Make it easier to setup SSH authentication for Git

Feature request

The authentication page in documentation looks a bit overwhelming at first visit. Unfortunately, setting up authentication is one of the first things a new user needs to do to use Tekton for Continuous Integration. It would be good if the steps (and instructions) on how to setup SSH authentication for Git would be easier to understand and easier to do. If this part is too overwhelming, it might serve as a barrier to start using Tekton.

Suggestions

Prepare a known_hosts file

Example using github.com

1. Create file with known_hosts (you may also want to verify this further)

   ssh-keyscan github.com > ssh_known_hosts
   

2. Create secret from file

   kubectl create configmap github-known-hosts --from-file=ssh_known_hosts
   

Generate and distribute SSH key pair

Generate a separate SSH key pair for Tekton. (The current auth doc describes a process for uploading the users private key from its home dir which might not be a good idea from a security standpoint)

1. Generate keypair to local file

   ssh-keygen -t rsa -b 4096 -f id_rsa -q -N ""
   

2. Create a secret from the private key

   kubectl create secret generic github-private-key --from-file=id_rsa
   

3. Upload the public key id_rsa.pub to GitHub

   Start with copying the content of the public key with (this example is for macos)

   pbcopy < id_rsa.pub
   

   And follow Adding a new SSH key to your GitHub account alternatively Managing Deploy Keys for organization

Usage

The ConfigMap and Secret created above, can be exposed to a Task with a Projected Volume:

      volumes:
      - name: ssh-auth                  # name of volume - matching name in Task
        projected:
          defaultMode: 0400
          sources:
          - configMap:
              name: github-known-hosts  # name of ConfigMap from Auth setup
          - secret:
              name: github-private-key  # name of Secret from Auth setup

Summary

The above commands for secret, configmap and ssh key generation can be used by copy-pasting, which makes the process a bit easier do to, and to avoid mistakes.

Use case

To configure a Git-clone Task so that the user can start to use Tekton Pipelines together with a Tekton Trigger connected to a git repository, e.g. GitHub.