Security / Giving SSH keys of a Github user is too permissive and risky

[gustavosr98]

Bug Description

We should not provide SSH private keys, even if it is stored in Kubernetes as secret
https://charmhub.io/github-profiles-automator/configurations#ssh-key-secret-id

SSH keys are too sensitive to be used by applications
SSH keys in Github gives access to ALL repositories of the user

We should instead used token based permissions that is tailored for the application, something more similar to ServiceAccounts in Kubernetes

https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens

To Reproduce

N/A

Environment

Edge channel / Revision 200

Relevant Log Output

N/A

Additional Context

No response

[syncronize-issues-to-jira]

Thank you for reporting your feedback to us!

The internal ticket has been created: https://warthogs.atlassian.net/browse/KF-7492.

This message was autogenerated

[deusebio]

Thanks @gustavosr98 for raising this. Yes, I believe this makes sense. We were initially designing this to keep consistent with the ux provided by the cos-configuration that is providing a similar UX (syncing with a github repo where dahsboards and alerts are stored), and also in this case, cos-configuration uses ssh keys.

I have discussed this with Simme, and indeed your suggestions seems very sensible to both of us. We will raise a draft PR to be discussed with the cos team to aim to have a consistent UX across the repositories. This is however not too critical but a nice-to-have, so it may not get prioritized in the super short term, but more in the mid-term.