# How to create an image and deploy this helm chart:

## Image creation:
### Generate your ssh key to Docker
```
ssh-keygen -t ed25519 -C "docker-access" -f ~/.ssh/id_ed25519_docker
```

Add the public key to yout Git SSH keys in your git platform

### Enable Docker BuildKit
```
export DOCKER_BUILDKIT=1
``` 
or make it permanent:
```
echo '{ "features": { "buildkit": true } }' | sudo tee /etc/docker/daemon.json
sudo systemctl restart docker
```

### Build and upload image
```
make -C docker
```

## SSH secrets:

### Create secret to your git ssh credentials
We need a dedicated keypair to access GitHub from a Kubernetes pod without exposing your user credentials or tokens.
```
ssh-keygen -t ed25519 -f git_key -C "k8s-deploy-key" -N ""
```
- ```-t ed25519```: modern, secure key type

- ```-f git_key```: saves to git_key (private) and git_key.pub (public)

- ```-C "..."```: comment to identify this key

- ```-N ""```: no passphrase (for non-interactive use in pods)

### Add the Public Key to GitHub (Read-Only Deploy Key)
Deploy keys allow read-only access to a specific repo. This avoids using user tokens or giving broad permissions.

1. Copy your public key:
```
cat git_key.pub
```

2. Go to your GitHub repo → Settings → Deploy Keys

3. Click “Add deploy key”

- Title: K8s ReadOnly

- Key: paste your git_key.pub

- ✅ Check “Allow read access”

- ❌ Do NOT check “Allow write access”

### Create a Kubernetes Secret from the Private Key
Kubernetes Secrets securely store sensitive data like private keys. This secret will later be mounted into your pod for Git to use.
```
kubectl create secret generic git-ssh-key \
  --namespace sientia-opc \
  --from-file=ssh-privatekey=git_key \
  --type=kubernetes.io/ssh-auth
```
- ```ssh-privatekey```: required key name for type kubernetes.io/ssh-auth

- Secret is base64-encoded and stored in Kubernetes (not encrypted unless you're using an external secret manager or encryption at rest is enabled)