How to handle private repositories ?

[ypapouin]

Following is my current workflow to handle private repositories (odoo image is built using Gitlab CI using DinD, docker-in-docker), but I think that my way to handle it is not correct (I would like to avoid a call to docker-squash). Any idea to do it properly ?

I'm adding a private repository to repos.yaml

my-private-repo:
  defaults:
    depth: $DEPTH_MERGE
  remotes:
    origin: ssh://git@gitlab-ssh.mycompany.com/project/odoo/private.git
  target: origin $ODOO_VERSION
  merges:
    - origin $ODOO_VERSION

And before building, the private key is copied to fetch this private repository

    - cp "$SSH_PRIVATE_KEY" /builds/project/odoo-images/custom/ssh/id_rsa
    - chmod 0400 /builds/project/odoo-images/custom/ssh/id_rsa
    ## Set tag value
    - TAG=${CI_COMMIT_TAG:-$CI_COMMIT_BRANCH-latest}
    - IMAGE_PATH=${CI_REGISTRY_IMAGE}:${TAG}
    ## Build
    - docker build --pull -t "${IMAGE_PATH}" .

An intermediate script is added in the Doodba template to delete this key when the build is ended:

odoo-images/custom/build.d/450-delete-ssh-private-key.sh

But since the SSH key is kept in image layers, I have to squash the image to ensure that this private key is not published in the container registry

    ## Squash all ONBUILD commmands (use history to retrieve first layer)
    - docker history "${IMAGE_PATH}"
    - docker-squash -f 40 -t ${IMAGE_PATH} ${IMAGE_PATH}
    - docker history "${IMAGE_PATH}"
    ## Publish squashed image
    - docker push "${IMAGE_PATH}"

Any idea to fetch a private repo ? ssh-agent ? environment variables ?

[pedrobaeza]

Why don't you use deploy keys?

[ypapouin]

The key I use in my workflow is already a deploy key :

• My deploy key, the public part of the SSH key pair, is created and enabled on private repositories.
• The $SSH_PRIVATE_KEY is a file-type CI/CD variable with the private counterpart of this SSH key pair.

The only way I found today is the one in my workflow:

• CI/CD: Copy the private key to the doodba template
• DinD: Use the private key while building the doodba image
• DinD: Delete the private key when building is finished
• CI/CD: Squash the final image to ensure no private key in layers

The main issue is that call to docker build to an almost empty Dockerfile (FROM tecnativa/doodba:18.0-onbuild).

This docker environment is isolated from the CI/CD (variables are not passed to docker-in-docker) and I don't know how I could use this deploy key without creating my own "doodba:18.0-onbuild" image.

After some investigation, I found that line ONBUILD RUN /opt/odoo/common/build && sync, so everything in build.d will be run in the same docker layer, so I could add a 90-add-ssh-private-key.sh script if I found a way to get my CI/CD variable from DinD.

[pedrobaeza]

But I put the deploy key in the repos.yaml in the remote, and nothing more to do.

[ypapouin]

Oh, I didn't know that adding a deploy key in the repos.yaml was an option, can you provide me a sample ?
Also, does that mean that you don't care that this deploy key will leak in the final image ?

[pedrobaeza]

./private-repo:
  defaults:
    depth: $DEPTH_DEFAULT
  remotes:
    private: https://token:key@git-server.com/org/private-repo.git
  target: private $ODOO_VERSION
  merges:
    - private $ODOO_VERSION

And yes, I don't lock my customers. The repo code is available to them. In fact, the code is also there inside the build anyway.