This repository has been archived by the owner on Nov 1, 2022. It is now read-only.
Support Git over HTTPS with creds from env vars #2470
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
hiddeco
force-pushed
the
feature/git-https
branch
from
23251a9
to
7c68c1b
Compare
stefanprodan
approved these changes
Sep 24, 2019
hiddeco
force-pushed
the
feature/git-https
branch
from
7c68c1b
to
2b44c21
Compare
|
The doc updates are welcome, but some of the changes aren't much to do with supporting HTTPS -- can you split them into a separate commit, at least? |
squaremo
reviewed
Sep 25, 2019
hiddeco
force-pushed
the
feature/git-https
branch
2 times, most recently
from
9bd017a
to
95c0ad7
Compare
squaremo
approved these changes
Sep 26, 2019
hiddeco
force-pushed
the
feature/git-https
branch
2 times, most recently
from
e8c73bc
to
4207293
Compare
This commit makes supplying HTTP(S) basic auth credentials in the `--git-url` secure. Places where the full remote origin were logged have been modified to only log the `Remote.SafeURL()` so that the authentication key is never exposed in the logs. Securely supplying the credentials without exposing them in the Flux workload is possible by adding two environment variables (e.g. `GIT_AUTHUSER` and `GIT_AUTHKEY`) to a Kubernetes secret, and using Kubernetes mechanics to define them in the Flux pod by using an `envFrom`. The variables can then be used in `--git-url` argument as documented in the Kubernetes documentation[1]: `--git-url=https://$(GIT_AUTHUSER):$(GIT_AUTHKEY)@github.com/an/example.git` If the `--git-url` uses a HTTP(S) scheme; the generation of an SSH private key and the setup of the SSH keyring is now disabled. Co-Authored-By: Vytautas Maciulskis <vyckou@gmail.com> [1]: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/#using-environment-variables-inside-of-your-config
To make secure HTTPS configurations using Helm possible, by using the defined environment variables from the `env.secretName` in the `git.url`.
By adding links to various documentation pages from git vendors about creating a personal access token.
hiddeco
force-pushed
the
feature/git-https
branch
from
4207293
to
e48def6
Compare
squaremo
approved these changes
Sep 26, 2019
Closed
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a rework of #2438, and fixes #2280.
This PR makes supplying HTTP(S) basic auth credentials in the
--git-urlsecure. Places where the full remote origin were loggedhave been modified to only log the
Remote.SafeURL()so that theauthentication key is never exposed in the logs.
Securely supplying the credentials without exposing them in the
Flux workload is possible by adding two environment variables (e.g.
GIT_AUTHUSERandGIT_AUTHKEY) to a Kubernetes secret, and usingKubernetes mechanics to define them in the Flux pod by using an
envFrom. The variables can then be used in--git-urlargument asdocumented in the Kubernetes documentation1:
--git-url=https://$(GIT_AUTHUSER):$(GIT_AUTHKEY)@github.com/an/example.gitIf the
--git-urluses a HTTP(S) scheme; the generation of an SSHprivate key and the setup of the SSH keyring is now disabled.
This includes changes to the documentation, (generated) example deployments and the Helm chart to offer full support.