chore(README): add instructions on Flux SSH authentication

Signed-off-by: Devin Buhl <devin@buhl.casa>

.gitignore

@@ -9,6 +9,8 @@ kubeconfig
 .decrypted~*.yaml
 .config.env
 *.agekey
+*.pub
+*.key
 # Ansible
 xanmanning.k3s*
 # Terraform

README.md

@@ -467,6 +467,77 @@ Rancher's `local-path-provisioner` is a great start for storage but soon you mig
 - [csi-driver-nfs](https://github.com/kubernetes-csi/csi-driver-nfs)
 - [synology-csi](https://github.com/SynologyOpenSource/synology-csi)
 
+### 🔏 Authenticate Flux over SSH
+
+Authenticating Flux to your git repository has a couple benefits like using a private git repository and/or using the Flux [Image Automation Controllers](https://fluxcd.io/docs/components/image/).
+
+📍 By default this template only works on a public GitHub repository, it is advised to keep your repository public and add a topic to your repository of `k8s-at-home` to be included in the [k8s-at-home-search](https://whazor.github.io/k8s-at-home-search/). This search helps people discover different configurations of Helm charts across others Flux based repositories.
+
+<details>
+  <summary>Expand to read guide on adding Flux SSH authentication</summary>
+
+  1. Generate new SSH key:
+      ```sh
+      ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f ./cluster/github-deploy-key -q -P ""
+      ```
+  2. Paste public key in the deploy keys section of your repository settings
+  3. Create sops secret in `cluster/base/flux-system/github-deploy-key.sops.yaml` with the contents of:
+      ```yaml
+      # yamllint disable
+      apiVersion: v1
+      kind: Secret
+      metadata:
+          name: github-deploy-key
+          namespace: flux-system
+      stringData:
+          # 3a. Contents of github-deploy-key
+          identity: |
+              -----BEGIN OPENSSH PRIVATE KEY-----
+                  ...
+              -----END OPENSSH PRIVATE KEY-----
+          # 3b. Output of curl --silent https://api.github.com/meta | jq --raw-output '"github.com "+.ssh_keys[]'
+          known_hosts: |
+              github.com ssh-ed25519 ...
+              github.com ecdsa-sha2-nistp256 ...
+              github.com ssh-rsa ...
+      ```
+  4. Encrypt secret:
+      ```sh
+      sops --encrypt --in-place ./cluster/base/flux-system/github-deploy-key.sops.yaml
+      ```
+  5. Apply secret to cluster:
+      ```sh
+      sops --decrypt cluster/base/flux-system/github-deploy-key.sops.yaml | kubectl apply -f -
+      ```
+  6.  Update `cluster/base/flux-system/gotk-sync.yaml`:
+      ```yaml
+      ---
+      apiVersion: source.toolkit.fluxcd.io/v1beta2
+      kind: GitRepository
+      metadata:
+        name: flux-system
+        namespace: flux-system
+      spec:
+        interval: 5m0s
+        # 6a: Change this to your user and repo names
+        url: ssh://git@github.com/$user/$repo
+        ref:
+          branch: main
+        secretRef:
+          name: github-deploy-key
+      ```
+  7. Commit and push changes
+  8. Force flux to reconcile your changes
+     ```sh
+     task cluster:reconcile
+     ```
+  9. Verify git repository is now using SSH:
+      ```sh
+      task cluster:gitrepositories
+      ```
+  10. Set your repository to Private in your repository settings.
+</details>
+
 ## 👉 Troubleshooting
 
 Our [wiki](https://github.com/k8s-at-home/template-cluster-k3s/wiki) (WIP, contributions welcome) is a good place to start troubleshooting issues. If that doesn't cover your issue, come join and say Hi in our [Discord](https://discord.gg/k8s-at-home) server by starting a new thread in the #kubernetes support channel.