Skip to content

Commit 914cd1f

Browse files
aryan9600aryan9600
committed
helmrepo: add .spec.certSecretReffor specifying TLS auth data
Add `.spec.certSecretRef` for specifying TLS authentication data using the `certFile`, `keyFile` and `caFile` keys. Deprecate the usage of these keys in the secret specified by `.spec.secretRef`. Signed-off-by: Sanskar Jaiswal <[email protected]>
1 parent d141456 commit 914cd1f

File tree

7 files changed

+208
-49
lines changed

7 files changed

+208
-49
lines changed

‎api/v1beta2/helmrepository_types.go

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,11 +51,18 @@ type HelmRepositorySpec struct {
5151
// for the HelmRepository.
5252
// For HTTP/S basic auth the secret must contain 'username' and 'password'
5353
// fields.
54-
// For TLS the secret must contain a 'certFile' and 'keyFile', and/or
55-
// 'caFile' fields.
54+
// Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile'
55+
// keys has been DEPRECATED. Please use `.spec.certSecretRef` instead.
5656
// +optional
5757
SecretRef *meta.LocalObjectReference `json:"secretRef,omitempty"`
5858

59+
// CertSecretRef specifies the Secret containing the TLS authentication
60+
// data. The secret must contain a 'certFile' and 'keyFile', and/or 'caFile'
61+
// fields. It takes precedence over the values specified in the Secret
62+
// referred to by `.spec.secretRef`.
63+
// +optional
64+
CertSecretRef *meta.LocalObjectReference `json:"certSecretRef,omitempty"`
65+
5966
// PassCredentials allows the credentials from the SecretRef to be passed
6067
// on to a host that does not match the host as defined in URL.
6168
// This may be required if the host of the advertised chart URLs in the

‎api/v1beta2/zz_generated.deepcopy.go

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/source.toolkit.fluxcd.io_helmrepositories.yaml

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -296,6 +296,18 @@ spec:
296296
required:
297297
- namespaceSelectors
298298
type: object
299+
certSecretRef:
300+
description: CertSecretRef specifies the Secret containing the TLS
301+
authentication data. The secret must contain a 'certFile' and 'keyFile',
302+
and/or 'caFile' fields. It takes precedence over the values specified
303+
in the Secret referred to by `.spec.secretRef`.
304+
properties:
305+
name:
306+
description: Name of the referent.
307+
type: string
308+
required:
309+
- name
310+
type: object
299311
interval:
300312
description: Interval at which to check the URL for updates.
301313
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
@@ -323,8 +335,9 @@ spec:
323335
secretRef:
324336
description: SecretRef specifies the Secret containing authentication
325337
credentials for the HelmRepository. For HTTP/S basic auth the secret
326-
must contain 'username' and 'password' fields. For TLS the secret
327-
must contain a 'certFile' and 'keyFile', and/or 'caFile' fields.
338+
must contain 'username' and 'password' fields. Support for TLS auth
339+
using the 'certFile' and 'keyFile', and/or 'caFile' keys has been
340+
DEPRECATED. Please use `.spec.certSecretRef` instead.
328341
properties:
329342
name:
330343
description: Name of the referent.

‎config/samples/source_v1beta2_helmrepository.yaml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,8 @@ metadata:
44
name: helmrepository-sample
55
spec:
66
interval: 1m
7-
url: https://stefanprodan.github.io/podinfo
7+
url: https://127.0.0.1:3000
8+
secretRef:
9+
name: invalid-tls
10+
certSecretRef:
11+
name: tls

‎docs/api/v1beta2/source.md

Lines changed: 38 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -792,8 +792,25 @@ github.com/fluxcd/pkg/apis/meta.LocalObjectReference
792792
for the HelmRepository.
793793
For HTTP/S basic auth the secret must contain &lsquo;username&rsquo; and &lsquo;password&rsquo;
794794
fields.
795-
For TLS the secret must contain a &lsquo;certFile&rsquo; and &lsquo;keyFile&rsquo;, and/or
796-
&lsquo;caFile&rsquo; fields.</p>
795+
Support for TLS auth using the &lsquo;certFile&rsquo; and &lsquo;keyFile&rsquo;, and/or &lsquo;caFile&rsquo;
796+
keys has been DEPRECATED. Please use <code>.spec.certSecretRef</code> instead.</p>
797+
</td>
798+
</tr>
799+
<tr>
800+
<td>
801+
<code>certSecretRef</code><br>
802+
<em>
803+
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#LocalObjectReference">
804+
github.com/fluxcd/pkg/apis/meta.LocalObjectReference
805+
</a>
806+
</em>
807+
</td>
808+
<td>
809+
<em>(Optional)</em>
810+
<p>CertSecretRef specifies the Secret containing the TLS authentication
811+
data. The secret must contain a &lsquo;certFile&rsquo; and &lsquo;keyFile&rsquo;, and/or &lsquo;caFile&rsquo;
812+
fields. It takes precedence over the values specified in the Secret
813+
referred to by <code>.spec.secretRef</code>.</p>
797814
</td>
798815
</tr>
799816
<tr>
@@ -2459,8 +2476,25 @@ github.com/fluxcd/pkg/apis/meta.LocalObjectReference
24592476
for the HelmRepository.
24602477
For HTTP/S basic auth the secret must contain &lsquo;username&rsquo; and &lsquo;password&rsquo;
24612478
fields.
2462-
For TLS the secret must contain a &lsquo;certFile&rsquo; and &lsquo;keyFile&rsquo;, and/or
2463-
&lsquo;caFile&rsquo; fields.</p>
2479+
Support for TLS auth using the &lsquo;certFile&rsquo; and &lsquo;keyFile&rsquo;, and/or &lsquo;caFile&rsquo;
2480+
keys has been DEPRECATED. Please use <code>.spec.certSecretRef</code> instead.</p>
2481+
</td>
2482+
</tr>
2483+
<tr>
2484+
<td>
2485+
<code>certSecretRef</code><br>
2486+
<em>
2487+
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#LocalObjectReference">
2488+
github.com/fluxcd/pkg/apis/meta.LocalObjectReference
2489+
</a>
2490+
</em>
2491+
</td>
2492+
<td>
2493+
<em>(Optional)</em>
2494+
<p>CertSecretRef specifies the Secret containing the TLS authentication
2495+
data. The secret must contain a &lsquo;certFile&rsquo; and &lsquo;keyFile&rsquo;, and/or &lsquo;caFile&rsquo;
2496+
fields. It takes precedence over the values specified in the Secret
2497+
referred to by <code>.spec.secretRef</code>.</p>
24642498
</td>
24652499
</tr>
24662500
<tr>

‎internal/controller/helmrepository_controller.go

Lines changed: 61 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -380,6 +380,18 @@ func (r *HelmRepositoryReconciler) reconcileStorage(ctx context.Context, sp *pat
380380
return sreconcile.ResultSuccess, nil
381381
}
382382

383+
func (r *HelmRepositoryReconciler) getSecret(ctx context.Context, name, namespace string) (*corev1.Secret, error) {
384+
key := types.NamespacedName{
385+
Namespace: namespace,
386+
Name: name,
387+
}
388+
var secret corev1.Secret
389+
if err := r.Get(ctx, key, &secret); err != nil {
390+
return nil, err
391+
}
392+
return &secret, nil
393+
}
394+
383395
// reconcileSource attempts to fetch the Helm repository index using the
384396
// specified configuration on the v1beta2.HelmRepository object.
385397
//
@@ -399,25 +411,52 @@ func (r *HelmRepositoryReconciler) reconcileSource(ctx context.Context, sp *patc
399411
helmgetter.WithPassCredentialsAll(obj.Spec.PassCredentials),
400412
}
401413

402-
// Configure any authentication related options
403-
if obj.Spec.SecretRef != nil {
404-
// Attempt to retrieve secret
405-
name := types.NamespacedName{
406-
Namespace: obj.GetNamespace(),
407-
Name: obj.Spec.SecretRef.Name,
408-
}
409-
var secret corev1.Secret
410-
if err := r.Client.Get(ctx, name, &secret); err != nil {
414+
getTLSConfig := func(secret *corev1.Secret) error {
415+
var err error
416+
tlsConfig, err = getter.TLSClientConfigFromSecret(*secret, obj.Spec.URL)
417+
if err != nil {
411418
e := &serror.Event{
412-
Err: fmt.Errorf("failed to get secret '%s': %w", name.String(), err),
419+
Err: fmt.Errorf("failed to create TLS client config with secret data: %w", err),
413420
Reason: sourcev1.AuthenticationFailedReason,
414421
}
415422
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, e.Err.Error())
416-
return sreconcile.ResultEmpty, e
423+
return e
424+
}
425+
return nil
426+
}
427+
428+
// Check certSecretRef first as it takes precedence over secretRef for TLS.
429+
if obj.Spec.CertSecretRef != nil {
430+
secret, err := r.getSecret(ctx, obj.Spec.CertSecretRef.Name, obj.GetNamespace())
431+
if err != nil {
432+
e := serror.NewGeneric(
433+
fmt.Errorf("failed to get TLS authentication secret '%s/%s': %w", obj.GetNamespace(), obj.Spec.CertSecretRef.Name, err),
434+
sourcev1.AuthenticationFailedReason,
435+
)
436+
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, e.Err.Error())
437+
return sreconcile.ResultEmpty, err
438+
}
439+
440+
if err := getTLSConfig(secret); err != nil {
441+
// Requeue as content of secret might change
442+
return sreconcile.ResultEmpty, err
443+
}
444+
}
445+
446+
// Configure any authentication related options
447+
if obj.Spec.SecretRef != nil {
448+
secret, err := r.getSecret(ctx, obj.Spec.SecretRef.Name, obj.GetNamespace())
449+
if err != nil {
450+
e := serror.NewGeneric(
451+
fmt.Errorf("failed to get authentication secret '%s/%s': %w", obj.GetNamespace(), obj.Spec.SecretRef.Name, err),
452+
sourcev1.AuthenticationFailedReason,
453+
)
454+
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, e.Err.Error())
455+
return sreconcile.ResultEmpty, err
417456
}
418457

419458
// Construct actual options
420-
opts, err := getter.ClientOptionsFromSecret(secret)
459+
opts, err := getter.ClientOptionsFromSecret(*secret)
421460
if err != nil {
422461
e := &serror.Event{
423462
Err: fmt.Errorf("failed to configure Helm client with secret data: %w", err),
@@ -429,15 +468,17 @@ func (r *HelmRepositoryReconciler) reconcileSource(ctx context.Context, sp *patc
429468
}
430469
clientOpts = append(clientOpts, opts...)
431470

432-
tlsConfig, err = getter.TLSClientConfigFromSecret(secret, obj.Spec.URL)
433-
if err != nil {
434-
e := &serror.Event{
435-
Err: fmt.Errorf("failed to create TLS client config with secret data: %w", err),
436-
Reason: sourcev1.AuthenticationFailedReason,
471+
if tlsConfig == nil {
472+
if err := getTLSConfig(secret); err != nil {
473+
// Return err as the content of the secret may change.
474+
return sreconcile.ResultEmpty, err
475+
}
476+
// If we constructed a TLS config using the secret specified in `.spec.secretRef`,
477+
// then alert users that this behavior is deprecated.
478+
if tlsConfig != nil {
479+
r.Event(obj, "Warning", "DeprecatedBehaviorReason",
480+
"specifying TLS authentication data via `.spec.secretRef` is deprecated, please use `.spec.certSecretRef` instead")
437481
}
438-
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, e.Err.Error())
439-
// Requeue as content of secret might change
440-
return sreconcile.ResultEmpty, e
441482
}
442483
}
443484

0 commit comments

Comments
 (0)