@@ -31,6 +31,7 @@ import (
3131 authutils "github.com/fluxcd/pkg/auth/utils"
3232 "github.com/fluxcd/pkg/git/github"
3333 "github.com/fluxcd/pkg/runtime/logger"
34+ "github.com/fluxcd/pkg/runtime/secrets"
3435 "github.com/go-git/go-git/v5/plumbing/transport"
3536 corev1 "k8s.io/api/core/v1"
3637 "k8s.io/apimachinery/pkg/runtime"
@@ -486,7 +487,11 @@ func (r *GitRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
486487 var proxyURL * url.URL
487488 if obj .Spec .ProxySecretRef != nil {
488489 var err error
489- proxyOpts , proxyURL , err = r .getProxyOpts (ctx , obj .Spec .ProxySecretRef .Name , obj .GetNamespace ())
490+ secretRef := types.NamespacedName {
491+ Name : obj .Spec .ProxySecretRef .Name ,
492+ Namespace : obj .GetNamespace (),
493+ }
494+ proxyURL , err = secrets .ProxyURLFromSecretRef (ctx , r .Client , secretRef )
490495 if err != nil {
491496 e := serror .NewGeneric (
492497 fmt .Errorf ("failed to configure proxy options: %w" , err ),
@@ -496,6 +501,7 @@ func (r *GitRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
496501 // Return error as the world as observed may change
497502 return sreconcile .ResultEmpty , e
498503 }
504+ proxyOpts = & transport.ProxyOptions {URL : proxyURL .String ()}
499505 }
500506
501507 u , err := url .Parse (obj .Spec .URL )
@@ -618,52 +624,16 @@ func (r *GitRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
618624 return sreconcile .ResultSuccess , nil
619625}
620626
621- // getProxyOpts fetches the secret containing the proxy settings, constructs a
622- // transport.ProxyOptions object using those settings and then returns it.
623- func (r * GitRepositoryReconciler ) getProxyOpts (ctx context.Context , proxySecretName ,
624- proxySecretNamespace string ) (* transport.ProxyOptions , * url.URL , error ) {
625- proxyData , err := r .getSecretData (ctx , proxySecretName , proxySecretNamespace )
626- if err != nil {
627- return nil , nil , fmt .Errorf ("failed to get proxy secret '%s/%s': %w" , proxySecretNamespace , proxySecretName , err )
628- }
629- b , ok := proxyData ["address" ]
630- if ! ok {
631- return nil , nil , fmt .Errorf ("invalid proxy secret '%s/%s': key 'address' is missing" , proxySecretNamespace , proxySecretName )
632- }
633-
634- address := string (b )
635- username := string (proxyData ["username" ])
636- password := string (proxyData ["password" ])
637-
638- proxyOpts := & transport.ProxyOptions {
639- URL : address ,
640- Username : username ,
641- Password : password ,
642- }
643-
644- proxyURL , err := url .Parse (string (address ))
645- if err != nil {
646- return nil , nil , fmt .Errorf ("invalid address in proxy secret '%s/%s': %w" , proxySecretNamespace , proxySecretName , err )
647- }
648- switch {
649- case username != "" && password == "" :
650- proxyURL .User = url .User (username )
651- case username != "" && password != "" :
652- proxyURL .User = url .UserPassword (username , password )
653- }
654-
655- return proxyOpts , proxyURL , nil
656- }
657-
658627// getAuthOpts fetches the secret containing the auth options (if specified),
659628// constructs a git.AuthOptions object using those options along with the provided
660629// URL and returns it.
661630func (r * GitRepositoryReconciler ) getAuthOpts (ctx context.Context , obj * sourcev1.GitRepository ,
662631 u url.URL , proxyURL * url.URL ) (* git.AuthOptions , error ) {
632+ var secret * corev1.Secret
663633 var authData map [string ][]byte
664634 if obj .Spec .SecretRef != nil {
665635 var err error
666- authData , err = r .getSecretData (ctx , obj .Spec .SecretRef .Name , obj .GetNamespace ())
636+ secret , err = r .getSecret (ctx , obj .Spec .SecretRef .Name , obj .GetNamespace ())
667637 if err != nil {
668638 e := serror .NewGeneric (
669639 fmt .Errorf ("failed to get secret '%s/%s': %w" , obj .GetNamespace (), obj .Spec .SecretRef .Name , err ),
@@ -672,6 +642,7 @@ func (r *GitRepositoryReconciler) getAuthOpts(ctx context.Context, obj *sourcev1
672642 conditions .MarkTrue (obj , sourcev1 .FetchFailedCondition , e .Reason , "%s" , e )
673643 return nil , e
674644 }
645+ authData = secret .Data
675646 }
676647
677648 // Configure authentication strategy to access the source
@@ -718,24 +689,38 @@ func (r *GitRepositoryReconciler) getAuthOpts(ctx context.Context, obj *sourcev1
718689 conditions .MarkTrue (obj , sourcev1 .FetchFailedCondition , e .Reason , "%s" , e )
719690 return nil , e
720691 }
721-
692+ targetURL := fmt .Sprintf ("%s://%s" , u .Scheme , u .Host )
693+ authMethods , err := secrets .AuthMethodsFromSecret (ctx , secret , secrets .WithTargetURL (targetURL ), secrets .WithTLSSystemCertPool ())
694+ if err != nil {
695+ return nil , err
696+ }
697+ if ! authMethods .HasGitHubAppData () {
698+ e := serror .NewGeneric (
699+ fmt .Errorf ("secretRef with github app data must be specified when provider is set to github" ),
700+ sourcev1 .InvalidProviderConfigurationReason ,
701+ )
702+ conditions .MarkTrue (obj , sourcev1 .FetchFailedCondition , e .Reason , "%s" , e )
703+ return nil , e
704+ }
722705 getCreds = func () (* authutils.GitCredentials , error ) {
723- var opts []github.OptFunc
706+ var appOpts []github.OptFunc
724707
725- if len (authData ) > 0 {
726- opts = append (opts , github .WithAppData (authData ))
727- }
708+ appOpts = append (appOpts , github .WithAppData (authMethods .GitHubAppData ))
728709
729710 if proxyURL != nil {
730- opts = append (opts , github .WithProxyURL (proxyURL ))
711+ appOpts = append (appOpts , github .WithProxyURL (proxyURL ))
731712 }
732713
733714 if r .TokenCache != nil {
734- opts = append (opts , github .WithCache (r .TokenCache , sourcev1 .GitRepositoryKind ,
715+ appOpts = append (appOpts , github .WithCache (r .TokenCache , sourcev1 .GitRepositoryKind ,
735716 obj .GetName (), obj .GetNamespace (), cache .OperationReconcile ))
736717 }
737718
738- username , password , err := github .GetCredentials (ctx , opts ... )
719+ if authMethods .HasTLS () {
720+ appOpts = append (appOpts , github .WithTLSConfig (authMethods .TLS ))
721+ }
722+
723+ username , password , err := github .GetCredentials (ctx , appOpts ... )
739724 if err != nil {
740725 return nil , err
741726 }
@@ -772,16 +757,16 @@ func (r *GitRepositoryReconciler) getAuthOpts(ctx context.Context, obj *sourcev1
772757 return opts , nil
773758}
774759
775- func (r * GitRepositoryReconciler ) getSecretData (ctx context.Context , name , namespace string ) (map [ string ][] byte , error ) {
760+ func (r * GitRepositoryReconciler ) getSecret (ctx context.Context , name , namespace string ) (* corev1. Secret , error ) {
776761 key := types.NamespacedName {
777762 Namespace : namespace ,
778763 Name : name ,
779764 }
780- var secret corev1.Secret
781- if err := r .Client .Get (ctx , key , & secret ); err != nil {
782- return nil , err
765+ secret := & corev1.Secret {}
766+ if err := r .Client .Get (ctx , key , secret ); err != nil {
767+ return nil , fmt . Errorf ( "failed to get secret '%s/%s': %w" , namespace , name , err )
783768 }
784- return secret . Data , nil
769+ return secret , nil
785770}
786771
787772// reconcileArtifact archives a new Artifact to the Storage, if the current
0 commit comments