Skip to content

Commit

Permalink
[RFC-007] Implement GitHub app authentication for git repositories.
Browse files Browse the repository at this point in the history 
- API change to add new `github` provider field in `GitRepository` spec.
- Controller change to use the GitHub authentication information specified in `.spec.secretRef` to create the auth options to authenticate to git repositories when the `provider` field is set to `github`,
- Tests for new `github` provider field
- Updated docs to use GitHub Apps for authentication in source-controller.

Signed-off-by: Dipti Pai <[email protected]>
  • Loading branch information
@dipti-pai
dipti-pai committed Dec 5, 2024
1 parent 53868f7 commit 8e06af4
Show file tree
Hide file tree
Showing 8 changed files with 277 additions and 102 deletions.
8 changes: 6 additions & 2 deletions api/v1/gitrepository_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,10 @@ const (
// GitProviderAzure provides support for authentication to azure
// repositories using Managed Identity.
GitProviderAzure string = "azure"

// GitProviderGitHub provides support for authentication to git
// repositories using GitHub App authentication
GitProviderGitHub string = "github"
)

const (
Expand Down Expand Up @@ -88,9 +92,9 @@ type GitRepositorySpec struct {
// +optional
SecretRef *meta.LocalObjectReference `json:"secretRef,omitempty"`

// Provider used for authentication, can be 'azure', 'generic'.
// Provider used for authentication, can be 'azure', 'github', 'generic'.
// When not specified, defaults to 'generic'.
// +kubebuilder:validation:Enum=generic;azure
// +kubebuilder:validation:Enum=generic;azure;github
// +optional
Provider string `json:"provider,omitempty"`

Expand Down
3 changes: 2 additions & 1 deletion config/crd/bases/source.toolkit.fluxcd.io_gitrepositories.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -105,11 +105,12 @@ spec:
type: string
provider:
description: |-
Provider used for authentication, can be 'azure', 'generic'.
Provider used for authentication, can be 'azure', 'github', 'generic'.
When not specified, defaults to 'generic'.
enum:
- generic
- azure
- github
type: string
proxySecretRef:
description: |-
Expand Down
4 changes: 2 additions & 2 deletions docs/api/v1/source.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -390,7 +390,7 @@ string
</td>
<td>
<em>(Optional)</em>
<p>Provider used for authentication, can be &lsquo;azure&rsquo;, &lsquo;generic&rsquo;.
<p>Provider used for authentication, can be &lsquo;azure&rsquo;, &lsquo;github&rsquo;, &lsquo;generic&rsquo;.
When not specified, defaults to &lsquo;generic&rsquo;.</p>
</td>
</tr>
Expand Down Expand Up @@ -1730,7 +1730,7 @@ string
</td>
<td>
<em>(Optional)</em>
<p>Provider used for authentication, can be &lsquo;azure&rsquo;, &lsquo;generic&rsquo;.
<p>Provider used for authentication, can be &lsquo;azure&rsquo;, &lsquo;github&rsquo;, &lsquo;generic&rsquo;.
When not specified, defaults to &lsquo;generic&rsquo;.</p>
</td>
</tr>
Expand Down
49 changes: 49 additions & 0 deletions docs/spec/v1/gitrepositories.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -221,6 +221,7 @@ Supported options are:

- `generic`
- `azure`
- `github`

When provider is not specified, it defaults to `generic` indicating that
mechanisms using `spec.secretRef` are used for authentication.
Expand Down Expand Up @@ -296,6 +297,54 @@ must follow this format:
```
https://dev.azure.com/{your-organization}/{your-project}/_git/{your-repository}
```
#### GitHub

The `github` provider can be used to authenticate to Git repositories using
[GitHub Apps](https://docs.github.com/en/apps/overview).

##### Pre-requisites

- [Register](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app)
the GitHub App with the necessary permissions and [generate a private
key](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/managing-private-keys-for-github-apps)
for the app.

- [Install](https://docs.github.com/en/apps/using-github-apps/installing-your-own-github-app)
the app in the organization/account configuring access to the necessary
repositories.

##### Configure GitHub App secret

The GitHub App information is specified in `.spec.secretRef` in the format
specified below:

- Get the App ID from the app settings page at
`https://github.com/settings/apps/<app-name>`.
- Get the App Installation ID from the app installations page at
`https://github.com/settings/installations`. Click the installed app, the URL
will contain the installation ID
`https://github.com/settings/installations/<installation-id>`. For
organizations, the first part of the URL may be different, but it follows the
same pattern.
- The private key that was generated in the pre-requisites.
- (Optional) GitHub Enterprise Server users can set the base URL to
`http(s)://HOSTNAME/api/v3`.

```yaml
apiVersion: v1
kind: Secret
metadata:
name: github-sa
type: Opaque
stringData:
githubAppID: "<app-id>"
githubAppInstallationID: "<app-installation-id>"
githubAppPrivateKey: |
-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----
githubAppBaseURL: "<github-enterprise-api-url>" #optional, required only for GitHub Enterprise Server users
```

### Interval

Expand Down
48 changes: 25 additions & 23 deletions go.mod
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/fluxcd/source-controller

go 1.22.5
go 1.22.7

replace github.com/fluxcd/source-controller/api => ./api

Expand All @@ -12,21 +12,21 @@ require (
cloud.google.com/go/compute/metadata v0.5.1
cloud.google.com/go/storage v1.43.0
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.14.0
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.0
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.4.0
github.com/Masterminds/semver/v3 v3.3.0
github.com/cyphar/filepath-securejoin v0.3.2
github.com/Masterminds/semver/v3 v3.3.1
github.com/cyphar/filepath-securejoin v0.3.4
github.com/distribution/distribution/v3 v3.0.0-beta.1
github.com/docker/cli v27.2.1+incompatible
github.com/docker/go-units v0.5.0
github.com/elazarl/goproxy v0.0.0-20240909085733-6741dbfc16a1
github.com/fluxcd/cli-utils v0.36.0-flux.9
github.com/fluxcd/pkg/apis/event v0.10.1
github.com/fluxcd/pkg/apis/meta v1.6.1
github.com/fluxcd/pkg/auth v0.0.1
github.com/fluxcd/pkg/git v0.21.0
github.com/fluxcd/pkg/git/gogit v0.21.0
github.com/fluxcd/pkg/auth v0.0.2-0.20241205135915-b83bd25dbf63
github.com/fluxcd/pkg/git v0.21.1-0.20241205135915-b83bd25dbf63
github.com/fluxcd/pkg/git/gogit v0.21.1-0.20241205135915-b83bd25dbf63
github.com/fluxcd/pkg/gittestserver v0.13.1
github.com/fluxcd/pkg/helmtestserver v0.20.0
github.com/fluxcd/pkg/lockedfile v0.3.0
Expand All @@ -40,7 +40,7 @@ require (
github.com/fluxcd/pkg/version v0.4.1
github.com/fluxcd/source-controller/api v1.4.0
github.com/foxcpp/go-mockdns v1.1.0
github.com/go-git/go-billy/v5 v5.5.0
github.com/go-git/go-billy/v5 v5.6.0
github.com/go-git/go-git/v5 v5.12.0
github.com/go-logr/logr v1.4.2
github.com/google/go-containerregistry v0.20.2
Expand All @@ -49,7 +49,7 @@ require (
github.com/minio/minio-go/v7 v7.0.77
github.com/notaryproject/notation-core-go v1.1.0
github.com/notaryproject/notation-go v1.2.1
github.com/onsi/gomega v1.34.2
github.com/onsi/gomega v1.36.0
github.com/opencontainers/go-digest v1.0.0
github.com/opencontainers/go-digest/blake3 v0.0.0-20231212064514-429d0316a3dd
github.com/opencontainers/image-spec v1.1.0
Expand All @@ -61,9 +61,9 @@ require (
github.com/sigstore/sigstore v1.8.9
github.com/sirupsen/logrus v1.9.3
github.com/spf13/pflag v1.0.5
golang.org/x/crypto v0.27.0
golang.org/x/crypto v0.30.0
golang.org/x/oauth2 v0.23.0
golang.org/x/sync v0.8.0
golang.org/x/sync v0.10.0
google.golang.org/api v0.198.0
gotest.tools v2.2.0+incompatible
helm.sh/helm/v3 v3.16.1
Expand Down Expand Up @@ -104,7 +104,7 @@ require (
github.com/Masterminds/squirrel v1.5.4 // indirect
github.com/Microsoft/go-winio v0.6.2 // indirect
github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
github.com/ProtonMail/go-crypto v1.0.0 // indirect
github.com/ProtonMail/go-crypto v1.1.3 // indirect
github.com/ThalesIgnite/crypto11 v1.2.5 // indirect
github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.4 // indirect
github.com/alibabacloud-go/cr-20160607 v1.0.1 // indirect
Expand Down Expand Up @@ -137,6 +137,7 @@ require (
github.com/beorn7/perks v1.0.1 // indirect
github.com/blang/semver v3.5.1+incompatible // indirect
github.com/blang/semver/v4 v4.0.0 // indirect
github.com/bradleyfalzon/ghinstallation/v2 v2.12.0 // indirect
github.com/bshuster-repo/logrus-logstash-hook v1.0.0 // indirect
github.com/buildkite/agent/v3 v3.76.2 // indirect
github.com/buildkite/go-pipeline v0.10.0 // indirect
Expand All @@ -147,7 +148,7 @@ require (
github.com/chai2010/gettext-go v1.0.2 // indirect
github.com/chrismellard/docker-credential-acr-env v0.0.0-20230304212654-82a0ddb27589 // indirect
github.com/clbanning/mxj/v2 v2.7.0 // indirect
github.com/cloudflare/circl v1.4.0 // indirect
github.com/cloudflare/circl v1.5.0 // indirect
github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
github.com/containerd/containerd v1.7.20 // indirect
github.com/containerd/continuity v0.4.3 // indirect
Expand Down Expand Up @@ -210,7 +211,7 @@ require (
github.com/goccy/go-json v0.10.3 // indirect
github.com/gofrs/uuid v4.4.0+incompatible // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
github.com/golang-jwt/jwt/v4 v4.5.1 // indirect
github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/protobuf v1.5.4 // indirect
Expand All @@ -221,6 +222,7 @@ require (
github.com/google/go-cmp v0.6.0 // indirect
github.com/google/go-containerregistry/pkg/authn/kubernetes v0.0.0-20230516205744-dbecb1de8cfa // indirect
github.com/google/go-github/v55 v55.0.0 // indirect
github.com/google/go-github/v66 v66.0.0 // indirect
github.com/google/go-querystring v1.1.0 // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/google/s2a-go v0.1.8 // indirect
Expand Down Expand Up @@ -300,7 +302,7 @@ require (
github.com/prometheus/procfs v0.15.1 // indirect
github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 // indirect
github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 // indirect
github.com/redis/go-redis/v9 v9.5.1 // indirect
github.com/redis/go-redis/v9 v9.6.1 // indirect
github.com/rivo/uniseg v0.4.4 // indirect
github.com/rs/xid v1.6.0 // indirect
github.com/rubenv/sql-migrate v1.7.0 // indirect
Expand Down Expand Up @@ -372,19 +374,19 @@ require (
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
golang.org/x/mod v0.21.0 // indirect
golang.org/x/net v0.29.0 // indirect
golang.org/x/sys v0.25.0 // indirect
golang.org/x/term v0.24.0 // indirect
golang.org/x/text v0.18.0 // indirect
golang.org/x/mod v0.22.0 // indirect
golang.org/x/net v0.32.0 // indirect
golang.org/x/sys v0.28.0 // indirect
golang.org/x/term v0.27.0 // indirect
golang.org/x/text v0.21.0 // indirect
golang.org/x/time v0.6.0 // indirect
golang.org/x/tools v0.25.0 // indirect
golang.org/x/tools v0.28.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/genproto v0.0.0-20240903143218-8af14fe29dc1 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20240827150818-7e3bb234dfed // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 // indirect
google.golang.org/grpc v1.66.2 // indirect
google.golang.org/protobuf v1.34.2 // indirect
google.golang.org/protobuf v1.35.1 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/ini.v1 v1.67.0 // indirect
Expand Down
Loading

0 comments on commit 8e06af4

Please sign in to comment.