Expected Behavior

Multiple ssh keys to the same host/provider (eg. github) are working.

Actual Behavior

Only first ssh key for github is working, rest is failing.

Steps to Reproduce the Problem

Two different secrets with two different ssh keys for two different github repos:

---
apiVersion: v1
kind: Secret
metadata:
  name: ssh-key-repo1
  annotations:
    tekton.dev/git-0: github.com
type: kubernetes.io/ssh-auth
data:
  ssh-privatekey: <key>

---
apiVersion: v1
kind: Secret
metadata:
  name: ssh-key-repo2
  annotations:
    tekton.dev/git-0: github.com
type: kubernetes.io/ssh-auth
data:
  ssh-privatekey: <key>

ServiceAccount:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: fetch-repo
secrets:
- name: ssh-key-repo1
- name: ssh-key-repo2

It produces .ssh/config like this:

Host github.com
    HostName github.com
    Port 22
    IdentityFile /tekton/home/.ssh/id_ssh-key-repo1
    IdentityFile /tekton/home/.ssh/id_ssh-key-repo2

For ssh this config is fine but git for some reason respect only first IdentityFile clause and ignores rest. So in this case you can only authenticate to repo1. Authentication to repo2 will fail - github will complain that the repository doesn’t match.

So in order to authenticate properly with git and multiple ssh keys, .ssh/config file should look similar to this:

Host github.com-ssh-key-repo1
    HostName github.com
    Port 22
    IdentityFile /tekton/home/.ssh/id_ssh-key-repo1

Host github.com-ssh-key-repo2
    HostName github.com
    Port 22
    IdentityFile /tekton/home/.ssh/id_ssh-key-repo2

Unfortunately git client then should also use those fake hosts:

git clone git@github.com-ssh-key-repo1:example/repo1.git

and

git clone git@github.com-ssh-key-repo2:example/repo2.git

For this reason, above workaround seems not quite reasonable since you can have git repo url dynamically fetched from git push webhook and then it would be in a form: git@github.com:example/repo1.git or git@github.com:example/repo2.git

Additional Info

This is particularly painful with github because it doesn’t allow to use the same deploy key for different repos so you need to use different keys. And this it how you hit this issue.

• Kubernetes version:

  Output of kubectl version:

Client Version: version.Info{Major:"1", Minor:"17", GitVersion:"v1.17.4", GitCommit:"8d8aa39598534325ad77120c120a22b3a990b5ea", GitTreeState:"clean", BuildDate:"2020-03-12T23:41:24Z", GoVersion:"go1.14", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"17", GitVersion:"v1.17.4", GitCommit:"8d8aa39598534325ad77120c120a22b3a990b5ea", GitTreeState:"clean", BuildDate:"2020-03-12T20:55:23Z", GoVersion:"go1.13.8", Compiler:"gc", Platform:"linux/amd64"}

• Tekton Pipeline version:

Client version: 0.8.0
Pipeline version: v0.11.1