@@ -25,6 +25,7 @@ import (
2525 "time"
2626
2727 "github.com/ProtonMail/go-crypto/openpgp"
28+ "github.com/fluxcd/pkg/runtime/secrets"
2829 "github.com/go-git/go-git/v5/plumbing/transport"
2930 corev1 "k8s.io/api/core/v1"
3031 metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -165,13 +166,15 @@ func configurePush(cfg *gitSrcCfg, gitSpec *imagev1.GitSpec, checkoutRef *source
165166
166167func getAuthOpts (ctx context.Context , c client.Client , repo * sourcev1.GitRepository ,
167168 srcOpts SourceOptions , proxyURL * url.URL ) (* git.AuthOptions , error ) {
169+ var secret * corev1.Secret
168170 var data map [string ][]byte
169171 var err error
170172 if repo .Spec .SecretRef != nil {
171- data , err = getSecretData (ctx , c , repo .Spec .SecretRef .Name , repo .GetNamespace ())
173+ secret , err = getSecret (ctx , c , repo .Spec .SecretRef .Name , repo .GetNamespace ())
172174 if err != nil {
173175 return nil , fmt .Errorf ("failed to get auth secret '%s/%s': %w" , repo .GetNamespace (), repo .Spec .SecretRef .Name , err )
174176 }
177+ data = secret .Data
175178 }
176179
177180 u , err := url .Parse (repo .Spec .URL )
@@ -211,24 +214,34 @@ func getAuthOpts(ctx context.Context, c client.Client, repo *sourcev1.GitReposit
211214 if repo .Spec .SecretRef == nil {
212215 return nil , fmt .Errorf ("secretRef with github app data must be specified when provider is set to github: %w" , ErrInvalidSourceConfiguration )
213216 }
217+ targetURL := fmt .Sprintf ("%s://%s" , u .Scheme , u .Host )
218+ authMethods , err := secrets .AuthMethodsFromSecret (ctx , secret , secrets .WithTargetURL (targetURL ), secrets .WithTLSSystemCertPool ())
219+ if err != nil {
220+ return nil , err
221+ }
222+ if ! authMethods .HasGitHubAppData () {
223+ return nil , fmt .Errorf ("secretRef with github app data must be specified when provider is set to github: %w" , ErrInvalidSourceConfiguration )
224+ }
214225
215226 getCreds = func () (* authutils.GitCredentials , error ) {
216- var opts []github.OptFunc
227+ var appOpts []github.OptFunc
217228
218- if len (data ) > 0 {
219- opts = append (opts , github .WithAppData (data ))
220- }
229+ appOpts = append (appOpts , github .WithAppData (authMethods .GitHubAppData ))
221230
222231 if proxyURL != nil {
223- opts = append (opts , github .WithProxyURL (proxyURL ))
232+ appOpts = append (appOpts , github .WithProxyURL (proxyURL ))
224233 }
225234
226235 if srcOpts .tokenCache != nil {
227- opts = append (opts , github .WithCache (srcOpts .tokenCache , imagev1 .ImageUpdateAutomationKind ,
236+ appOpts = append (appOpts , github .WithCache (srcOpts .tokenCache , imagev1 .ImageUpdateAutomationKind ,
228237 srcOpts .objName , srcOpts .objNamespace , cache .OperationReconcile ))
229238 }
230239
231- username , password , err := github .GetCredentials (ctx , opts ... )
240+ if authMethods .HasTLS () {
241+ appOpts = append (appOpts , github .WithTLSConfig (authMethods .TLS ))
242+ }
243+
244+ username , password , err := github .GetCredentials (ctx , appOpts ... )
232245 if err != nil {
233246 return nil , err
234247 }
@@ -259,38 +272,15 @@ func getProxyOpts(ctx context.Context, c client.Client, repo *sourcev1.GitReposi
259272 if repo .Spec .ProxySecretRef == nil {
260273 return nil , nil , nil
261274 }
262- name := repo .Spec .ProxySecretRef .Name
263- namespace := repo .GetNamespace ()
264- proxyData , err := getSecretData (ctx , c , name , namespace )
265- if err != nil {
266- return nil , nil , fmt .Errorf ("failed to get proxy secret '%s/%s': %w" , namespace , name , err )
267- }
268- b , ok := proxyData ["address" ]
269- if ! ok {
270- return nil , nil , fmt .Errorf ("invalid proxy secret '%s/%s': key 'address' is missing" , namespace , name )
271- }
272-
273- address := string (b )
274- username := string (proxyData ["username" ])
275- password := string (proxyData ["password" ])
276-
277- proxyOpts := & transport.ProxyOptions {
278- URL : address ,
279- Username : username ,
280- Password : password ,
275+ secretRef := types.NamespacedName {
276+ Name : repo .Spec .ProxySecretRef .Name ,
277+ Namespace : repo .GetNamespace (),
281278 }
282-
283- proxyURL , err := url .Parse (string (address ))
279+ proxyURL , err := secrets .ProxyURLFromSecretRef (ctx , c , secretRef )
284280 if err != nil {
285- return nil , nil , fmt .Errorf ("invalid address in proxy secret '%s/%s': %w" , namespace , name , err )
281+ return nil , nil , fmt .Errorf ("failed to get proxy URL from secret '%s/%s': %w" , secretRef . Namespace , secretRef . Name , err )
286282 }
287- switch {
288- case username != "" && password == "" :
289- proxyURL .User = url .User (username )
290- case username != "" && password != "" :
291- proxyURL .User = url .UserPassword (username , password )
292- }
293-
283+ proxyOpts := & transport.ProxyOptions {URL : proxyURL .String ()}
294284 return proxyOpts , proxyURL , nil
295285}
296286
@@ -330,13 +320,21 @@ func getSigningEntity(ctx context.Context, c client.Client, namespace string, gi
330320}
331321
332322func getSecretData (ctx context.Context , c client.Client , name , namespace string ) (map [string ][]byte , error ) {
323+ secret , err := getSecret (ctx , c , name , namespace )
324+ if err != nil {
325+ return nil , err
326+ }
327+ return secret .Data , nil
328+ }
329+
330+ func getSecret (ctx context.Context , c client.Client , name , namespace string ) (* corev1.Secret , error ) {
333331 key := types.NamespacedName {
334332 Namespace : namespace ,
335333 Name : name ,
336334 }
337- var secret corev1.Secret
338- if err := c .Get (ctx , key , & secret ); err != nil {
335+ secret := & corev1.Secret {}
336+ if err := c .Get (ctx , key , secret ); err != nil {
339337 return nil , err
340338 }
341- return secret . Data , nil
339+ return secret , nil
342340}
0 commit comments