Migrate HelmRepository to runtime/secrets #1849
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This was referenced Jul 13, 2025
cappyzawa
force-pushed
the
feat/helm-repository-runtime-secrets-migration
branch
from
4733f8f to
2d22893
Compare
cappyzawa
force-pushed
the
feat/helm-repository-runtime-secrets-migration
branch
from
2d22893 to
11522d2
Compare
cappyzawa
changed the title
cappyzawa
force-pushed
the
feat/helm-repository-runtime-secrets-migration
branch
from
d8c26cc to
fd2a017
Compare
…e/secrets migration Signed-off-by: cappyzawa <[email protected]>
cappyzawa
force-pushed
the
feat/helm-repository-runtime-secrets-migration
branch
2 times, most recently
from
866f087 to
3cb0187
Compare
matheuscscp
approved these changes
Jul 18, 2025
| hrOpts.Insecure = obj.Spec.Insecure | ||
| // Handle TLS certificate files for OCI | ||
| var tempCertDir string | ||
| if opts.TlsConfig != nil { |
There was a problem hiding this comment.
I filed helm/helm#31075 and helm/helm#31076 so we can stop doing this crazy dance and start leveraging our shiny new secrets library ;)
This commit upgrades pkg/runtime to v0.73.0 and adopts the unified AuthMethodsFromSecret API for HelmRepository authentication handling. The change replaces complex manual authentication detection with a single API call and improves error handling consistency. Breaking Changes: - TLS certificate validation is now strictly enforced. Invalid CA certificates will cause authentication failures even for public repositories, where they were previously ignored. - Empty TLS certificate secrets now trigger validation errors instead of being silently ignored. This affects certSecretRef with empty Data map - previously ignored, now causes proper error. Signed-off-by: cappyzawa <[email protected]>
cappyzawa
force-pushed
the
feat/helm-repository-runtime-secrets-migration
branch
from
3cb0187 to
9950f56
Compare
|
@matheuscscp Thanks a lot for your review and kind words! |
This was referenced Jul 30, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR migrates HelmRepository authentication to use runtime/secrets API as part of fluxcd/flux2#5433.
Introduces pkg/runtime v0.66.0 and refactors HelmRepository authentication accordingly.
Breaking Changes (security improvement)