Documentation/architecture: Pass public/private key as parameter

[jakubbujny]

Looking on following documentation:
https://github.com/weaveworks/flux/blob/master/chart/flux/README.md#user-content-setup-git-deploy
https://github.com/weaveworks/flux/blob/master/site/helm-get-started.md#user-content-giving-write-access
https://github.com/weaveworks/flux/blob/master/site/standalone-setup.md#using-a-private-git-host
I can see that I can only get auto-generated Flux's public key and configure it in repository as deploy key. It means for me that Flux cannot operate in HA deployments where failure of some node is expected. In case of such failure Kubernetes will create new Flux container on another node and new keys will be created so new instance cannot connect with git repository without human intervention.

Either is it some problem with docs that I misunderstood it or such quite critical feature is missing?
I one doc I see that I can pass something like "flux-ssh-config" ConfigMap where I can configure known_hosts but cannot probably pass private/public key which should be used?

[stefanprodan]

This is not the case, Flux will generate a SSH key only if the flux-git-deploy secret is empty. When a node goes down and Flux will be rescheduled on a new node, the secret will be mounted and Flux will use the existing key.

[stefanprodan]

You can create the secret before deploying Flux, this is how it looks:

apiVersion: v1
kind: Secret
metadata:
  name: flux-git-deploy
  namespace: flux
type: Opaque
data:
  identity: LS0tLS1CRUdJTiBSU0EgU...

[jakubbujny]

Okay I can see it now here:
https://github.com/weaveworks/flux/blob/master/site/standalone-setup.md#2-specify-a-key-to-use

I have 3 propositions:

1. Paste file example which you added to that section: https://github.com/weaveworks/flux/blob/master/site/standalone-setup.md#2-specify-a-key-to-use
2. Add reference here that mounted secret can be used: https://github.com/weaveworks/flux/blob/master/chart/flux/README.md#user-content-setup-git-deploy
3. Add reference here that mounted secret can be used: https://github.com/weaveworks/flux/blob/master/site/helm-get-started.md#user-content-giving-write-access

I can create PR for you if you think that change would be useful.

[stefanprodan]

A PR would be great, thank you.

For the helm chart there is a flag called git.secretName so you can use whatever name you want for the secret. There is a docs PR underway #1527 you would want to wait for that one to be merged to avoid conflicts.