# This example mounts a fake git ssh credential into a Task
# and confirms that only the expected credential appears
# on the Task container's disk.
apiVersion: v1
kind: Secret
type: kubernetes.io/ssh-auth
metadata:
  name: phony-ssh-key
  annotations:
    tekton.dev/git-0: localhost
data:
  # "Hello, world!"
  ssh-privatekey: SGVsbG8sIHdvcmxkCg==
  # "Hello, world!"
  known_hosts: SGVsbG8sIHdvcmxkCg==
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: phony-ssh-key-service-account
secrets:
- name: phony-ssh-key
---
apiVersion: tekton.dev/v1beta1
kind: TaskRun
metadata:
  generateName: creds-init-only-mounts-provided-credentials-
spec:
  serviceAccountName: phony-ssh-key-service-account
  taskSpec:
    steps:
    - name: check-credentials
      image: alpine
      script: |
        #!/usr/bin/env ash
        set -xe

        # We expect the ssh credential to show up because it's
        # declared on the service account above.
        test -f $HOME/.ssh/id_phony-ssh-key

        # We don't expect any docker credentials to appear in the container.
        test ! -d $HOME/.docker

        # We don't expect any git basic auth credentials or related
        # configuration to appear in the container.
        test ! -f $HOME/.git-credentials
        test ! -f $HOME/.gitconfig
