@@ -27,7 +27,7 @@ import (
2727 "time"
2828
2929 securejoin "github.com/cyphar/filepath-securejoin"
30- "github.com/fluxcd/pkg/auth/azure "
30+ "github.com/fluxcd/pkg/auth"
3131 "github.com/fluxcd/pkg/git/github"
3232 "github.com/fluxcd/pkg/runtime/logger"
3333 "github.com/go-git/go-git/v5/plumbing/transport"
@@ -485,9 +485,10 @@ func (r *GitRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
485485 }
486486
487487 var proxyOpts * transport.ProxyOptions
488+ var proxyURL * url.URL
488489 if obj .Spec .ProxySecretRef != nil {
489490 var err error
490- proxyOpts , err = r .getProxyOpts (ctx , obj .Spec .ProxySecretRef .Name , obj .GetNamespace ())
491+ proxyOpts , proxyURL , err = r .getProxyOpts (ctx , obj .Spec .ProxySecretRef .Name , obj .GetNamespace ())
491492 if err != nil {
492493 e := serror .NewGeneric (
493494 fmt .Errorf ("failed to configure proxy options: %w" , err ),
@@ -509,7 +510,7 @@ func (r *GitRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
509510 return sreconcile .ResultEmpty , e
510511 }
511512
512- authOpts , err := r .getAuthOpts (ctx , obj , * u )
513+ authOpts , err := r .getAuthOpts (ctx , obj , * u , proxyURL )
513514 if err != nil {
514515 // Return error as the world as observed may change
515516 return sreconcile .ResultEmpty , err
@@ -622,28 +623,45 @@ func (r *GitRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
622623// getProxyOpts fetches the secret containing the proxy settings, constructs a
623624// transport.ProxyOptions object using those settings and then returns it.
624625func (r * GitRepositoryReconciler ) getProxyOpts (ctx context.Context , proxySecretName ,
625- proxySecretNamespace string ) (* transport.ProxyOptions , error ) {
626+ proxySecretNamespace string ) (* transport.ProxyOptions , * url. URL , error ) {
626627 proxyData , err := r .getSecretData (ctx , proxySecretName , proxySecretNamespace )
627628 if err != nil {
628- return nil , fmt .Errorf ("failed to get proxy secret '%s/%s': %w" , proxySecretNamespace , proxySecretName , err )
629+ return nil , nil , fmt .Errorf ("failed to get proxy secret '%s/%s': %w" , proxySecretNamespace , proxySecretName , err )
629630 }
630- address , ok := proxyData ["address" ]
631+ b , ok := proxyData ["address" ]
631632 if ! ok {
632- return nil , fmt .Errorf ("invalid proxy secret '%s/%s': key 'address' is missing" , proxySecretNamespace , proxySecretName )
633+ return nil , nil , fmt .Errorf ("invalid proxy secret '%s/%s': key 'address' is missing" , proxySecretNamespace , proxySecretName )
633634 }
634635
636+ address := string (b )
637+ username := string (proxyData ["username" ])
638+ password := string (proxyData ["password" ])
639+
635640 proxyOpts := & transport.ProxyOptions {
636- URL : string (address ),
637- Username : string (proxyData ["username" ]),
638- Password : string (proxyData ["password" ]),
641+ URL : address ,
642+ Username : username ,
643+ Password : password ,
644+ }
645+
646+ proxyURL , err := url .Parse (string (address ))
647+ if err != nil {
648+ return nil , nil , fmt .Errorf ("invalid address in proxy secret '%s/%s': %w" , proxySecretNamespace , proxySecretName , err )
639649 }
640- return proxyOpts , nil
650+ switch {
651+ case username != "" && password == "" :
652+ proxyURL .User = url .User (username )
653+ case username != "" && password != "" :
654+ proxyURL .User = url .UserPassword (username , password )
655+ }
656+
657+ return proxyOpts , proxyURL , nil
641658}
642659
643660// getAuthOpts fetches the secret containing the auth options (if specified),
644661// constructs a git.AuthOptions object using those options along with the provided
645662// URL and returns it.
646- func (r * GitRepositoryReconciler ) getAuthOpts (ctx context.Context , obj * sourcev1.GitRepository , u url.URL ) (* git.AuthOptions , error ) {
663+ func (r * GitRepositoryReconciler ) getAuthOpts (ctx context.Context , obj * sourcev1.GitRepository ,
664+ u url.URL , proxyURL * url.URL ) (* git.AuthOptions , error ) {
647665 var authData map [string ][]byte
648666 if obj .Spec .SecretRef != nil {
649667 var err error
@@ -659,7 +677,7 @@ func (r *GitRepositoryReconciler) getAuthOpts(ctx context.Context, obj *sourcev1
659677 }
660678
661679 // Configure authentication strategy to access the source
662- authOpts , err := git .NewAuthOptions (u , authData )
680+ opts , err := git .NewAuthOptions (u , authData )
663681 if err != nil {
664682 e := serror .NewGeneric (
665683 fmt .Errorf ("failed to configure authentication options: %w" , err ),
@@ -669,14 +687,28 @@ func (r *GitRepositoryReconciler) getAuthOpts(ctx context.Context, obj *sourcev1
669687 return nil , e
670688 }
671689
690+ var authOpts []auth.Option
691+
692+ if r .tokenCache != nil {
693+ involvedObject := cache.InvolvedObject {
694+ Kind : sourcev1 .GitRepositoryKind ,
695+ Name : obj .GetName (),
696+ Namespace : obj .GetNamespace (),
697+ Operation : cache .OperationReconcile ,
698+ }
699+ authOpts = append (authOpts , auth .WithCache (* r .tokenCache , involvedObject ))
700+ }
701+
702+ if proxyURL != nil {
703+ authOpts = append (authOpts , auth .WithProxyURL (* proxyURL ))
704+ }
705+
672706 // Configure provider authentication if specified in spec
673707 switch obj .GetProvider () {
674708 case sourcev1 .GitProviderAzure :
675- authOpts .ProviderOpts = & git.ProviderOptions {
676- Name : sourcev1 .GitProviderAzure ,
677- AzureOpts : []azure.OptFunc {
678- azure .WithAzureDevOpsScope (),
679- },
709+ opts .ProviderOpts = & git.ProviderOptions {
710+ Name : sourcev1 .GitProviderAzure ,
711+ AuthOpts : authOpts ,
680712 }
681713 case sourcev1 .GitProviderGitHub :
682714 // if provider is github, but secret ref is not specified
@@ -689,11 +721,13 @@ func (r *GitRepositoryReconciler) getAuthOpts(ctx context.Context, obj *sourcev1
689721 return nil , e
690722 }
691723
692- authOpts .ProviderOpts = & git.ProviderOptions {
724+ opts .ProviderOpts = & git.ProviderOptions {
693725 Name : sourcev1 .GitProviderGitHub ,
694726 GitHubOpts : []github.OptFunc {
695727 github .WithAppData (authData ),
696- github .WithCache (r .tokenCache , sourcev1 .GitRepositoryKind , obj .GetName (), obj .GetNamespace ()),
728+ github .WithProxyURL (proxyURL ),
729+ github .WithCache (r .tokenCache , sourcev1 .GitRepositoryKind ,
730+ obj .GetName (), obj .GetNamespace (), cache .OperationReconcile ),
697731 },
698732 }
699733 default :
@@ -707,7 +741,7 @@ func (r *GitRepositoryReconciler) getAuthOpts(ctx context.Context, obj *sourcev1
707741 return nil , e
708742 }
709743 }
710- return authOpts , nil
744+ return opts , nil
711745}
712746
713747func (r * GitRepositoryReconciler ) getSecretData (ctx context.Context , name , namespace string ) (map [string ][]byte , error ) {
@@ -1116,7 +1150,8 @@ func (r *GitRepositoryReconciler) reconcileDelete(ctx context.Context, obj *sour
11161150 controllerutil .RemoveFinalizer (obj , sourcev1 .SourceFinalizer )
11171151
11181152 // Cleanup caches.
1119- r .tokenCache .DeleteEventsForObject (sourcev1 .GitRepositoryKind , obj .GetName (), obj .GetNamespace ())
1153+ r .tokenCache .DeleteEventsForObject (sourcev1 .GitRepositoryKind ,
1154+ obj .GetName (), obj .GetNamespace (), cache .OperationReconcile )
11201155
11211156 // Stop reconciliation as the object is being deleted
11221157 return sreconcile .ResultEmpty , nil
0 commit comments