How to create an image and deploy this helm chart:
Image creation:
Generate your ssh key to Docker
ssh-keygen -t ed25519 -C "docker-access" -f ~/.ssh/id_ed25519_docker
Add the public key to yout Git SSH keys in your git platform
Enable Docker BuildKit
export DOCKER_BUILDKIT=1
or make it permanent:
echo '{ "features": { "buildkit": true } }' | sudo tee /etc/docker/daemon.json
sudo systemctl restart docker
Build and upload image
make -C docker
SSH secrets:
Create secret to your git ssh credentials
We need a dedicated keypair to access GitHub from a Kubernetes pod without exposing your user credentials or tokens.
ssh-keygen -t ed25519 -f git_key -C "k8s-deploy-key" -N ""
-
-t ed25519: modern, secure key type -
-f git_key: saves to git_key (private) and git_key.pub (public) -
-C "...": comment to identify this key -
-N "": no passphrase (for non-interactive use in pods)
Add the Public Key to GitHub (Read-Only Deploy Key)
Deploy keys allow read-only access to a specific repo. This avoids using user tokens or giving broad permissions.
- Copy your public key:
cat git_key.pub
-
Go to your GitHub repo → Settings → Deploy Keys
-
Click “Add deploy key”
-
Title: K8s ReadOnly
-
Key: paste your git_key.pub
-
✅ Check “Allow read access”
-
❌ Do NOT check “Allow write access”
Create a Kubernetes Secret from the Private Key
Kubernetes Secrets securely store sensitive data like private keys. This secret will later be mounted into your pod for Git to use.
kubectl create secret generic git-ssh-key \
--namespace sientia-opc \
--from-file=ssh-privatekey=git_key \
--type=kubernetes.io/ssh-auth
-
ssh-privatekey: required key name for type kubernetes.io/ssh-auth -
Secret is base64-encoded and stored in Kubernetes (not encrypted unless you're using an external secret manager or encryption at rest is enabled)