Google Cloud Build with multiple git repositories - google-cloud-platform

Question

I have a git repository with git sub-module, which linked to another git repository.
main-repo
-> file1.txt
-> submodule-repo
-> file2.txt
I created a Google Cloud Build trigger that has permissions to main-repo.
In order to load the submodule-repo repository, I added this command to the build instructions:
steps:
- name: gcr.io/cloud-builders/git
args: ['submodule', 'update', '--init', '--recursive']
...
And it fail in this stage. Why? permissions problem:
Submodule 'XXX' (XXX) registered for path '***' Cloning into
'/workspace/XXX'... ssh: Could not resolve hostname c: Name or service
not known fatal: Could not read from remote repository.
Please make sure you have the correct access rights and the repository
exists.
The read permission I gave Google is for the main-repo git repository. Since I can give access only for one repository, I can't give another permission for the submodule-repo repsoitory.
How I can use Google Cloud Build to build an git repository with git sub-module?

Answer 1

I did the following and it's working for me:
I followed these instructions to access my private repo from google cloud:
Create an SSH key
Store the private SSH key in Secret Manager
Add the public SSH key to your private repository's deploy keys (if you need to access more than one repo, create a user or use an existing user who has access to these repos and put the deploy key in this account, not in the repo itself > from GitHub account > settings > SSH keys)
Grant permissions to Cloud Build service account to access Secret Manager
Add the public SSH key to known hosts (I stored the public key as a variable in cloud build and you can use GitHub secret to store it)
*Use this command to get the public key and don't copy it from .pub file
ssh-keyscan -t rsa github.com > known_hosts.github
Then these steps in the cloud build file:
- name: 'gcr.io/cloud-builders/git'
secretEnv: ['SSH_KEY']
entrypoint: 'bash'
args:
- -c
- |
echo "$$SSH_KEY" >> /root/.ssh/id_rsa
chmod 400 /root/.ssh/id_rsa
echo ${_SSH_PUBLIC_KEY} >> /root/.ssh/known_hosts
volumes:
- name: 'ssh'
path: /root/.ssh
- name: 'gcr.io/cloud-builders/git'
entrypoint: 'bash'
args:
- '-c'
- |
git submodule init
git submodule update
volumes:
- name: 'ssh'
path: /root/.ssh
availableSecrets:
secretManager:
- versionName: projects/[GCP_Project]/secrets/[SECRET_NAME]/versions/latest
env: 'SSH_KEY'