How to link secret to default pipeline ServiceAccount in an OpenShift template? - openshift

Question

Currently I am trying to make sure that the default pipeline account is able to perform the git-clone ClusterTask in a Tekton pipeline. With the following yaml, the task can be performed successfully (the repo gets pulled):
apiVersion: v1
kind: ServiceAccount
metadata:
name: pipeline
secrets
- name: git-secret
However, when I use this same configuration in an OpenShift template, e.g.:
apiVersion: v1
kind: Template
metadata:
name: test-template
objects:
- apiVersion: v1
kind: Secret
type: kubernetes.io/ssh-auth
metadata:
name: git-secret
annotations:
tekton.dev/git-0: bitbucket.org
data:
ssh-privatekey: ${GIT_SSH_KEY}
- apiVersion: v1
kind: ServiceAccount
metadata:
name: pipeline
secrets
- name: git-secret
The secret is not linked with the ServiceAccount and as a result, the pull fails. I tried to give the secret the following annotation:
kubernetes.io/service-account.name: pipeline
But that does not help either. When creating a new ServiceAccount in the template (e.g. pipeline-with-secret), things work perfectly. Also, when linking the secret manually, it also works well. However, I would prefer to have the template set the link correctly to avoid having to do the linking manually. This makes me wonder: is it possible to link a secret to a ServiceAccount that gets created by default?
OpenShift version: 4.5.19
Thanks.

Answer 1

You are almost there,
The problem is that you miss parameters, see my last section below:
apiVersion: v1
kind: Template
metadata:
name: test-template
objects:
- apiVersion: v1
kind: Secret
type: kubernetes.io/ssh-auth
metadata:
name: git-secret
annotations:
tekton.dev/git-0: bitbucket.org
data:
ssh-privatekey: ${GIT_SSH_KEY}
- apiVersion: v1
kind: ServiceAccount
metadata:
name: pipeline
secrets
- name: git-secret
parameters:
- name: GIT_SSH_KEY
displayName: SSH Private Key
description: SSH Private key to use for openshift pipelines
required: true
value: ssh-private-key...
See the Templates Parameters section here.
To be honest I hate templates, prefer helm which is more as a standard.