Problem

The git-configuration init container runs eval \ssh-agent`to set up SSH authentication for cloning private git repositories. In newer OpenSSH versions (10.x+),ssh-agentattempts to create its socket at/root/.ssh/agent/instead of/tmp/`. This path is read-only in the container, causing the following error:

ensure_mkdir: mkdir /root/.ssh/agent: Read-only file system
main: Couldn't prepare agent socket
Could not open a connection to your authentication agent.

This breaks the gitCredentialsSecretReference flow for ComponentDefinitions pointing at private SSH git repos.

Affected: OpenSSH >= 10.x (e.g. alpine/git:latest ships OpenSSH_10.2p1)
Not affected: OpenSSH <= 9.x (e.g. alpine/git:v2.30.2)

Fix options

Option 1 (recommended) — explicit socket path in the script
Change the init container script from:

eval `ssh-agent`

to:

eval `ssh-agent -a /tmp/ssh-agent.sock`
export SSH_AUTH_SOCK=/tmp/ssh-agent.sock

/tmp is always writable regardless of OpenSSH version. No image pinning needed.

Option 2 — mount an emptyDir at the expected path
Add a writable emptyDir volume mounted at /root/.ssh/agent in the init container spec. No script changes needed.

Option 3 — set SSH_AUTH_SOCK env var
Set SSH_AUTH_SOCK=/tmp/ssh-agent.sock on the init container and invoke ssh-agent -a /tmp/ssh-agent.sock explicitly.

Current workaround

Pin gitImage to alpine/git:v2.30.2 when installing via Helm:

helm install terraform-controller ... --set gitImage=alpine/git:v2.30.2

This is not a long-term solution as it locks to an unmaintained image with accumulating CVEs.