Skip to content

Commit 6c5ffee

Browse files
matheuscscpmatheuscscp
authored
Merge pull request #907 from fluxcd/rfc-0010-feature-gate
[RFC-0010] Introduce feature gate
2 parents 498ec11 + 07058a1 commit 6c5ffee

File tree

8 files changed

+149
-69
lines changed

8 files changed

+149
-69
lines changed

‎api/go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ module github.com/fluxcd/image-automation-controller/api
33
go 1.24.0
44

55
require (
6-
github.com/fluxcd/pkg/apis/meta v1.11.0
6+
github.com/fluxcd/pkg/apis/meta v1.12.0
77
github.com/fluxcd/source-controller/api v1.5.0
88
k8s.io/apimachinery v0.33.0
99
sigs.k8s.io/controller-runtime v0.20.4

‎api/go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
55
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
66
github.com/fluxcd/pkg/apis/acl v0.7.0 h1:dMhZJH+g6ZRPjs4zVOAN9vHBd1DcavFgcIFkg5ooOE0=
77
github.com/fluxcd/pkg/apis/acl v0.7.0/go.mod h1:uv7pXXR/gydiX4MUwlQa7vS8JONEDztynnjTvY3JxKQ=
8-
github.com/fluxcd/pkg/apis/meta v1.11.0 h1:h8q95k6ZEK1HCfsLkt8Np3i6ktb6ZzcWJ6hg++oc9w0=
9-
github.com/fluxcd/pkg/apis/meta v1.11.0/go.mod h1:+son1Va60x2eiDcTwd7lcctbI6C+K3gM7R+ULmEq1SI=
8+
github.com/fluxcd/pkg/apis/meta v1.12.0 h1:XW15TKZieC2b7MN8VS85stqZJOx+/b8jATQ/xTUhVYg=
9+
github.com/fluxcd/pkg/apis/meta v1.12.0/go.mod h1:+son1Va60x2eiDcTwd7lcctbI6C+K3gM7R+ULmEq1SI=
1010
github.com/fluxcd/source-controller/api v1.5.0 h1:caSR+u/r2Vh0jq/0pNR0r1zLxyvgatWuGSV2mxgTB/I=
1111
github.com/fluxcd/source-controller/api v1.5.0/go.mod h1:OZPuHMlLH2E2mnj6Q5DLkWfUOmJ20zA1LIvUVfNsYl8=
1212
github.com/fxamacker/cbor/v2 v2.8.0 h1:fFtUGXUzXPHTIUdne5+zzMPTfffl3RD5qYnkY40vtxU=

‎go.mod

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,11 @@ require (
1919
github.com/fluxcd/image-reflector-controller/api v0.34.0
2020
github.com/fluxcd/pkg/apis/acl v0.7.0
2121
github.com/fluxcd/pkg/apis/event v0.17.0
22-
github.com/fluxcd/pkg/apis/meta v1.11.0
23-
github.com/fluxcd/pkg/auth v0.12.0
22+
github.com/fluxcd/pkg/apis/meta v1.12.0
23+
github.com/fluxcd/pkg/auth v0.14.0
2424
github.com/fluxcd/pkg/cache v0.9.0
25-
github.com/fluxcd/pkg/git v0.29.0
26-
github.com/fluxcd/pkg/git/gogit v0.31.0
25+
github.com/fluxcd/pkg/git v0.31.0
26+
github.com/fluxcd/pkg/git/gogit v0.33.0
2727
github.com/fluxcd/pkg/gittestserver v0.17.0
2828
github.com/fluxcd/pkg/runtime v0.59.0
2929
github.com/fluxcd/pkg/ssh v0.18.0
@@ -45,6 +45,7 @@ require (
4545
)
4646

4747
require (
48+
cloud.google.com/go/compute/metadata v0.6.0 // indirect
4849
dario.cat/mergo v1.0.1 // indirect
4950
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 // indirect
5051
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.9.0 // indirect
@@ -55,6 +56,20 @@ require (
5556
github.com/Masterminds/goutils v1.1.1 // indirect
5657
github.com/Masterminds/semver/v3 v3.3.0 // indirect
5758
github.com/Microsoft/go-winio v0.6.2 // indirect
59+
github.com/aws/aws-sdk-go-v2 v1.36.3 // indirect
60+
github.com/aws/aws-sdk-go-v2/config v1.29.14 // indirect
61+
github.com/aws/aws-sdk-go-v2/credentials v1.17.67 // indirect
62+
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 // indirect
63+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 // indirect
64+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 // indirect
65+
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
66+
github.com/aws/aws-sdk-go-v2/service/ecr v1.43.3 // indirect
67+
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 // indirect
68+
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 // indirect
69+
github.com/aws/aws-sdk-go-v2/service/sso v1.25.3 // indirect
70+
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1 // indirect
71+
github.com/aws/aws-sdk-go-v2/service/sts v1.33.19 // indirect
72+
github.com/aws/smithy-go v1.22.2 // indirect
5873
github.com/beorn7/perks v1.0.1 // indirect
5974
github.com/blang/semver/v4 v4.0.0 // indirect
6075
github.com/bradleyfalzon/ghinstallation/v2 v2.15.0 // indirect

‎go.sum

Lines changed: 38 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
2+
cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg=
13
dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
24
dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
35
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
@@ -33,6 +35,34 @@ github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFI
3335
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
3436
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
3537
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
38+
github.com/aws/aws-sdk-go-v2 v1.36.3 h1:mJoei2CxPutQVxaATCzDUjcZEjVRdpsiiXi2o38yqWM=
39+
github.com/aws/aws-sdk-go-v2 v1.36.3/go.mod h1:LLXuLpgzEbD766Z5ECcRmi8AzSwfZItDtmABVkRLGzg=
40+
github.com/aws/aws-sdk-go-v2/config v1.29.14 h1:f+eEi/2cKCg9pqKBoAIwRGzVb70MRKqWX4dg1BDcSJM=
41+
github.com/aws/aws-sdk-go-v2/config v1.29.14/go.mod h1:wVPHWcIFv3WO89w0rE10gzf17ZYy+UVS1Geq8Iei34g=
42+
github.com/aws/aws-sdk-go-v2/credentials v1.17.67 h1:9KxtdcIA/5xPNQyZRgUSpYOE6j9Bc4+D7nZua0KGYOM=
43+
github.com/aws/aws-sdk-go-v2/credentials v1.17.67/go.mod h1:p3C44m+cfnbv763s52gCqrjaqyPikj9Sg47kUVaNZQQ=
44+
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 h1:x793wxmUWVDhshP8WW2mlnXuFrO4cOd3HLBroh1paFw=
45+
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30/go.mod h1:Jpne2tDnYiFascUEs2AWHJL9Yp7A5ZVy3TNyxaAjD6M=
46+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 h1:ZK5jHhnrioRkUNOc+hOgQKlUL5JeC3S6JgLxtQ+Rm0Q=
47+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34/go.mod h1:p4VfIceZokChbA9FzMbRGz5OV+lekcVtHlPKEO0gSZY=
48+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 h1:SZwFm17ZUNNg5Np0ioo/gq8Mn6u9w19Mri8DnJ15Jf0=
49+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34/go.mod h1:dFZsC0BLo346mvKQLWmoJxT+Sjp+qcVR1tRVHQGOH9Q=
50+
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
51+
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
52+
github.com/aws/aws-sdk-go-v2/service/ecr v1.43.3 h1:YyH8Hk73bYzdbvf6S8NF5z/fb/1stpiMnFSfL6jSfRA=
53+
github.com/aws/aws-sdk-go-v2/service/ecr v1.43.3/go.mod h1:iQ1skgw1XRK+6Lgkb0I9ODatAP72WoTILh0zXQ5DtbU=
54+
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 h1:eAh2A4b5IzM/lum78bZ590jy36+d/aFLgKF/4Vd1xPE=
55+
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3/go.mod h1:0yKJC/kb8sAnmlYa6Zs3QVYqaC8ug2AbnNChv5Ox3uA=
56+
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 h1:dM9/92u2F1JbDaGooxTq18wmmFzbJRfXfVfy96/1CXM=
57+
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15/go.mod h1:SwFBy2vjtA0vZbjjaFtfN045boopadnoVPhu4Fv66vY=
58+
github.com/aws/aws-sdk-go-v2/service/sso v1.25.3 h1:1Gw+9ajCV1jogloEv1RRnvfRFia2cL6c9cuKV2Ps+G8=
59+
github.com/aws/aws-sdk-go-v2/service/sso v1.25.3/go.mod h1:qs4a9T5EMLl/Cajiw2TcbNt2UNo/Hqlyp+GiuG4CFDI=
60+
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1 h1:hXmVKytPfTy5axZ+fYbR5d0cFmC3JvwLm5kM83luako=
61+
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1/go.mod h1:MlYRNmYu/fGPoxBQVvBYr9nyr948aY/WLUvwBMBJubs=
62+
github.com/aws/aws-sdk-go-v2/service/sts v1.33.19 h1:1XuUZ8mYJw9B6lzAkXhqHlJd/XvaX32evhproijJEZY=
63+
github.com/aws/aws-sdk-go-v2/service/sts v1.33.19/go.mod h1:cQnB8CUnxbMU82JvlqjKR2HBOm3fe9pWorWBza6MBJ4=
64+
github.com/aws/smithy-go v1.22.2 h1:6D9hW43xKFrRx/tXXfAlIZc4JI+yQe6snnWcQyxSyLQ=
65+
github.com/aws/smithy-go v1.22.2/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
3666
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
3767
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
3868
github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
@@ -86,16 +116,16 @@ github.com/fluxcd/pkg/apis/acl v0.7.0 h1:dMhZJH+g6ZRPjs4zVOAN9vHBd1DcavFgcIFkg5o
86116
github.com/fluxcd/pkg/apis/acl v0.7.0/go.mod h1:uv7pXXR/gydiX4MUwlQa7vS8JONEDztynnjTvY3JxKQ=
87117
github.com/fluxcd/pkg/apis/event v0.17.0 h1:foEINE++pCJlWVhWjYDXfkVmGKu8mQ4BDBlbYi5NU7M=
88118
github.com/fluxcd/pkg/apis/event v0.17.0/go.mod h1:0fLhLFiHlRTDKPDXdRnv+tS7mCMIQ0fJxnEfmvGM/5A=
89-
github.com/fluxcd/pkg/apis/meta v1.11.0 h1:h8q95k6ZEK1HCfsLkt8Np3i6ktb6ZzcWJ6hg++oc9w0=
90-
github.com/fluxcd/pkg/apis/meta v1.11.0/go.mod h1:+son1Va60x2eiDcTwd7lcctbI6C+K3gM7R+ULmEq1SI=
91-
github.com/fluxcd/pkg/auth v0.12.0 h1:35o0ziYMLZVgJwNvJBGsv/wd903B2fMagcrnm1ptUjc=
92-
github.com/fluxcd/pkg/auth v0.12.0/go.mod h1:gQD2VT5OhIR1E8ZTEsTaho3bDQZidr9P10smH/awcew=
119+
github.com/fluxcd/pkg/apis/meta v1.12.0 h1:XW15TKZieC2b7MN8VS85stqZJOx+/b8jATQ/xTUhVYg=
120+
github.com/fluxcd/pkg/apis/meta v1.12.0/go.mod h1:+son1Va60x2eiDcTwd7lcctbI6C+K3gM7R+ULmEq1SI=
121+
github.com/fluxcd/pkg/auth v0.14.0 h1:AA9nmbFzTN5jcGROJK51LvQoDetMrXJLAo4Sd6WHpFI=
122+
github.com/fluxcd/pkg/auth v0.14.0/go.mod h1:o91WIZZshLooBALXY/MVn0mmdUw3eATrqGXrG1M7nTE=
93123
github.com/fluxcd/pkg/cache v0.9.0 h1:EGKfOLMG3fOwWnH/4Axl5xd425mxoQbZzlZoLfd8PDk=
94124
github.com/fluxcd/pkg/cache v0.9.0/go.mod h1:jMwabjWfsC5lW8hE7NM3wtGNwSJ38Javx6EKbEi7INU=
95-
github.com/fluxcd/pkg/git v0.29.0 h1:MHQ4F53e6Xt8a/POkd/fiChgysnd/XqiuK7vOWXAXLk=
96-
github.com/fluxcd/pkg/git v0.29.0/go.mod h1:Ygn+LfrK6Ok+85uiq6s3NWG5LcHS4KY7mzES2JDJsGY=
97-
github.com/fluxcd/pkg/git/gogit v0.31.0 h1:A56cmtgJBkWAj+gXSOdhPMQVTx0VF91S0PUaqpMXN4g=
98-
github.com/fluxcd/pkg/git/gogit v0.31.0/go.mod h1:ya8z22xTvAAdW12HycxKYv4S+G+lqu5Kx/LyO/jWz8Y=
125+
github.com/fluxcd/pkg/git v0.31.0 h1:hVUJcRujNa+GA5zrjrMpuVcgHbCBjfq0CZIZJqJl22I=
126+
github.com/fluxcd/pkg/git v0.31.0/go.mod h1:rUgLXVQGBkBggHOLVMhHMHaweQ8Oc6HwZiN2Zm08Zxs=
127+
github.com/fluxcd/pkg/git/gogit v0.33.0 h1:JYKa3XqA91AX7/sKEgARO9VzkwouXWjUgpwudEZEWq0=
128+
github.com/fluxcd/pkg/git/gogit v0.33.0/go.mod h1:EvsVYcB3KjfhpdoyU1sO9HuMH5Xt0cVhW49kFlZcFLY=
99129
github.com/fluxcd/pkg/gittestserver v0.17.0 h1:JlBvWZQTDOI+np5Z+084m3DkeAH1hMusEybyRUDF63k=
100130
github.com/fluxcd/pkg/gittestserver v0.17.0/go.mod h1:E/40EmLoXcMqd6gLuLDC9F6KJxqHVGbBBeMNKk5XdxU=
101131
github.com/fluxcd/pkg/runtime v0.59.0 h1:3OrFkMJB39NcQ2vhhoxqls59sQVSn8U+thhyLbsQoA4=

‎internal/features/features.go

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,10 @@ limitations under the License.
1919
// states.
2020
package features
2121

22-
import feathelper "github.com/fluxcd/pkg/runtime/features"
22+
import (
23+
"github.com/fluxcd/pkg/auth"
24+
feathelper "github.com/fluxcd/pkg/runtime/features"
25+
)
2326

2427
const (
2528
// GitForcePushBranch enables the use of "force push" when push branches
@@ -57,6 +60,10 @@ var features = map[string]bool{
5760
CacheSecretsAndConfigMaps: false,
5861
}
5962

63+
func init() {
64+
auth.SetFeatureGates(features)
65+
}
66+
6067
// FeatureGates contains a list of all supported feature gates and
6168
// their default values.
6269
func FeatureGates() map[string]bool {

‎internal/source/git.go

Lines changed: 54 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ import (
3232
"sigs.k8s.io/controller-runtime/pkg/client"
3333

3434
"github.com/fluxcd/pkg/auth"
35+
authutils "github.com/fluxcd/pkg/auth/utils"
3536
"github.com/fluxcd/pkg/cache"
3637
"github.com/fluxcd/pkg/git"
3738
"github.com/fluxcd/pkg/git/github"
@@ -183,49 +184,74 @@ func getAuthOpts(ctx context.Context, c client.Client, repo *sourcev1.GitReposit
183184
return nil, fmt.Errorf("failed to configure authentication options: %w", err)
184185
}
185186

186-
var authOpts []auth.Option
187-
188-
if srcOpts.tokenCache != nil {
189-
involvedObject := cache.InvolvedObject{
190-
Kind: imagev1.ImageUpdateAutomationKind,
191-
Name: srcOpts.objName,
192-
Namespace: srcOpts.objNamespace,
193-
Operation: cache.OperationReconcile,
194-
}
195-
authOpts = append(authOpts, auth.WithCache(*srcOpts.tokenCache, involvedObject))
196-
}
187+
var getCreds func() (*authutils.GitCredentials, error)
188+
switch provider := repo.GetProvider(); provider {
189+
case sourcev1.GitProviderAzure: // If AWS or GCP are added in the future they can be added here separated by a comma.
190+
getCreds = func() (*authutils.GitCredentials, error) {
191+
var opts []auth.Option
192+
193+
if srcOpts.tokenCache != nil {
194+
involvedObject := cache.InvolvedObject{
195+
Kind: imagev1.ImageUpdateAutomationKind,
196+
Name: srcOpts.objName,
197+
Namespace: srcOpts.objNamespace,
198+
Operation: cache.OperationReconcile,
199+
}
200+
opts = append(opts, auth.WithCache(*srcOpts.tokenCache, involvedObject))
201+
}
197202

198-
if proxyURL != nil {
199-
authOpts = append(authOpts, auth.WithProxyURL(*proxyURL))
200-
}
203+
if proxyURL != nil {
204+
opts = append(opts, auth.WithProxyURL(*proxyURL))
205+
}
201206

202-
switch repo.GetProvider() {
203-
case sourcev1.GitProviderAzure:
204-
opts.ProviderOpts = &git.ProviderOptions{
205-
Name: sourcev1.GitProviderAzure,
206-
AuthOpts: authOpts,
207+
return authutils.GetGitCredentials(ctx, provider, opts...)
207208
}
208209
case sourcev1.GitProviderGitHub:
209210
// if provider is github, but secret ref is not specified
210211
if repo.Spec.SecretRef == nil {
211212
return nil, fmt.Errorf("secretRef with github app data must be specified when provider is set to github: %w", ErrInvalidSourceConfiguration)
212213
}
213-
opts.ProviderOpts = &git.ProviderOptions{
214-
Name: sourcev1.GitProviderGitHub,
215-
GitHubOpts: []github.OptFunc{
216-
github.WithAppData(data),
217-
github.WithProxyURL(proxyURL),
218-
github.WithCache(srcOpts.tokenCache, imagev1.ImageUpdateAutomationKind,
219-
srcOpts.objName, srcOpts.objNamespace, cache.OperationReconcile),
220-
},
214+
215+
getCreds = func() (*authutils.GitCredentials, error) {
216+
var opts []github.OptFunc
217+
218+
if len(data) > 0 {
219+
opts = append(opts, github.WithAppData(data))
220+
}
221+
222+
if proxyURL != nil {
223+
opts = append(opts, github.WithProxyURL(proxyURL))
224+
}
225+
226+
if srcOpts.tokenCache != nil {
227+
opts = append(opts, github.WithCache(srcOpts.tokenCache, imagev1.ImageUpdateAutomationKind,
228+
srcOpts.objName, srcOpts.objNamespace, cache.OperationReconcile))
229+
}
230+
231+
username, password, err := github.GetCredentials(ctx, opts...)
232+
if err != nil {
233+
return nil, err
234+
}
235+
return &authutils.GitCredentials{
236+
Username: username,
237+
Password: password,
238+
}, nil
221239
}
222240
default:
223241
// analyze secret, if it has github app data, perhaps provider should have been github.
224242
if appID := data[github.AppIDKey]; len(appID) != 0 {
225243
return nil, fmt.Errorf("secretRef '%s/%s' has github app data but provider is not set to github: %w", repo.GetNamespace(), repo.Spec.SecretRef.Name, ErrInvalidSourceConfiguration)
226244
}
227245
}
228-
246+
if getCreds != nil {
247+
creds, err := getCreds()
248+
if err != nil {
249+
return nil, fmt.Errorf("failed to configure authentication options: %w", err)
250+
}
251+
opts.BearerToken = creds.BearerToken
252+
opts.Username = creds.Username
253+
opts.Password = creds.Password
254+
}
229255
return opts, nil
230256
}
231257

‎internal/source/git_test.go

Lines changed: 18 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ package source
1818

1919
import (
2020
"context"
21-
"errors"
2221
"fmt"
2322
"net/url"
2423
"testing"
@@ -143,29 +142,27 @@ func Test_getAuthOpts(t *testing.T) {
143142

144143
func Test_getAuthOpts_providerAuth(t *testing.T) {
145144
tests := []struct {
146-
name string
147-
url string
148-
secret *corev1.Secret
149-
beforeFunc func(obj *sourcev1.GitRepository)
150-
wantProviderOptsName string
151-
wantErr error
145+
name string
146+
url string
147+
secret *corev1.Secret
148+
beforeFunc func(obj *sourcev1.GitRepository)
149+
wantErr string
152150
}{
153151
{
154152
name: "azure provider",
155153
url: "https://dev.azure.com/foo/bar/_git/baz",
156154
beforeFunc: func(obj *sourcev1.GitRepository) {
157155
obj.Spec.Provider = sourcev1.GitProviderAzure
158156
},
159-
wantProviderOptsName: sourcev1.GitProviderAzure,
157+
wantErr: "ManagedIdentityCredential",
160158
},
161159
{
162160
name: "github provider with no secret ref",
163161
url: "https://github.com/org/repo.git",
164162
beforeFunc: func(obj *sourcev1.GitRepository) {
165163
obj.Spec.Provider = sourcev1.GitProviderGitHub
166164
},
167-
wantProviderOptsName: sourcev1.GitProviderGitHub,
168-
wantErr: errors.New("secretRef with github app data must be specified when provider is set to github: invalid source configuration"),
165+
wantErr: "secretRef with github app data must be specified when provider is set to github: invalid source configuration",
169166
},
170167
{
171168
name: "github provider with secret ref that does not exist",
@@ -176,7 +173,7 @@ func Test_getAuthOpts_providerAuth(t *testing.T) {
176173
Name: "githubAppSecret",
177174
}
178175
},
179-
wantErr: errors.New("failed to get auth secret '/githubAppSecret': secrets \"githubAppSecret\" not found"),
176+
wantErr: "failed to get auth secret '/githubAppSecret': secrets \"githubAppSecret\" not found",
180177
},
181178
{
182179
name: "github provider with github app data in secret",
@@ -197,7 +194,7 @@ func Test_getAuthOpts_providerAuth(t *testing.T) {
197194
Name: "githubAppSecret",
198195
}
199196
},
200-
wantProviderOptsName: sourcev1.GitProviderGitHub,
197+
wantErr: "Key must be a PEM encoded PKCS1 or PKCS8 key",
201198
},
202199
{
203200
name: "generic provider with github app data in secret",
@@ -216,7 +213,7 @@ func Test_getAuthOpts_providerAuth(t *testing.T) {
216213
Name: "githubAppSecret",
217214
}
218215
},
219-
wantErr: errors.New("secretRef '/githubAppSecret' has github app data but provider is not set to github: invalid source configuration"),
216+
wantErr: "secretRef '/githubAppSecret' has github app data but provider is not set to github: invalid source configuration",
220217
},
221218
{
222219
name: "generic provider",
@@ -251,20 +248,19 @@ func Test_getAuthOpts_providerAuth(t *testing.T) {
251248
if tt.beforeFunc != nil {
252249
tt.beforeFunc(obj)
253250
}
254-
opts, err := getAuthOpts(context.TODO(), c, obj, SourceOptions{}, nil)
251+
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
252+
defer cancel()
253+
opts, err := getAuthOpts(ctx, c, obj, SourceOptions{}, nil)
255254

256-
if tt.wantErr != nil {
255+
if tt.wantErr != "" {
257256
g.Expect(err).To(HaveOccurred())
258-
g.Expect(err.Error()).To(ContainSubstring(tt.wantErr.Error()))
257+
g.Expect(err.Error()).To(ContainSubstring(tt.wantErr))
259258
} else {
260259
g.Expect(err).ToNot(HaveOccurred())
261260
g.Expect(opts).ToNot(BeNil())
262-
if tt.wantProviderOptsName != "" {
263-
g.Expect(opts.ProviderOpts).ToNot(BeNil())
264-
g.Expect(opts.ProviderOpts.Name).To(Equal(tt.wantProviderOptsName))
265-
} else {
266-
g.Expect(opts.ProviderOpts).To(BeNil())
267-
}
261+
g.Expect(opts.BearerToken).To(BeEmpty())
262+
g.Expect(opts.Username).To(BeEmpty())
263+
g.Expect(opts.Password).To(BeEmpty())
268264
}
269265
})
270266
}

‎main.go

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ import (
3535
metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
3636

3737
imagev1_reflect "github.com/fluxcd/image-reflector-controller/api/v1beta2"
38+
"github.com/fluxcd/pkg/auth"
3839
cache "github.com/fluxcd/pkg/cache"
3940
"github.com/fluxcd/pkg/runtime/acl"
4041
"github.com/fluxcd/pkg/runtime/client"
@@ -59,9 +60,6 @@ import (
5960

6061
const (
6162
controllerName = "image-automation-controller"
62-
63-
// recoverPanic indicates whether panic caused by reconciles should be recovered.
64-
recoverPanic = true
6563
)
6664

6765
var (
@@ -126,6 +124,14 @@ func main() {
126124
os.Exit(1)
127125
}
128126

127+
switch enabled, err := features.Enabled(auth.FeatureGateObjectLevelWorkloadIdentity); {
128+
case err != nil:
129+
setupLog.Error(err, "unable to check feature gate "+auth.FeatureGateObjectLevelWorkloadIdentity)
130+
os.Exit(1)
131+
case enabled:
132+
auth.EnableObjectLevelWorkloadIdentity()
133+
}
134+
129135
watchNamespace := ""
130136
if !watchOptions.AllNamespaces {
131137
watchNamespace = os.Getenv("RUNTIME_NAMESPACE")

0 commit comments

Comments
 (0)