Can I use remote function build on private git repository via ssh authenctication?

[Khodesaeed]

I have situation, that I need to use remote build of the func CLI feature with TekTon pipeline.

So far, I have a task that create func.yaml file:

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: create-func-config
spec:
  description: Creates the required func.yaml configuration file.
  params:
    - name: image-url
      description: The final image repository URL (e.g., registry.example.com/user/function)
      type: string
    - name: git-url
      description: The SSH Git URL for the function source code (e.g.,
      type: string
    - name: context-dir
      description: The context directory within the Git repository (if any)
      type: string
      default: ""
    - name: revision
      description: The Git revision (branch, tag, commit) to use
      type: string
      default: "main"
    - name: runtime
      description: The runtime/language for the function (e.g., node, python)
      type: string
      default: "go"
  workspaces:
    - name: output # The workspace where func.yaml will be created
  steps:
    - name: create-config-file
      image: bash:5.1 # A minimal image with bash
      workingDir: $(workspaces.output.path)
      script: |
        #!/bin/bash
        # Write the func.yaml content using the passed parameters
        cat > func.yaml <<EOF
        apiVersion: 'v1'
        kind: 'Function'
        metadata:
          name: my-function
        spec:
          # Use a language runtime, e.g., node
          runtime: "$(params.runtime)"
          image: "$(params.image-url)" 
          git:
            url: "$(params.git-url)"
            revision: $(params.revision)
            contextDir: "$(params.context-dir)"
        EOF
        echo "Debug Info: Created func.yaml with the following content:"
        cat func.yaml     
        echo "func.yaml created at $(workspaces.output.path)/func.yaml"

And here is the remote builder task:

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: kn-func-remote-build
spec:
  description: |
    Triggers an on-cluster build and deployment of a Knative Function
    using the 'func' CLI with the --remote flag.
  
  params:
    - name: image-url
      type: string
      description: The final image repository URL (e.g., registry.example.com/user/function)
  workspaces:
    - name: function-source
      description: The workspace where the func.yaml file is located.
  steps:
    - name: trigger-remote-deploy
      image: ghcr.io/knative/func/func:latest # Use the official func CLI image
      workingDir: $(workspaces.function-source.path)
      env:
        # Set the HOME environment variable as func might need it
        - name: HOME
          value: /tekton/home
      script: |
        #!/bin/bash
        echo "🚀 Starting remote build and deploy for Knative Function..."        
        echo "2. Triggering remote build and deploy (via Tekton TaskRun)..."
        # The --remote flag initiates the on-cluster build process.
        # This command will wait for the remote build to complete or fail.
        func deploy --remote --image $(params.image-url)
        if [ $? -ne 0 ]; then
          echo "❌ Remote build and deploy failed."
          exit 1
        fi     
        echo "✅ Remote build and deploy process completed."

And here is my pipeline:

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: function-build-pipeline
  namespace: knative-tenant-customer1
spec:
  params:
    - name: image-name
      description: The name of the function image (e.g., my-function)
      type: string
    - name: image-url
      description: The final image repository URL (e.g., registry.example.com/user/function)
      type: string
    - name: git-url
      description: The SSH Git URL for the function source code (e.g.,
      type: string
    - name: context-dir
      description: The context directory within the Git repository (if any)
      type: string
      default: "cluster-alpha/knative-tenant-customer1"
    - name: runtime
      description: The runtime/language for the function (e.g., node, python)
      type: string
      default: "go"
      
  workspaces:
    # Define a shared workspace for the function source/config
    - name: shared-config

  tasks:
    # --- 1. Create func.yaml ---
    - name: configure-function
      taskRef:
        name: create-func-config
      params:
        - name: image-url
          value: "$(params.image-url)/$(params.image-name)"
        - name: git-url
          value: $(params.git-url)
        - name: context-dir
          value: $(params.context-dir) 
        - name: runtime
          value: $(params.runtime)
      workspaces:
        # Map the Task's 'output' workspace to the Pipeline's 'shared-config' workspace
        - name: output
          workspace: shared-config
          
    # --- 2. Run the Remote Build ---
    - name: build-and-deploy
      runAfter:
        - configure-function # Ensure config task runs first
      taskRef:
        name: kn-func-remote-build
      params:
        # Pass parameters directly to the build task
        - name: image-url
          value: $(params.image-url)
        - name: git-url
          value: $(params.git-url)
      workspaces:
        # Map the Task's 'function-source' workspace to the Pipeline's 'shared-config' workspace
        - name: function-source
          workspace: shared-config

And here is my pipelinerun file:

apiVersion: v1
kind: Secret
metadata:
  name: dockerconfig-secret
  namespace: knative-tenant-customer1
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: <base6d encoded data>
---
apiVersion: v1
kind: Secret
metadata:
  name: git-credentials
  namespace: knative-tenant-customer1
  annotations:
    tekton.dev/git-0: <private-repo>
type: kubernetes.io/ssh-auth
data:
  id_rsa: <base6d encoded data>
  known_hosts: <base6d encoded data>
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: knative-function-sa
  namespace: knative-tenant-customer1
secrets:
  - name: git-credentials
imagePullSecrets:
  - name:  dockerconfig-secret 
---
apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
  name: run-function-build-pipeline
spec:
  pipelineRef:
    name: function-build-pipeline
  serviceAccountName: knative-function-sa

  params:
    - name: image-name
      value: "ipinfo-function"
    - name: image-url
      value: "<private-registry>"
    - name: git-url
      value: "<private repo>"
      
  workspaces:
    - name: shared-config
      # Use a volumeClaimTemplate to dynamically create a PVC for the shared files
      volumeClaimTemplate:
        spec:
          accessModes:
            - ReadWriteOnce
          resources:
            requests:
              storage: 1G

But I'm not sure if this approach is correct. (create two secrets of git repository and registry credential and assign them to a ServiceAccount)
Besides, the git credential doesn't applied into cluster.