Adds mTLS support for GitRepositories #1766
Conversation
|
|
||
| // Ensures the secret contains the valid keys for the certificate & private key. | ||
| func (r *GitRepositoryReconciler) isCertificateDataValid(sslCertificateData map[string][]byte) bool { | ||
| certBytes, keyBytes := sslCertificateData["certFile"], sslCertificateData["keyFile"] |
There was a problem hiding this comment.
The keys should be tls.crt and tls.key, same as for OCIRepository and other APIs we have in Flux.
There was a problem hiding this comment.
- updated
isCertificateDataValidfunction to usetls.key&tls.crtinstead. - Changed to use
KubeTLSClientConfigFromSecretasOCIRepositorydoes.
Signed-off-by: Henrik Wikman <[email protected]>
| transportHttp = h.DefaultTransport | ||
| } | ||
|
|
||
| gitclient.InstallProtocol("https", transportHttp) |
There was a problem hiding this comment.
We can't alter the global client as this would impact all GitRepositories. If you have a GitHub repo and some mTLS Git server, then GitHub will fail. Not to mention this breaks multi-tenancy allowing any tenant to use the client certs of any other tenant.
There was a problem hiding this comment.
We need to add support for mTLS to fluxcd/pkg/git in the same way we do for CA: https://github.com/fluxcd/pkg/blob/155709e21f1e4cbe9726c7be831fcf92aceda3d1/git/options.go#L51
Then source-controller and image-automation-controller would set the client certs as options when they create the client for each reconciliation.
But before all of this, go-git needs to support client certs here: https://github.com/go-git/go-git/blob/4e67bbed91c0e31ce97b9ad5e2b9b51f1cf139de/options.go#L77
|
Closing, please see the implementation requirements for Git mTLS documented here: #1761 (comment) |
Hi,
Here's an updated version of PR #1302, without the proxy parts.
This PR adds mTLS support for GitRepositories, which is required if you have your git infrastructure
behind a firewall.
With this feature you don't need any additional setup like nginx reverse proxy or mtls-transmitter,
to access git repos behind a firewall requiring mTLS.
Certificates are added to the same secret used for the credentials in spec.secretRef, CA is optional:
Credit to @VasylR for the PR #1302
This PR closes #1761