Bootstrap with Github App credentials

[tenevdev]

I propose supporting Github App credentials as another method for access to private Github repositories of an organization.

I imagine the workaround for lack of this feature is to create a "machine" user in the Github organization but this requires an extra licence.

Same feature in ArgoCD - https://argo-cd.readthedocs.io/en/stable/user-guide/private-repositories/#github-app-credential

[tenevdev]

After learning more about how Flux uses deploy keys I realise this discussion is irrelevant.

[leifwalsh]

@tenevdev could you enlighten us? I would also expect any automation to use a GitHub App. Knowing more about GitHub than I do about FluxCD, it definitely seems like your original question is valid: we have the same concern about needing to create an extra user account to create a personal access token for.

[tenevdev]

The personal access token is used only during the bootstrap to create a deploy key. However, if you worry about your deploy keys being associated with personal access tokens, I guess you could create a GitHub app to manage them (I didn't) or use any other method of managing deploy keys. So instead of flux creating the deploy key for you during bootstrap, you can create the Kubernetes secret for a given deploy key explicitly - https://fluxcd.io/flux/cmd/flux_create_secret_git/

[leifwalsh]

Ah, thanks!

[joebowbeer]

See #4806