<p>I have a Pod on OpenShift 3.11 (Kubernetes 1.11). From that POD I need to push to a GitHub Repository using a passphrased SSH-Key.
Now I can create a secret just fine:</p>

<pre><code>apiVersion: v1
data:
  known_hosts: Yml...
  passphrase: abcde...
  ssh-privatekey: LS0...
kind: Secret
metadata:
  name: git-ssh-mirror
  namespace: mynamespace
type: kubernetes.io/ssh-auth
</code></pre>

<p>I have not idea though, how then to hook up this Secret in a way, that the Pod would work with both the Privatekey as well as the Passphrase.</p>

<p>Any pointers would be appreciated.</p>

abergmeier
<p>The <code>passphrase</code> and <code>ssh-privatekey</code> fields in the <code>data</code> section of the <code>git-ssh-mirror</code> secret created can be mounted inside the container either as:</p>

<ul>
<li><a href="https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-environment-variables" rel="nofollow noreferrer">Environment variables</a>, or  </li>
<li><p><a href="https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod" rel="nofollow noreferrer">Files</a></p>

<ol>
<li>Mounting secret as <strong>environment variables</strong> <code>GIT_SSH_PASSPHRASE</code> and <code>GIT_SSH_PRIVATEKEY</code> inside the container:</li>
</ol>

<pre><code>...
kind: Pod
...
spec:
  containers:
  - name: mycontainer
    image: myimage
    env:
      - name: GIT_SSH_PASSPHRASE
        valueFrom:
          secretKeyRef:
            name: git-ssh-mirror
            key: passphrase
      - name: GIT_SSH_PRIVATEKEY
        valueFrom:
          secretKeyRef:
            name: git-ssh-mirror
            key: ssh-privatekey
</code></pre>

<p>Now, use the environment variables <code>GIT_SSH_PASSPHRASE</code> and <code>GIT_SSH_PRIVATEKEY</code> inside the container to access the SSH passphrase and private key respectively needed to push to the GitHub repository.</p>

<ol start="2">
<li>Mounting secret as <strong>files</strong> inside the container:</li>
</ol>

<pre><code>...
kind: Pod
...
spec:
  containers:
  - name: mycontainer
    image: myimage
    volumeMounts:
    - name: git-ssh-secrets
      mountPath: "/etc/mypath"
      readOnly: true
  volumes:
  - name: git-ssh-secrets
    secret:
      secretName: git-ssh-mirror
</code></pre>

<p>Now, the values of <code>passphrase</code> and <code>ssh-privatekey</code> in the <code>git-ssh-mirror</code> secret created are <code>base-64</code> decoded and stored in the read-only files <code>/etc/mypath/passphrase</code> and <code>/etc/mypath/ssh-privatekey</code> respectively inside the container. Use them to push to the GitHub repository.</p></li>
</ul>

<p>If the passphrase or SSH private key needs to be <code>base-64</code> decoded, use the <code>base64 --decode</code> command.</p>
