如何创建Tekton任务更新Git配置仓库文件触发ArgoCD同步

需求背景 #

需要创建Tekton任务更新Git配置（公开）仓库中的文件，通过Git更新触发ArgoCD同步运行时环境，优先完成基础步骤，后续再添加安全配置。

首次HTTPS方式尝试及问题 #

使用HTTPS协议操作Git仓库的Tekton Task配置如下：

apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: deploy
spec:
  params:
    - name: environment
    - name: argo-app-name
    - name: configGitUrl
    - name: appImage
    - name: buildRevision
  workspaces:
    - name: config-source
  steps:
    - name: git-update
      image: alpine/git:v2.26.2
      workingDir: "$(workspaces.config-source.path)"
      script: |
        #!/usr/bin/env sh
        set -x
        
        whoami
        eval $(ssh-agent)
        git config --global core.sshCommand 'ssh -o StrictHostKeyChecking=accept-new'
        
        git init
        git remote add origin $(params.configGitUrl)
        git fetch --depth 1 origin master
        git clone git@github.com:myuser/argocd-demo.git
        git checkout master
        
        echo "updating $(inputs.params.environment) image to $(inputs.params.appImage):$(inputs.params.buildRevision)"
        sed -i "s#$(inputs.params.appImage):[a-zA-Z0-9]\+#$(inputs.params.appImage):$(inputs.params.buildRevision)#" demo/sb2demo-deployment.yaml
                
        git config --global user.email "tekton@tekton.dev"
        git config --global user.name "Tekton Pipeline"
        git add .
        git commit --allow-empty -m "[tekton] updating $(inputs.params.environment) image to $(inputs.params.buildRevision)"
        git push origin master

执行到git push步骤时触发错误：

git push origin master fatal: could not read Username for 'https://github.com': No such device or address

第二次SSH方式尝试及问题 #

改用SSH协议的Tekton Task配置如下：

apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: deploy
spec:
  params:
    - name: environment
    - name: argo-app-name
    - name: configGitUrl
    - name: appImage
    - name: buildRevision
  workspaces:
    - name: config-source
  steps:
    - name: git-update
      image: alpine/git:v2.26.2
      workingDir: "$(workspaces.config-source.path)"
      script: |
        #!/usr/bin/env sh
        set -x
        
        whoami
        eval $(ssh-agent)
        mkdir /ssh-stuff
        mkdir /ssh-stuff/.ssh
        ssh-keygen -t rsa -q -b 4096 -C "tekton@tekton.dev" -f /ssh-stuff/.ssh/id_rsa 
        ssh-add /ssh-stuff/.ssh/id_rsa
        git config --global core.sshCommand 'ssh -o StrictHostKeyChecking=accept-new'
        
        git init
        git remote add origin $(params.configGitUrl)
        git fetch --depth 1 origin master
        git clone git@github.com:myuser/argocd-demo.git
        git checkout master
        
        echo "updating $(inputs.params.environment) image to $(inputs.params.appImage):$(inputs.params.buildRevision)"
        sed -i "s#$(inputs.params.appImage):[a-zA-Z0-9]\+#$(inputs.params.appImage):$(inputs.params.buildRevision)#" demo/sb2demo-deployment.yaml
                
        git config --global user.email "tekton@tekton.dev"
        git config --global user.name "Tekton Pipeline"
        git add .
        git commit --allow-empty -m "[tekton] updating $(inputs.params.environment) image to $(inputs.params.buildRevision)"
        git push origin master

脚本以root用户运行时触发权限错误：

• git clone git@github.com:myuser/argocd-demo.git
  Cloning into 'argocd-demo'...
  Warning: Permanently added 'github.com,140.82.121.3' (ECDSA) to the list of known hosts.
  git@github.com: Permission denied (publickey).
  fatal: Could not read from remote repository.

解决方案 #

针对HTTPS方式的修复 #

HTTPS方式的核心问题是缺少Git仓库的推送认证信息（公开仓库只读无需认证，但写入必须认证）。可以使用GitHub个人访问令牌（PAT）作为认证凭证，修改Git远程地址为带认证的格式，同时通过Tekton Secret传递凭证，避免硬编码：

修改后的关键脚本片段：

# 替换原有的git init、remote add、clone步骤
git clone https://$(params.gitUsername):$(params.gitToken)@github.com/myuser/argocd-demo.git
cd argocd-demo

# 后续的sed、commit、push步骤保持不变

需要在Tekton Task中新增gitUsername和gitToken参数，并通过Kubernetes Secret挂载传入。

针对SSH方式的修复 #

SSH方式的问题是脚本临时生成的密钥未添加到GitHub仓库的部署密钥列表中，正确流程如下：

1. 提前生成SSH密钥对，将公钥添加到GitHub仓库的部署密钥中（勾选允许写入权限）
2. 将私钥存储为Kubernetes Secret
3. 在Tekton Task中通过Workspace挂载该Secret，加载已有私钥而非临时生成

修改后的Task配置：

apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: deploy
spec:
  params:
    - name: environment
    - name: argo-app-name
    - name: configGitUrl
    - name: appImage
    - name: buildRevision
  workspaces:
    - name: config-source
    - name: ssh-credentials  # 新增挂载SSH密钥的Workspace
  steps:
    - name: git-update
      image: alpine/git:v2.26.2
      workingDir: "$(workspaces.config-source.path)"
      script: |
        #!/usr/bin/env sh
        set -x
        
        # 配置SSH使用挂载的密钥
        mkdir -p ~/.ssh
        cp $(workspaces.ssh-credentials.path)/id_rsa ~/.ssh/
        chmod 600 ~/.ssh/id_rsa
        git config --global core.sshCommand 'ssh -i ~/.ssh/id_rsa -o StrictHostKeyChecking=accept-new'
        
        # 克隆仓库
        git clone $(params.configGitUrl)
        cd argocd-demo
        
        # 更新镜像版本
        echo "updating $(params.environment) image to $(params.appImage):$(params.buildRevision)"
        sed -i "s#$(params.appImage):[a-zA-Z0-9]\+#$(params.appImage):$(params.buildRevision)#" demo/sb2demo-deployment.yaml
                
        # 配置Git用户信息
        git config --global user.email "tekton@tekton.dev"
        git config --global user.name "Tekton Pipeline"
        
        # 提交并推送
        git add .
        git commit -m "[tekton] updating $(params.environment) image to $(params.appImage):$(params.buildRevision)"
        git push origin master

创建对应的Kubernetes Secret：

kubectl create secret generic ssh-creds --from-file=id_rsa=/path/to/your/private/key

使用Task时，将ssh-credentials Workspace绑定到该Secret即可。

内容的提问来源于stack exchange，提问作者tm1701