Clone a private Git repository in a CI pipeline - Container Service for Kubernetes

Clone private Git repositories in ACK One CI pipelines using Git artifacts or environment variables.

Three methods are available.

Prerequisites

Ensure that you have:

An Argo Workflows CI pipeline for Golang configured in an ACK One workflow cluster.
Credentials for the private Git repository: a username and password (or token), or an SSH key.

Choose a method

Method	Authentication	When to use
Clone with Git artifacts (username and password)	Username + password or token	HTTPS repositories; credentials already managed as tokens
Clone with Git artifacts (SSH key)	SSH private key	SSH-format repository URLs; key-based authentication preferred
Clone with environment variable credentials	Username + password or token via environment variables	Simpler setup without a DAG task; single-task workflows

All methods require a Kubernetes Secret named git-creds for repository credentials. Create the Secret first, then apply your chosen template.

Store credentials in the workflow cluster

Create a Secret named git-creds in your workflow cluster to store the repository username, password (or token), and SSH key.

Replace the placeholders with your actual values:

Placeholder	Description	Example
`${username}`	Your Git repository username	`demo`
`${password or token}`	Your password or personal access token. GitHub and similar providers require tokens instead of passwords.	`ghp_GePB****************d407`
`${ssh private key path}`	Local path to your SSH private key file	`$HOME/.ssh/id_rsa`

kubectl create secret generic git-creds \
  --from-literal="username=${username}" \
  --from-literal="password=${password or token}" \
  --from-file=ssh-private-key=${ssh private key path}

# Example:
# kubectl create secret generic git-creds \
#   --from-literal="username=demo" \
#   --from-literal="password=ghp_GePB****************d407" \
#   --from-file=ssh-private-key=$HOME/.ssh/id_rsa

For SSH authentication, generate a key pair and add the public key to your Git repository first. See your Git provider's documentation: GitHub | GitLab.

Clone with Git artifacts (username and password)

The template adds a git-clone task that reads username and password from the git-creds Secret, as a dependency of git-checkout-pr.

All methods retain only the git-checkout-pr task from the predefined workflow template. The shell script in the command parameter of git-checkout-pr remains unchanged.

Apply the workflow template

Apply the following ClusterWorkflowTemplate to your workflow cluster:

apiVersion: argoproj.io/v1alpha1
kind: ClusterWorkflowTemplate
metadata:
  name: ci-git-artifact
spec:
  entrypoint: main
  volumes:
  - name: run-test
    emptyDir: {}
  - name: workdir
    persistentVolumeClaim:
      claimName: pvc-nas
  - name: docker-config
    secret:
      secretName: docker-config
  arguments:
    parameters:
    - name: repo_url
      value: ""
    - name: repo_name
      value: ""
    - name: target_branch
      value: "main"
  templates:
    - name: main
      dag:
        tasks:
          - name: git-clone
            arguments:
              artifacts:
              - name: git-repo
                path: /workdir
                git:
                  repo: "{{arguments.parameters.repo_url}}"
                  revision: main
                  usernameSecret:
                    name: git-creds
                    key: username
                  passwordSecret:
                    name: git-creds
                    key: password
                  sshPrivateKeySecret:
                    name: git-creds
                    key: ssh-private-key
            inline:
              container:
                image: golang:1.10
                command:
                - sh
                - -c
                - |
                  cd {{workflow.parameters.repo_name}}
                  git status && ls
                workingDir: /workdir
                volumeMounts:
                - name: "workdir"
                  mountPath: /workdir
          - name: git-checkout-pr
            inline:
              container:
                image: alpine:latest
                command:
                  - sh
                  - -c
                  - |
                    set -eu

                    apk --update add git

                    cd /workdir
                    echo "Start to Clone "{{workflow.parameters.repo_url}}
                    git -C "{{workflow.parameters.repo_name}}" pull || git clone {{workflow.parameters.repo_url}}
                    cd {{workflow.parameters.repo_name}}

                    echo "Start to Checkout target branch" {{workflow.parameters.target_branch}}
                    git checkout {{workflow.parameters.target_branch}}

                    echo "Get commit id"
                    git rev-parse --short origin/{{workflow.parameters.target_branch}} > /workdir/{{workflow.parameters.repo_name}}-commitid.txt
                    commitId=$(cat /workdir/{{workflow.parameters.repo_name}}-commitid.txt)
                    echo "Commit id is got: "$commitId

                    echo "Git Clone and Checkout Complete."
                volumeMounts:
                - name: "workdir"
                  mountPath: /workdir
                resources:
                  requests:
                    memory: 1Gi
                    cpu: 1
                activeDeadlineSeconds: 1200
            depends: git-clone

Submit the workflow

Set the workflow parameters to match your CI pipeline configuration, then submit the workflow.

Clone with Git artifacts (SSH key)

Similar to the previous method, with two differences:

The git-clone task reads only ssh-private-key from the git-creds Secret.
The repo_url parameter must be in SSH format. Example: git@github.com:ivan-cai/gitops-demo-private.git.

Apply the workflow template

Apply the following ClusterWorkflowTemplate to your workflow cluster:

apiVersion: argoproj.io/v1alpha1
kind: ClusterWorkflowTemplate
metadata:
  name: ci-git-artifact-sshkey
spec:
  entrypoint: main
  volumes:
  - name: run-test
    emptyDir: {}
  - name: workdir
    persistentVolumeClaim:
      claimName: pvc-nas
  - name: docker-config
    secret:
      secretName: docker-config
  arguments:
    parameters:
    - name: repo_url
      value: ""
    - name: repo_name
      value: ""
    - name: target_branch
      value: "main"
  templates:
    - name: main
      dag:
        tasks:
          - name: git-clone
            arguments:
              artifacts:
              - name: git-repo
                path: /workdir
                git:
                  repo: "{{arguments.parameters.repo_url}}"
                  revision: main
                  sshPrivateKeySecret:
                    name: git-creds
                    key: ssh-private-key
            inline:
              container:
                image: golang:1.10
                command:
                - sh
                - -c
                - |
                  cd {{workflow.parameters.repo_name}}
                  git status && ls
                workingDir: /workdir
                volumeMounts:
                - name: "workdir"
                  mountPath: /workdir
          - name: git-checkout-pr
            inline:
              container:
                image: alpine:latest
                command:
                  - sh
                  - -c
                  - |
                    set -eu

                    apk --update add git

                    cd /workdir
                    echo "Start to Clone "{{workflow.parameters.repo_url}}
                    git -C "{{workflow.parameters.repo_name}}" pull || git clone {{workflow.parameters.repo_url}}
                    cd {{workflow.parameters.repo_name}}

                    echo "Start to Checkout target branch" {{workflow.parameters.target_branch}}
                    git checkout {{workflow.parameters.target_branch}}

                    echo "Get commit id"
                    git rev-parse --short origin/{{workflow.parameters.target_branch}} > /workdir/{{workflow.parameters.repo_name}}-commitid.txt
                    commitId=$(cat /workdir/{{workflow.parameters.repo_name}}-commitid.txt)
                    echo "Commit id is got: "$commitId

                    echo "Git Clone and Checkout Complete."
                volumeMounts:
                - name: "workdir"
                  mountPath: /workdir
                resources:
                  requests:
                    memory: 1Gi
                    cpu: 1
                activeDeadlineSeconds: 1200
            depends: git-clone

Submit the workflow

Set repo_url in SSH format. Example: git@github.com:ivan-cai/gitops-demo-private.git.

Clone with environment variable credentials

No separate git-clone DAG task is needed. The git-checkout-pr task embeds credentials from environment variables:

git clone https://${GIT_USER}:${GIT_TOKEN}@github.com/${GITHUB_REPOSITORY}

The task reads credentials from the git-creds Secret using two environment variables:

Environment variable	Secret field
`GIT_USER`	`username`
`GIT_TOKEN`	`password`

Apply the workflow template

Apply the following ClusterWorkflowTemplate to your workflow cluster:

apiVersion: argoproj.io/v1alpha1
kind: ClusterWorkflowTemplate
metadata:
  name: ci-git
spec:
  entrypoint: main
  volumes:
  - name: run-test
    emptyDir: {}
  - name: workdir
    persistentVolumeClaim:
      claimName: pvc-nas
  - name: docker-config
    secret:
      secretName: docker-config
  arguments:
    parameters:
    - name: repo_url
      value: ""
    - name: repo_name
      value: ""
    - name: target_branch
      value: "main"
  templates:
    - name: main
      dag:
        tasks:
          - name: git-checkout-pr
            inline:
              container:
                image: alpine:latest
                env:
                - name: GIT_USER
                  valueFrom:
                    secretKeyRef:
                      name: git-creds
                      key: username
                - name: GIT_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: git-creds
                      key: password
                command:
                  - sh
                  - -c
                  - |
                    set -eu

                    apk --update add git

                    cd /workdir
                    echo "Start to Clone "{{workflow.parameters.repo_url}}
                    git -C "{{workflow.parameters.repo_name}}" pull || git clone https://$GIT_USER:$GIT_TOKEN@{{workflow.parameters.repo_url}}
                    cd {{workflow.parameters.repo_name}}

                    echo "Start to Checkout target branch" {{workflow.parameters.target_branch}}
                    git checkout {{workflow.parameters.target_branch}}

                    echo "Get commit id"
                    git rev-parse --short origin/{{workflow.parameters.target_branch}} > /workdir/{{workflow.parameters.repo_name}}-commitid.txt
                    commitId=$(cat /workdir/{{workflow.parameters.repo_name}}-commitid.txt)
                    echo "Commit id is got: "$commitId

                    echo "Git Clone and Checkout Complete."
                volumeMounts:
                - name: "workdir"
                  mountPath: /workdir
                resources:
                  requests:
                    memory: 1Gi
                    cpu: 1
                activeDeadlineSeconds: 1200

Submit the workflow

Provide the raw repository URL for repo_url. Omit the https:// prefix — the template prepends it.

Next steps

Create CI pipelines for Golang projects in workflow clusters