@@ -25,6 +25,7 @@ import (
2525 "time"
2626
2727 "github.com/ProtonMail/go-crypto/openpgp"
28+ "github.com/fluxcd/pkg/runtime/secrets"
2829 "github.com/go-git/go-git/v5/plumbing/transport"
2930 corev1 "k8s.io/api/core/v1"
3031 metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -165,13 +166,15 @@ func configurePush(cfg *gitSrcCfg, gitSpec *imagev1.GitSpec, checkoutRef *source
165166
166167func getAuthOpts (ctx context.Context , c client.Client , repo * sourcev1.GitRepository ,
167168 srcOpts SourceOptions , proxyURL * url.URL ) (* git.AuthOptions , error ) {
169+ var secret * corev1.Secret
168170 var data map [string ][]byte
169171 var err error
170172 if repo .Spec .SecretRef != nil {
171- data , err = getSecretData (ctx , c , repo .Spec .SecretRef .Name , repo .GetNamespace ())
173+ secret , err = getSecret (ctx , c , repo .Spec .SecretRef .Name , repo .GetNamespace ())
172174 if err != nil {
173175 return nil , fmt .Errorf ("failed to get auth secret '%s/%s': %w" , repo .GetNamespace (), repo .Spec .SecretRef .Name , err )
174176 }
177+ data = secret .Data
175178 }
176179
177180 u , err := url .Parse (repo .Spec .URL )
@@ -211,12 +214,20 @@ func getAuthOpts(ctx context.Context, c client.Client, repo *sourcev1.GitReposit
211214 if repo .Spec .SecretRef == nil {
212215 return nil , fmt .Errorf ("secretRef with github app data must be specified when provider is set to github: %w" , ErrInvalidSourceConfiguration )
213216 }
217+ targetURL := fmt .Sprintf ("%s://%s" , u .Scheme , u .Host )
218+ authMethods , err := secrets .AuthMethodsFromSecret (ctx , secret , secrets .WithTargetURL (targetURL ), secrets .WithTLSSystemCertPool ())
219+ if err != nil {
220+ return nil , err
221+ }
222+ if ! authMethods .HasGitHubAppData () {
223+ return nil , fmt .Errorf ("secretRef with github app data must be specified when provider is set to github: %w" , ErrInvalidSourceConfiguration )
224+ }
214225
215226 getCreds = func () (* authutils.GitCredentials , error ) {
216227 var opts []github.OptFunc
217228
218229 if len (data ) > 0 {
219- opts = append (opts , github .WithAppData (data ))
230+ opts = append (opts , github .WithAppData (authMethods . GitHubAppData ))
220231 }
221232
222233 if proxyURL != nil {
@@ -228,6 +239,10 @@ func getAuthOpts(ctx context.Context, c client.Client, repo *sourcev1.GitReposit
228239 srcOpts .objName , srcOpts .objNamespace , cache .OperationReconcile ))
229240 }
230241
242+ if authMethods .HasTLS () {
243+ opts = append (opts , github .WithTLSConfig (authMethods .TLS ))
244+ }
245+
231246 username , password , err := github .GetCredentials (ctx , opts ... )
232247 if err != nil {
233248 return nil , err
@@ -330,13 +345,21 @@ func getSigningEntity(ctx context.Context, c client.Client, namespace string, gi
330345}
331346
332347func getSecretData (ctx context.Context , c client.Client , name , namespace string ) (map [string ][]byte , error ) {
348+ secret , err := getSecret (ctx , c , name , namespace )
349+ if err != nil {
350+ return nil , err
351+ }
352+ return secret .Data , nil
353+ }
354+
355+ func getSecret (ctx context.Context , c client.Client , name , namespace string ) (* corev1.Secret , error ) {
333356 key := types.NamespacedName {
334357 Namespace : namespace ,
335358 Name : name ,
336359 }
337- var secret corev1.Secret
338- if err := c .Get (ctx , key , & secret ); err != nil {
360+ secret := & corev1.Secret {}
361+ if err := c .Get (ctx , key , secret ); err != nil {
339362 return nil , err
340363 }
341- return secret . Data , nil
364+ return secret , nil
342365}
0 commit comments