use ssh keys - closes #253

Signed-off-by: Marcin Fabrykowski git@fabrykowski.pl

app/appsservice/__init__.py

@@ -14,7 +14,14 @@ def create_app(test_config=None):
         app.logger.error("GIT_REPO not provided")
         return False
     app.config['gitdir'] = "workdir"
-    repo = git.Repo.clone_from(app.config['GIT_REPO'], app.config['gitdir'])
+    app.config['ssh_cmd'] = ("ssh "
+                             "-o StrictHostKeyChecking=no "
+                             "-o UserKnownHostsFile=/dev/null "
+                             "-i /app/sshkey/id_rsa"
+                             )
+    repo = git.Repo.clone_from(app.config['GIT_REPO'],
+                               app.config['gitdir'],
+                               env=dict(GIT_SSH_COMMAND=app.config['ssh_cmd']))
     app.config['repo'] = repo
     app.config['gitsem'] = threading.Semaphore()
 

app/appsservice/nginx.py

@@ -59,6 +59,8 @@ class Nginx(Resource):
         repo = current_app.config['repo']
         repo.index.add(ingitpath)
         repo.index.commit("add nginx")
-        repo.remotes.origin.push()
+        ssh_cmd = current_app.config['ssh_cmd']
+        with repo.git.custom_environment(GIT_SSH_COMMAND=ssh_cmd):
+            repo.remotes.origin.push().raise_if_error()
         current_app.config['gitsem'].release()
         return "Created", 201

chart/templates/deployment.yaml

@@ -33,6 +33,10 @@ spec:
             - name: http
               containerPort: 5000
               protocol: TCP
+          volumeMounts:
+            - name: sshkey
+              mountPath: "/app/sshkey"
+              readOnly: true
           #livenessProbe:
           #  httpGet:
           #    path: /
@@ -41,3 +45,19 @@ spec:
           #  httpGet:
           #    path: /
           #    port: http
+
+      volumes:
+      - name: sshkey
+        secret:
+{{- if .Values.git_repo.sshkey.secret.name }}
+          secretName: {{ .Values.git_repo.sshkey.secret.name }}
+          items:
+            - key: {{ .Values.git_repo.sshkey.secret.key }}
+              path: id_rsa
+{{- else }}
+          secretName: {{ include "chart.fullname" . }}-sshkey
+          items:
+            - key: ssh-privatekey
+              path: id_rsa
+{{- end }}
+          defaultMode: 0400

chart/templates/generate_sshkey.yml

+{{- if and (not .Values.git_repo.sshkey.key) (not .Values.git_repo.sshkey.secret) }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "chart.fullname" . }}-sshkey
+spec:
+  template:
+    spec:
+      serviceAccountName: argo-ssh-generator
+      restartPolicy: Never
+      volumes:
+      - name: sshkey
+        emptyDir: {}
+      containers:
+      - name: ssh-gen
+        image: alpine
+        command:
+          - /bin/sh
+          - -c
+          - 'apk add openssh && ssh-keygen -f /key/key_rsa -N "" && chmod 666 /key/*'
+        volumeMounts:
+        - name: sshkey
+          mountPath: /key
+      - name: create-creator
+        image: bitnami/kubectl:latest
+        command:
+          - /bin/sh
+          - -c
+          - 'while [ ! -e /key/key_rsa ]; do echo "waiting for /key/key_rsa"; sleep 1; done; kubectl create secret generic {{ include "chart.fullname" . }}-sshkey --from-file=ssh-publickey=/key/key_rsa.pub --from-file=ssh-privatekey=/key/key_rsa'
+        volumeMounts:
+        - name: sshkey
+          mountPath: /key
+{{- end }}

chart/templates/static_sshkey.yml

+{{- if .Values.git_repo.sshkey.key }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "chart.fullname" . }}-sshkey
+type: Opaque
+stringData:
+  ssh-privatekey: |
+{{ .Values.git_repo.sshkey.key | indent 4}}
+{{- end }}