why do i need to provision the private part of the ssh key to access a gitrepository

[wibed]

example:

i bootstrap a local git repo and define a gitrepository as a resource

apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: GitRepository
metadata:
  name: gitsrv
  namespace: flux-system
spec:
  interval: 1m
  url: ssh://[email protected]:2222/srv/bird.git
  ref:
    branch: master
  secretRef:
    name: ssh-credentials
  ignore: |
    # exclude all
    /*
    # include charts directory
    !/src/base/gitsrv/gitsrv/

now to reconcile
flux reconcile source git gitsrv

i have to provide a secret containing my private ssh key as a secret and expose it to the cluster.
even though i could encrypt it, i would like to know how on earth one could make a case for exposing a private ssh key

[stefanprodan]

Do you expect for Flux to be able to clone private repos without a private key?

[wibed]

is there a schematics which visualizes this.

i am still having issues understanding you correctly.
for me it seems perfectly sound to have the private key provisioned once.

maybe there is a use-case i am not including.

[hiddeco]

The private key is provisioned just once, if the Secret is already present in the cluster a new key is not generated.

[stefanprodan]

This is what happens on your cluster when you define a GitRepository source-controller -> read SSH private key from secret-> git clone -> github

[wibed]

tell me if i got this right.

the bootstrap stage:

• sets up the source-controller, provisioned with the private key by cli argument, or generates one and demands integration of its corresponding public key.
• by settings and resources found on the source, sets up a variety of controllers each representing an "ingestion point" somehow managed by flux to sync up their result into a final file, representing the state of the cluster. ( the well known gotk files)
• each controller has access to the private key and can do its operation by resource provided from within the cluster (kubernetes secret), and does NOT share this information with the "root-controller" (the source-controller)
• after each git change, the resources are reevaluated and controllers spawned as necessary.

[hiddeco]

I would advise you to read https://fluxcd.io/docs/flux-e2e/, as I have a vague feeling your mental model has taken some side path.

[wibed]

https://fluxcd.io/docs/flux-e2e/