@@ -31,6 +31,7 @@ import (
3131 authutils "github.com/fluxcd/pkg/auth/utils"
3232 "github.com/fluxcd/pkg/git/github"
3333 "github.com/fluxcd/pkg/runtime/logger"
34+ "github.com/fluxcd/pkg/runtime/secrets"
3435 "github.com/go-git/go-git/v5/plumbing/transport"
3536 corev1 "k8s.io/api/core/v1"
3637 "k8s.io/apimachinery/pkg/runtime"
@@ -485,7 +486,11 @@ func (r *GitRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
485486 var proxyURL * url.URL
486487 if obj .Spec .ProxySecretRef != nil {
487488 var err error
488- proxyOpts , proxyURL , err = r .getProxyOpts (ctx , obj .Spec .ProxySecretRef .Name , obj .GetNamespace ())
489+ secretRef := types.NamespacedName {
490+ Name : obj .Spec .ProxySecretRef .Name ,
491+ Namespace : obj .GetNamespace (),
492+ }
493+ proxyURL , err = secrets .ProxyURLFromSecretRef (ctx , r .Client , secretRef )
489494 if err != nil {
490495 e := serror .NewGeneric (
491496 fmt .Errorf ("failed to configure proxy options: %w" , err ),
@@ -495,6 +500,7 @@ func (r *GitRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
495500 // Return error as the world as observed may change
496501 return sreconcile .ResultEmpty , e
497502 }
503+ proxyOpts = & transport.ProxyOptions {URL : proxyURL .String ()}
498504 }
499505
500506 u , err := url .Parse (obj .Spec .URL )
@@ -617,52 +623,16 @@ func (r *GitRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
617623 return sreconcile .ResultSuccess , nil
618624}
619625
620- // getProxyOpts fetches the secret containing the proxy settings, constructs a
621- // transport.ProxyOptions object using those settings and then returns it.
622- func (r * GitRepositoryReconciler ) getProxyOpts (ctx context.Context , proxySecretName ,
623- proxySecretNamespace string ) (* transport.ProxyOptions , * url.URL , error ) {
624- proxyData , err := r .getSecretData (ctx , proxySecretName , proxySecretNamespace )
625- if err != nil {
626- return nil , nil , fmt .Errorf ("failed to get proxy secret '%s/%s': %w" , proxySecretNamespace , proxySecretName , err )
627- }
628- b , ok := proxyData ["address" ]
629- if ! ok {
630- return nil , nil , fmt .Errorf ("invalid proxy secret '%s/%s': key 'address' is missing" , proxySecretNamespace , proxySecretName )
631- }
632-
633- address := string (b )
634- username := string (proxyData ["username" ])
635- password := string (proxyData ["password" ])
636-
637- proxyOpts := & transport.ProxyOptions {
638- URL : address ,
639- Username : username ,
640- Password : password ,
641- }
642-
643- proxyURL , err := url .Parse (string (address ))
644- if err != nil {
645- return nil , nil , fmt .Errorf ("invalid address in proxy secret '%s/%s': %w" , proxySecretNamespace , proxySecretName , err )
646- }
647- switch {
648- case username != "" && password == "" :
649- proxyURL .User = url .User (username )
650- case username != "" && password != "" :
651- proxyURL .User = url .UserPassword (username , password )
652- }
653-
654- return proxyOpts , proxyURL , nil
655- }
656-
657626// getAuthOpts fetches the secret containing the auth options (if specified),
658627// constructs a git.AuthOptions object using those options along with the provided
659628// URL and returns it.
660629func (r * GitRepositoryReconciler ) getAuthOpts (ctx context.Context , obj * sourcev1.GitRepository ,
661630 u url.URL , proxyURL * url.URL ) (* git.AuthOptions , error ) {
631+ var secret * corev1.Secret
662632 var authData map [string ][]byte
663633 if obj .Spec .SecretRef != nil {
664634 var err error
665- authData , err = r .getSecretData (ctx , obj .Spec .SecretRef .Name , obj .GetNamespace ())
635+ secret , err = r .getSecret (ctx , obj .Spec .SecretRef .Name , obj .GetNamespace ())
666636 if err != nil {
667637 e := serror .NewGeneric (
668638 fmt .Errorf ("failed to get secret '%s/%s': %w" , obj .GetNamespace (), obj .Spec .SecretRef .Name , err ),
@@ -671,6 +641,7 @@ func (r *GitRepositoryReconciler) getAuthOpts(ctx context.Context, obj *sourcev1
671641 conditions .MarkTrue (obj , sourcev1 .FetchFailedCondition , e .Reason , "%s" , e )
672642 return nil , e
673643 }
644+ authData = secret .Data
674645 }
675646
676647 // Configure authentication strategy to access the source
@@ -717,24 +688,38 @@ func (r *GitRepositoryReconciler) getAuthOpts(ctx context.Context, obj *sourcev1
717688 conditions .MarkTrue (obj , sourcev1 .FetchFailedCondition , e .Reason , "%s" , e )
718689 return nil , e
719690 }
720-
691+ targetURL := fmt .Sprintf ("%s://%s" , u .Scheme , u .Host )
692+ authMethods , err := secrets .AuthMethodsFromSecret (ctx , secret , secrets .WithTargetURL (targetURL ), secrets .WithTLSSystemCertPool ())
693+ if err != nil {
694+ return nil , err
695+ }
696+ if ! authMethods .HasGitHubAppData () {
697+ e := serror .NewStalling (
698+ fmt .Errorf ("secretRef with github app data must be specified when provider is set to github" ),
699+ sourcev1 .InvalidProviderConfigurationReason ,
700+ )
701+ conditions .MarkTrue (obj , sourcev1 .FetchFailedCondition , e .Reason , "%s" , e )
702+ return nil , e
703+ }
721704 getCreds = func () (* authutils.GitCredentials , error ) {
722- var opts []github.OptFunc
705+ var appOpts []github.OptFunc
723706
724- if len (authData ) > 0 {
725- opts = append (opts , github .WithAppData (authData ))
726- }
707+ appOpts = append (appOpts , github .WithAppData (authMethods .GitHubAppData ))
727708
728709 if proxyURL != nil {
729- opts = append (opts , github .WithProxyURL (proxyURL ))
710+ appOpts = append (appOpts , github .WithProxyURL (proxyURL ))
730711 }
731712
732713 if r .TokenCache != nil {
733- opts = append (opts , github .WithCache (r .TokenCache , sourcev1 .GitRepositoryKind ,
714+ appOpts = append (appOpts , github .WithCache (r .TokenCache , sourcev1 .GitRepositoryKind ,
734715 obj .GetName (), obj .GetNamespace (), cache .OperationReconcile ))
735716 }
736717
737- username , password , err := github .GetCredentials (ctx , opts ... )
718+ if authMethods .HasTLS () {
719+ appOpts = append (appOpts , github .WithTLSConfig (authMethods .TLS ))
720+ }
721+
722+ username , password , err := github .GetCredentials (ctx , appOpts ... )
738723 if err != nil {
739724 return nil , err
740725 }
@@ -771,16 +756,16 @@ func (r *GitRepositoryReconciler) getAuthOpts(ctx context.Context, obj *sourcev1
771756 return opts , nil
772757}
773758
774- func (r * GitRepositoryReconciler ) getSecretData (ctx context.Context , name , namespace string ) (map [ string ][] byte , error ) {
759+ func (r * GitRepositoryReconciler ) getSecret (ctx context.Context , name , namespace string ) (* corev1. Secret , error ) {
775760 key := types.NamespacedName {
776761 Namespace : namespace ,
777762 Name : name ,
778763 }
779- var secret corev1.Secret
780- if err := r .Client .Get (ctx , key , & secret ); err != nil {
781- return nil , err
764+ secret := & corev1.Secret {}
765+ if err := r .Client .Get (ctx , key , secret ); err != nil {
766+ return nil , fmt . Errorf ( "failed to get secret '%s/%s': %w" , namespace , name , err )
782767 }
783- return secret . Data , nil
768+ return secret , nil
784769}
785770
786771// reconcileArtifact archives a new Artifact to the Storage, if the current
0 commit comments