Skip to content

Commit 8e06af4

Browse files
dipti-paidipti-pai
committed
[RFC-007] Implement GitHub app authentication for git repositories.
- API change to add new `github` provider field in `GitRepository` spec. - Controller change to use the GitHub authentication information specified in `.spec.secretRef` to create the auth options to authenticate to git repositories when the `provider` field is set to `github`, - Tests for new `github` provider field - Updated docs to use GitHub Apps for authentication in source-controller. Signed-off-by: Dipti Pai <[email protected]>
1 parent 53868f7 commit 8e06af4

File tree

8 files changed

+277
-102
lines changed

8 files changed

+277
-102
lines changed

‎api/v1/gitrepository_types.go‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,10 @@ const (
3535
// GitProviderAzure provides support for authentication to azure
3636
// repositories using Managed Identity.
3737
GitProviderAzure string = "azure"
38+
39+
// GitProviderGitHub provides support for authentication to git
40+
// repositories using GitHub App authentication
41+
GitProviderGitHub string = "github"
3842
)
3943

4044
const (
@@ -88,9 +92,9 @@ type GitRepositorySpec struct {
8892
// +optional
8993
SecretRef *meta.LocalObjectReference `json:"secretRef,omitempty"`
9094

91-
// Provider used for authentication, can be 'azure', 'generic'.
95+
// Provider used for authentication, can be 'azure', 'github', 'generic'.
9296
// When not specified, defaults to 'generic'.
93-
// +kubebuilder:validation:Enum=generic;azure
97+
// +kubebuilder:validation:Enum=generic;azure;github
9498
// +optional
9599
Provider string `json:"provider,omitempty"`
96100

‎config/crd/bases/source.toolkit.fluxcd.io_gitrepositories.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,11 +105,12 @@ spec:
105105
type: string
106106
provider:
107107
description: |-
108-
Provider used for authentication, can be 'azure', 'generic'.
108+
Provider used for authentication, can be 'azure', 'github', 'generic'.
109109
When not specified, defaults to 'generic'.
110110
enum:
111111
- generic
112112
- azure
113+
- github
113114
type: string
114115
proxySecretRef:
115116
description: |-

‎docs/api/v1/source.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -390,7 +390,7 @@ string
390390
</td>
391391
<td>
392392
<em>(Optional)</em>
393-
<p>Provider used for authentication, can be &lsquo;azure&rsquo;, &lsquo;generic&rsquo;.
393+
<p>Provider used for authentication, can be &lsquo;azure&rsquo;, &lsquo;github&rsquo;, &lsquo;generic&rsquo;.
394394
When not specified, defaults to &lsquo;generic&rsquo;.</p>
395395
</td>
396396
</tr>
@@ -1730,7 +1730,7 @@ string
17301730
</td>
17311731
<td>
17321732
<em>(Optional)</em>
1733-
<p>Provider used for authentication, can be &lsquo;azure&rsquo;, &lsquo;generic&rsquo;.
1733+
<p>Provider used for authentication, can be &lsquo;azure&rsquo;, &lsquo;github&rsquo;, &lsquo;generic&rsquo;.
17341734
When not specified, defaults to &lsquo;generic&rsquo;.</p>
17351735
</td>
17361736
</tr>

‎docs/spec/v1/gitrepositories.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -221,6 +221,7 @@ Supported options are:
221221

222222
- `generic`
223223
- `azure`
224+
- `github`
224225

225226
When provider is not specified, it defaults to `generic` indicating that
226227
mechanisms using `spec.secretRef` are used for authentication.
@@ -296,6 +297,54 @@ must follow this format:
296297
```
297298
https://dev.azure.com/{your-organization}/{your-project}/_git/{your-repository}
298299
```
300+
#### GitHub
301+
302+
The `github` provider can be used to authenticate to Git repositories using
303+
[GitHub Apps](https://docs.github.com/en/apps/overview).
304+
305+
##### Pre-requisites
306+
307+
- [Register](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app)
308+
the GitHub App with the necessary permissions and [generate a private
309+
key](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/managing-private-keys-for-github-apps)
310+
for the app.
311+
312+
- [Install](https://docs.github.com/en/apps/using-github-apps/installing-your-own-github-app)
313+
the app in the organization/account configuring access to the necessary
314+
repositories.
315+
316+
##### Configure GitHub App secret
317+
318+
The GitHub App information is specified in `.spec.secretRef` in the format
319+
specified below:
320+
321+
- Get the App ID from the app settings page at
322+
`https://github.com/settings/apps/<app-name>`.
323+
- Get the App Installation ID from the app installations page at
324+
`https://github.com/settings/installations`. Click the installed app, the URL
325+
will contain the installation ID
326+
`https://github.com/settings/installations/<installation-id>`. For
327+
organizations, the first part of the URL may be different, but it follows the
328+
same pattern.
329+
- The private key that was generated in the pre-requisites.
330+
- (Optional) GitHub Enterprise Server users can set the base URL to
331+
`http(s)://HOSTNAME/api/v3`.
332+
333+
```yaml
334+
apiVersion: v1
335+
kind: Secret
336+
metadata:
337+
name: github-sa
338+
type: Opaque
339+
stringData:
340+
githubAppID: "<app-id>"
341+
githubAppInstallationID: "<app-installation-id>"
342+
githubAppPrivateKey: |
343+
-----BEGIN RSA PRIVATE KEY-----
344+
...
345+
-----END RSA PRIVATE KEY-----
346+
githubAppBaseURL: "<github-enterprise-api-url>" #optional, required only for GitHub Enterprise Server users
347+
```
299348

300349
### Interval
301350

‎go.mod‎

Lines changed: 25 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/fluxcd/source-controller
22

3-
go 1.22.5
3+
go 1.22.7
44

55
replace github.com/fluxcd/source-controller/api => ./api
66

@@ -12,21 +12,21 @@ require (
1212
cloud.google.com/go/compute/metadata v0.5.1
1313
cloud.google.com/go/storage v1.43.0
1414
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24
15-
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.14.0
16-
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0
15+
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0
16+
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.0
1717
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.4.0
18-
github.com/Masterminds/semver/v3 v3.3.0
19-
github.com/cyphar/filepath-securejoin v0.3.2
18+
github.com/Masterminds/semver/v3 v3.3.1
19+
github.com/cyphar/filepath-securejoin v0.3.4
2020
github.com/distribution/distribution/v3 v3.0.0-beta.1
2121
github.com/docker/cli v27.2.1+incompatible
2222
github.com/docker/go-units v0.5.0
2323
github.com/elazarl/goproxy v0.0.0-20240909085733-6741dbfc16a1
2424
github.com/fluxcd/cli-utils v0.36.0-flux.9
2525
github.com/fluxcd/pkg/apis/event v0.10.1
2626
github.com/fluxcd/pkg/apis/meta v1.6.1
27-
github.com/fluxcd/pkg/auth v0.0.1
28-
github.com/fluxcd/pkg/git v0.21.0
29-
github.com/fluxcd/pkg/git/gogit v0.21.0
27+
github.com/fluxcd/pkg/auth v0.0.2-0.20241205135915-b83bd25dbf63
28+
github.com/fluxcd/pkg/git v0.21.1-0.20241205135915-b83bd25dbf63
29+
github.com/fluxcd/pkg/git/gogit v0.21.1-0.20241205135915-b83bd25dbf63
3030
github.com/fluxcd/pkg/gittestserver v0.13.1
3131
github.com/fluxcd/pkg/helmtestserver v0.20.0
3232
github.com/fluxcd/pkg/lockedfile v0.3.0
@@ -40,7 +40,7 @@ require (
4040
github.com/fluxcd/pkg/version v0.4.1
4141
github.com/fluxcd/source-controller/api v1.4.0
4242
github.com/foxcpp/go-mockdns v1.1.0
43-
github.com/go-git/go-billy/v5 v5.5.0
43+
github.com/go-git/go-billy/v5 v5.6.0
4444
github.com/go-git/go-git/v5 v5.12.0
4545
github.com/go-logr/logr v1.4.2
4646
github.com/google/go-containerregistry v0.20.2
@@ -49,7 +49,7 @@ require (
4949
github.com/minio/minio-go/v7 v7.0.77
5050
github.com/notaryproject/notation-core-go v1.1.0
5151
github.com/notaryproject/notation-go v1.2.1
52-
github.com/onsi/gomega v1.34.2
52+
github.com/onsi/gomega v1.36.0
5353
github.com/opencontainers/go-digest v1.0.0
5454
github.com/opencontainers/go-digest/blake3 v0.0.0-20231212064514-429d0316a3dd
5555
github.com/opencontainers/image-spec v1.1.0
@@ -61,9 +61,9 @@ require (
6161
github.com/sigstore/sigstore v1.8.9
6262
github.com/sirupsen/logrus v1.9.3
6363
github.com/spf13/pflag v1.0.5
64-
golang.org/x/crypto v0.27.0
64+
golang.org/x/crypto v0.30.0
6565
golang.org/x/oauth2 v0.23.0
66-
golang.org/x/sync v0.8.0
66+
golang.org/x/sync v0.10.0
6767
google.golang.org/api v0.198.0
6868
gotest.tools v2.2.0+incompatible
6969
helm.sh/helm/v3 v3.16.1
@@ -104,7 +104,7 @@ require (
104104
github.com/Masterminds/squirrel v1.5.4 // indirect
105105
github.com/Microsoft/go-winio v0.6.2 // indirect
106106
github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
107-
github.com/ProtonMail/go-crypto v1.0.0 // indirect
107+
github.com/ProtonMail/go-crypto v1.1.3 // indirect
108108
github.com/ThalesIgnite/crypto11 v1.2.5 // indirect
109109
github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.4 // indirect
110110
github.com/alibabacloud-go/cr-20160607 v1.0.1 // indirect
@@ -137,6 +137,7 @@ require (
137137
github.com/beorn7/perks v1.0.1 // indirect
138138
github.com/blang/semver v3.5.1+incompatible // indirect
139139
github.com/blang/semver/v4 v4.0.0 // indirect
140+
github.com/bradleyfalzon/ghinstallation/v2 v2.12.0 // indirect
140141
github.com/bshuster-repo/logrus-logstash-hook v1.0.0 // indirect
141142
github.com/buildkite/agent/v3 v3.76.2 // indirect
142143
github.com/buildkite/go-pipeline v0.10.0 // indirect
@@ -147,7 +148,7 @@ require (
147148
github.com/chai2010/gettext-go v1.0.2 // indirect
148149
github.com/chrismellard/docker-credential-acr-env v0.0.0-20230304212654-82a0ddb27589 // indirect
149150
github.com/clbanning/mxj/v2 v2.7.0 // indirect
150-
github.com/cloudflare/circl v1.4.0 // indirect
151+
github.com/cloudflare/circl v1.5.0 // indirect
151152
github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
152153
github.com/containerd/containerd v1.7.20 // indirect
153154
github.com/containerd/continuity v0.4.3 // indirect
@@ -210,7 +211,7 @@ require (
210211
github.com/goccy/go-json v0.10.3 // indirect
211212
github.com/gofrs/uuid v4.4.0+incompatible // indirect
212213
github.com/gogo/protobuf v1.3.2 // indirect
213-
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
214+
github.com/golang-jwt/jwt/v4 v4.5.1 // indirect
214215
github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
215216
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
216217
github.com/golang/protobuf v1.5.4 // indirect
@@ -221,6 +222,7 @@ require (
221222
github.com/google/go-cmp v0.6.0 // indirect
222223
github.com/google/go-containerregistry/pkg/authn/kubernetes v0.0.0-20230516205744-dbecb1de8cfa // indirect
223224
github.com/google/go-github/v55 v55.0.0 // indirect
225+
github.com/google/go-github/v66 v66.0.0 // indirect
224226
github.com/google/go-querystring v1.1.0 // indirect
225227
github.com/google/gofuzz v1.2.0 // indirect
226228
github.com/google/s2a-go v0.1.8 // indirect
@@ -300,7 +302,7 @@ require (
300302
github.com/prometheus/procfs v0.15.1 // indirect
301303
github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 // indirect
302304
github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 // indirect
303-
github.com/redis/go-redis/v9 v9.5.1 // indirect
305+
github.com/redis/go-redis/v9 v9.6.1 // indirect
304306
github.com/rivo/uniseg v0.4.4 // indirect
305307
github.com/rs/xid v1.6.0 // indirect
306308
github.com/rubenv/sql-migrate v1.7.0 // indirect
@@ -372,19 +374,19 @@ require (
372374
go.uber.org/multierr v1.11.0 // indirect
373375
go.uber.org/zap v1.27.0 // indirect
374376
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
375-
golang.org/x/mod v0.21.0 // indirect
376-
golang.org/x/net v0.29.0 // indirect
377-
golang.org/x/sys v0.25.0 // indirect
378-
golang.org/x/term v0.24.0 // indirect
379-
golang.org/x/text v0.18.0 // indirect
377+
golang.org/x/mod v0.22.0 // indirect
378+
golang.org/x/net v0.32.0 // indirect
379+
golang.org/x/sys v0.28.0 // indirect
380+
golang.org/x/term v0.27.0 // indirect
381+
golang.org/x/text v0.21.0 // indirect
380382
golang.org/x/time v0.6.0 // indirect
381-
golang.org/x/tools v0.25.0 // indirect
383+
golang.org/x/tools v0.28.0 // indirect
382384
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
383385
google.golang.org/genproto v0.0.0-20240903143218-8af14fe29dc1 // indirect
384386
google.golang.org/genproto/googleapis/api v0.0.0-20240827150818-7e3bb234dfed // indirect
385387
google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 // indirect
386388
google.golang.org/grpc v1.66.2 // indirect
387-
google.golang.org/protobuf v1.34.2 // indirect
389+
google.golang.org/protobuf v1.35.1 // indirect
388390
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
389391
gopkg.in/inf.v0 v0.9.1 // indirect
390392
gopkg.in/ini.v1 v1.67.0 // indirect

0 commit comments

Comments
 (0)