<p>I am trying to establish <code>SSH</code> authentication between Jenkins and GitHub. For the same, I am using the kubernetes secret to store the private and public key and I am mounting the secrets when the pod is created. Command I have used to create the secret:</p>
<pre><code>kubectl create secret generic test-ssh --from-file=id_rsa=id_rsa --from-file=id_rsa.pub=id_rsa.pub --namespace jenkins
</code></pre>
<p>and mapped it in pod configuration as:</p>
<pre><code>volumes:
  - secretVolume:
      mountPath: &quot;/root/.ssh&quot;
      secretName: &quot;test-ssh&quot;
</code></pre>
<p>When the pod is created, I can see that the secret is mapped correctly in the <code>~/.ssh</code> folder as shown below.</p>
<p><a href="https://i.stack.imgur.com/8Zyfv.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/8Zyfv.png" alt="enter image description here" /></a></p>
<p>but the problem is the <code>~/.ssh</code> folder itself has the sticky bit permission enabled</p>
<p><a href="https://i.stack.imgur.com/UGQR6.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/UGQR6.png" alt="enter image description here" /></a></p>
<p>and this is preventing the builds adding the <code>known_hosts</code> file when <code>ssh-keyscan</code> command is executed</p>
<pre><code>ssh-keyscan github.com &gt;&gt; ~/.ssh/known_hosts
bash: ~/.ssh/known_hosts: Read-only file system
</code></pre>
<p>I was hoping to achieve one of the two solutions I can think of</p>
<ol>
<li>Remove the sticky permissions from <code>~/.ssh</code> folder after it is created</li>
<li>While mounting the kubernetes secret, mount it without sticky permissions</li>
</ol>
<p>Could anyone help me to understand if there is a possibility to achieve this?
I have already tried <code>chmod -t .ssh</code> and it gives me the same error <code>chmod: changing permissions of '.ssh': Read-only file system</code></p>
<p>The owner of the <code>~/.ssh</code> folder is <code>root</code> and I have logged in as <code>root</code> user. I have confirmed this by running the <code>whoami</code> command.</p>

Prasann
<p>Secrets aren't mounts that allow for permissions to be alter, so you have to do some trickery to get it to work.
Recently I ran into a similar issue, and had to make it work.  We use a custom image to perform the ssh calls, so we added the .ssh dir and the known_hosts files to the image; setting the permissions in the Dockerfile.  I then used the subPath to target the id_rsa and id_rsa.pub files in the deployment.  I don't have my mappings handy but can tomorrow if necessary to show what I mean.
I think the 'official' answer was to mount the files in a different location and cp them where they needed to be in an initContainer using a shared mount or in the entrypoint file/binary.</p>
