@@ -28,6 +28,7 @@ import (
2828
2929 securejoin "github.com/cyphar/filepath-securejoin"
3030 "github.com/fluxcd/pkg/runtime/logger"
31+ "github.com/go-git/go-git/v5/plumbing/transport"
3132 corev1 "k8s.io/api/core/v1"
3233 "k8s.io/apimachinery/pkg/runtime"
3334 "k8s.io/apimachinery/pkg/types"
@@ -473,24 +474,50 @@ func (r *GitRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
473474 conditions .Delete (obj , sourcev1 .SourceVerifiedCondition )
474475 }
475476
477+ var proxyOpts * transport.ProxyOptions
478+ if obj .Spec .Proxy != nil {
479+ proxySecretName := obj .Spec .Proxy .SecretRef .Name
480+ proxyData , err := r .getSecretData (ctx , proxySecretName , obj .GetNamespace ())
481+ if err != nil {
482+ e := serror .NewGeneric (
483+ fmt .Errorf ("failed to get secret '%s/%s': %w" , proxySecretName , obj .GetNamespace (), err ),
484+ sourcev1 .AuthenticationFailedReason ,
485+ )
486+ conditions .MarkTrue (obj , sourcev1 .FetchFailedCondition , e .Reason , e .Err .Error ())
487+ // Return error as the world as observed may change
488+ return sreconcile .ResultEmpty , e
489+ }
490+ address , ok := proxyData ["address" ]
491+ if ! ok {
492+ e := serror .NewGeneric (
493+ fmt .Errorf ("invalid proxy secret '%s/%s': key 'address' is missing" , proxySecretName , obj .GetNamespace ()),
494+ sourcev1 .AuthenticationFailedReason ,
495+ )
496+ conditions .MarkTrue (obj , sourcev1 .FetchFailedCondition , e .Reason , e .Err .Error ())
497+ // Return error as the world as observed may change
498+ return sreconcile .ResultEmpty , e
499+ }
500+ proxyOpts = & transport.ProxyOptions {
501+ URL : string (address ),
502+ }
503+ proxyOpts .Username = string (proxyData ["username" ])
504+ proxyOpts .Password = string (proxyData ["password" ])
505+ }
506+
476507 var authData map [string ][]byte
477508 if obj .Spec .SecretRef != nil {
478509 // Attempt to retrieve secret
479- name := types.NamespacedName {
480- Namespace : obj .GetNamespace (),
481- Name : obj .Spec .SecretRef .Name ,
482- }
483- var secret corev1.Secret
484- if err := r .Client .Get (ctx , name , & secret ); err != nil {
510+ var err error
511+ authData , err = r .getSecretData (ctx , obj .Spec .SecretRef .Name , obj .GetNamespace ())
512+ if err != nil {
485513 e := serror .NewGeneric (
486- fmt .Errorf ("failed to get secret '%s': %w" , name . String (), err ),
514+ fmt .Errorf ("failed to get secret '%s/%s ': %w" , obj . Spec . SecretRef . Name , obj . GetNamespace (), err ),
487515 sourcev1 .AuthenticationFailedReason ,
488516 )
489517 conditions .MarkTrue (obj , sourcev1 .FetchFailedCondition , e .Reason , e .Err .Error ())
490518 // Return error as the world as observed may change
491519 return sreconcile .ResultEmpty , e
492520 }
493- authData = secret .Data
494521 }
495522
496523 u , err := url .Parse (obj .Spec .URL )
@@ -541,7 +568,7 @@ func (r *GitRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
541568 optimizedClone = true
542569 }
543570
544- c , err := r .gitCheckout (ctx , obj , authOpts , dir , optimizedClone )
571+ c , err := r .gitCheckout (ctx , obj , authOpts , proxyOpts , dir , optimizedClone )
545572 if err != nil {
546573 return sreconcile .ResultEmpty , err
547574 }
@@ -583,7 +610,7 @@ func (r *GitRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
583610
584611 // If we can't skip the reconciliation, checkout again without any
585612 // optimization.
586- c , err := r .gitCheckout (ctx , obj , authOpts , dir , false )
613+ c , err := r .gitCheckout (ctx , obj , authOpts , proxyOpts , dir , false )
587614 if err != nil {
588615 return sreconcile .ResultEmpty , err
589616 }
@@ -611,6 +638,18 @@ func (r *GitRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
611638 return sreconcile .ResultSuccess , nil
612639}
613640
641+ func (r * GitRepositoryReconciler ) getSecretData (ctx context.Context , name , namespace string ) (map [string ][]byte , error ) {
642+ key := types.NamespacedName {
643+ Namespace : namespace ,
644+ Name : name ,
645+ }
646+ var secret corev1.Secret
647+ if err := r .Client .Get (ctx , key , & secret ); err != nil {
648+ return nil , err
649+ }
650+ return secret .Data , nil
651+ }
652+
614653// reconcileArtifact archives a new Artifact to the Storage, if the current
615654// (Status) data on the object does not match the given.
616655//
@@ -782,8 +821,8 @@ func (r *GitRepositoryReconciler) reconcileInclude(ctx context.Context, sp *patc
782821// gitCheckout builds checkout options with the given configurations and
783822// performs a git checkout.
784823func (r * GitRepositoryReconciler ) gitCheckout (ctx context.Context ,
785- obj * sourcev1.GitRepository , authOpts * git.AuthOptions , dir string ,
786- optimized bool ) (* git.Commit , error ) {
824+ obj * sourcev1.GitRepository , authOpts * git.AuthOptions , proxyOpts * transport. ProxyOptions ,
825+ dir string , optimized bool ) (* git.Commit , error ) {
787826 // Configure checkout strategy.
788827 cloneOpts := repository.CloneConfig {
789828 RecurseSubmodules : obj .Spec .RecurseSubmodules ,
@@ -813,6 +852,9 @@ func (r *GitRepositoryReconciler) gitCheckout(ctx context.Context,
813852 if authOpts .Transport == git .HTTP {
814853 clientOpts = append (clientOpts , gogit .WithInsecureCredentialsOverHTTP ())
815854 }
855+ if proxyOpts != nil {
856+ clientOpts = append (clientOpts , gogit .WithProxy (* proxyOpts ))
857+ }
816858
817859 gitReader , err := gogit .NewClient (dir , authOpts , clientOpts ... )
818860 if err != nil {
0 commit comments