GIT_SYNC_SSH
              value: "true"
            - name: GIT_SYNC_DEST
              value: "/tmp"
            - name: GIT_SYNC_ONE_TIME
              value: "true"
          securityContext:
            runAsUser: 0
      restartPolicy: Never
      volumes:
        -
          emptyDir: {}
          name: source
        -
          name: aws-secret
          secret:
            secretName: aws-secret
        -
          name: git-secret
          secret:
            secretName: git-creds
            defaultMode: 256
        -
          name: docker-config
          configMap:
            name: docker-config

- rohanmehto2

---

通常情况下，您需要构建一个镜像，将其推送到存储库，然后通过 Kubernetes 进行部署。在部署时，您不需要 git clone 或手动复制源代码。 - David Maze

“Host key verification failed.”听起来很像你只是缺少了ssh-keyscan github.com或printf 'Host *\n StrictHostKeyChecking no\n' > $HOME/.ssh/config；你已经尝试过了吗？ - mdaniel

kaniko现在也可以通过自己的方式从私有仓库中获取 https://github.com/GoogleContainerTools/kaniko#using-private-git-repository - Tim

Answer 1

你可以使用 git-sync。

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: git-sync-test
spec:
  selector:
    matchLabels:
      app: git-sync-test
  serviceName: "git-sync-test"
  replicas: 1
  template:
    metadata:
      labels:
        app: git-sync-test
    spec:
      containers:
      - name: git-sync-test
        image: <your-main-image>
        volumeMounts:
        - name: service
          mountPath: /var/magic
      initContainers:
      - name: git-sync
        image: k8s.gcr.io/git-sync-amd64:v2.0.6
        imagePullPolicy: Always
        volumeMounts:
        - name: service
          mountPath: /magic
        - name: git-secret
          mountPath: /etc/git-secret
        env:
        - name: GIT_SYNC_REPO
          value: <repo-path-you-want-to-clone>
        - name: GIT_SYNC_BRANCH
          value: <repo-branch>
        - name: GIT_SYNC_ROOT
          value: /magic
        - name: GIT_SYNC_DEST
          value: <path-where-you-want-to-clone>
        - name: GIT_SYNC_PERMISSIONS
          value: "0777"
        - name: GIT_SYNC_ONE_TIME
          value: "true"
        - name: GIT_SYNC_SSH
          value: "true"
        securityContext:
          runAsUser: 0
      volumes:
      - name: service
        emptyDir: {}
      - name: git-secret
        secret:
          defaultMode: 256
          secretName: git-creds # your-ssh-key

欲了解更多细节，请查看此链接。

- Abu Hanifa

---

完美地运作了。只有一个问题，我该如何将 repo 克隆到 /tmp 目录中，因为 kaniko 是从那里获取构建上下文的。我已经尝试使用 GIT_SYNC_DEST 环境变量来完成它，但目前还没有成功。 - rohanmehto2

我可以使用HTTPS密码替代SSH密钥吗？如果可以，语法是什么？ - AhmFM

@AhmFM 是的，你可以。你可以将GIT_SYNC_USERNAME和GIT_SYNC_PASSWORD添加到环境变量中。 - Tegar D Pratama

Answer 2

  initContainers:
    -
      name: git-sync
      image: gcr.io/google_containers/git-sync-amd64:v2.0.4
      volumeMounts:
        -
          mountPath: /workspace
          name: source
        -
          name: git-secret
          mountPath: "/etc/git-secret"
      env:
        - name: GIT_SYNC_REPO
          value: "[e-mail]:username/repo.git"
        - name: GIT_SYNC_SSH
          value: "true"
        - name: GIT_SYNC_ROOT
          value: /workspace
        - name: GIT_SYNC_DEST
          value: "tmp"
        - name: GIT_SYNC_ONE_TIME
          value: "true"

注意：将GIT_SYNC_ROOT环境变量设置为/workspace

它将在您的emptyDir source卷中的/workspace/tmp目录中进行克隆。

- Abu Hanifa