Add support for mTLS to GitHub App transport #947
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
tested on GitHub Enterprise with mTLS GitHub App credentials - Note source-controller was built and run from fluxcd/source-controller#1860 Screenhost
Logs{"level":"info","ts":"2025-08-13T15:17:25.412+0200","logger":"setup","msg":"starting manager"}
{"level":"info","ts":"2025-08-13T15:17:25.413+0200","logger":"controller-runtime.metrics","msg":"Starting metrics server"}
{"level":"info","ts":"2025-08-13T15:17:25.413+0200","msg":"starting server","name":"health probe","addr":"[::]:9440"}
{"level":"info","ts":"2025-08-13T15:17:25.413+0200","logger":"controller-runtime.metrics","msg":"Serving metrics server","bindAddress":":8080","secure":false}
{"level":"info","ts":"2025-08-13T15:17:25.514+0200","msg":"Starting EventSource","controller":"imageupdateautomation","controllerGroup":"image.toolkit.fluxcd.io","controllerKind":"ImageUpdateAutomation","source":"kind source: *v1beta2.ImageUpdateAutomation"}
{"level":"info","ts":"2025-08-13T15:17:25.514+0200","msg":"Starting EventSource","controller":"imageupdateautomation","controllerGroup":"image.toolkit.fluxcd.io","controllerKind":"ImageUpdateAutomation","source":"kind source: *v1.GitRepository"}
{"level":"info","ts":"2025-08-13T15:17:25.514+0200","msg":"Starting EventSource","controller":"imageupdateautomation","controllerGroup":"image.toolkit.fluxcd.io","controllerKind":"ImageUpdateAutomation","source":"kind source: *v1beta2.ImagePolicy"}
{"level":"info","ts":"2025-08-13T15:17:25.615+0200","msg":"Starting Controller","controller":"imageupdateautomation","controllerGroup":"image.toolkit.fluxcd.io","controllerKind":"ImageUpdateAutomation"}
{"level":"info","ts":"2025-08-13T15:17:25.615+0200","msg":"Starting workers","controller":"imageupdateautomation","controllerGroup":"image.toolkit.fluxcd.io","controllerKind":"ImageUpdateAutomation","worker count":4}
{"level":"info","ts":"2025-08-13T15:17:44.791+0200","msg":"metadata.finalizers: \"finalizers.fluxcd.io\": prefer a domain-qualified finalizer name to avoid accidental conflicts with other finalizer writers","controller":"imageupdateautomation","controllerGroup":"image.toolkit.fluxcd.io","controllerKind":"ImageUpdateAutomation","ImageUpdateAutomation":{"name":"podinfo-update","namespace":"flux-system"},"namespace":"flux-system","name":"podinfo-update","reconcileID":"74bbc70f-d99b-4be0-a182-3d16dfd009b1"}
{"level":"info","ts":"2025-08-13T15:17:46.690+0200","msg":"repository up-to-date","controller":"imageupdateautomation","controllerGroup":"image.toolkit.fluxcd.io","controllerKind":"ImageUpdateAutomation","ImageUpdateAutomation":{"name":"podinfo-update","namespace":"flux-system"},"namespace":"flux-system","name":"podinfo-update","reconcileID":"a6e9294a-4d36-4ff7-b716-e7683ac56a61"}
{"level":"info","ts":"2025-08-13T15:19:55.738+0200","msg":"no change since last reconciliation","controller":"imageupdateautomation","controllerGroup":"image.toolkit.fluxcd.io","controllerKind":"ImageUpdateAutomation","ImageUpdateAutomation":{"name":"podinfo-update","namespace":"flux-system"},"namespace":"flux-system","name":"podinfo-update","reconcileID":"d8e48fef-0972-4f0a-ab2e-0528a68496c8"}
{"level":"info","ts":"2025-08-13T15:28:04.990+0200","msg":"no change since last reconciliation","controller":"imageupdateautomation","controllerGroup":"image.toolkit.fluxcd.io","controllerKind":"ImageUpdateAutomation","ImageUpdateAutomation":{"name":"podinfo-update","namespace":"flux-system"},"namespace":"flux-system","name":"podinfo-update","reconcileID":"35d78f57-fae3-41a9-a627-edaec5ebb731"}
{"level":"info","ts":"2025-08-13T15:31:00.189+0200","logger":"controller-runtime.cache","msg":"Warning: watch ended with error","reflector":"pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:285","type":"*v1.GitRepository","err":"an error on the server (\"unable to decode an event from the watch stream: http2: client connection lost\") has prevented the request from succeeding"}
{"level":"info","ts":"2025-08-13T15:31:00.189+0200","logger":"controller-runtime.cache","msg":"Warning: watch ended with error","reflector":"pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:285","type":"*v1beta2.ImagePolicy","err":"an error on the server (\"unable to decode an event from the watch stream: http2: client connection lost\") has prevented the request from succeeding"}
{"level":"info","ts":"2025-08-13T15:31:00.189+0200","msg":"no change since last reconciliation","controller":"imageupdateautomation","controllerGroup":"image.toolkit.fluxcd.io","controllerKind":"ImageUpdateAutomation","ImageUpdateAutomation":{"name":"podinfo-update","namespace":"flux-system"},"namespace":"flux-system","name":"podinfo-update","reconcileID":"e2b73d1f-3ba4-4002-b61d-60cfba4b676d"}
{"level":"error","ts":"2025-08-13T15:41:58.382+0200","msg":"failed to update source: failed to push to remote: authorization failed: Permission to teaser/podinfo.git denied to gitops[bot].","controller":"imageupdateautomation","controllerGroup":"image.toolkit.fluxcd.io","controllerKind":"ImageUpdateAutomation","ImageUpdateAutomation":{"name":"podinfo-update","namespace":"flux-system"},"namespace":"flux-system","name":"podinfo-update","reconcileID":"830558a2-6396-44a1-8bb3-f09562c5662b","error":"GitOperationFailed"}
{"level":"error","ts":"2025-08-13T15:41:58.397+0200","msg":"Reconciler error","controller":"imageupdateautomation","controllerGroup":"image.toolkit.fluxcd.io","controllerKind":"ImageUpdateAutomation","ImageUpdateAutomation":{"name":"podinfo-update","namespace":"flux-system"},"namespace":"flux-system","name":"podinfo-update","reconcileID":"830558a2-6396-44a1-8bb3-f09562c5662b","error":"failed to update source: failed to push to remote: authorization failed: Permission to teaser/podinfo.git denied to gitops[bot]."}
{"level":"info","ts":"2025-08-13T15:43:22.524+0200","msg":"pushed commit '0120fd9' to branch 'main'\nUpdate from image update automation","controller":"imageupdateautomation","controllerGroup":"image.toolkit.fluxcd.io","controllerKind":"ImageUpdateAutomation","ImageUpdateAutomation":{"name":"podinfo-update","namespace":"flux-system"},"namespace":"flux-system","name":"podinfo-update","reconcileID":"6750bf8f-ac6d-4b5f-b4b5-6c4b9bfc1c3e"}The errors in logs is due to missing permissions on the GitHub App initially. |
abhijith-darshan
force-pushed
the
feat/gh_app_tls
branch
from
043d3ac to
2ffa98b
Compare
matheuscscp
reviewed
Aug 13, 2025
abhijith-darshan
force-pushed
the
feat/gh_app_tls
branch
from
2ffa98b to
4ed023e
Compare
this commit ensures that if ca.crt or caFile is available in the github app secret, a tls config with user provided certs is appended to system cert pool and passed to the underlying http transport Signed-off-by: abhijith-darshan <[email protected]> (chore): keeps implementation in-sync with source-controller Signed-off-by: abhijith-darshan <[email protected]> (chore): inline proxy detection This commit removes getProxyOpts(...) helper func and uses pkg/runtime/secrets to retrieve proxy information from secret reference Signed-off-by: abhijith-darshan <[email protected]> (chore): remove err formatting for secrets.ProxyURLFromSecretRef Signed-off-by: abhijith-darshan <[email protected]>
abhijith-darshan
force-pushed
the
feat/gh_app_tls
branch
from
4ed023e to
57516b1
Compare
stefanprodan
added
area/security
stefanprodan
approved these changes
Aug 14, 2025
3 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If
ca.crtorcaFileis available in the GitHub App secret, a TLS config with user provided certs is appended to system cert pool and passed to the underlying GitHub App transport.related to -
fluxcd/pkg#999
fluxcd/source-controller#1860