Skip to content

Commit 0dbcd4e

Browse files
committed
gitrepo: add support for specifying CA data via ca.crt
Check the auth secret for the `ca.crt` key for CA certificate data. `ca.crt` takes precdence over `caFile`. Signed-off-by: Sanskar Jaiswal <jaiswalsanskar078@gmail.com>
1 parent 34ee875 commit 0dbcd4e

File tree

2 files changed

+30
-3
lines changed

2 files changed

+30
-3
lines changed

docs/spec/v1/gitrepositories.md

+4-3
Original file line numberDiff line numberDiff line change
@@ -161,8 +161,9 @@ data:
161161
#### HTTPS Certificate Authority
162162

163163
To provide a Certificate Authority to trust while connecting with a Git
164-
repository over HTTPS, the referenced Secret can contain a `.data.caFile`
165-
value.
164+
repository over HTTPS, the referenced Secret's `.data` can contain a `ca.crt`
165+
or `caFile` key. `ca.crt` takes precedence over `caFile`, i.e. if both keys
166+
are present, the value of `ca.crt` will be taken into consideration.
166167

167168
```yaml
168169
---
@@ -173,7 +174,7 @@ metadata:
173174
namespace: default
174175
type: Opaque
175176
data:
176-
caFile: <BASE64>
177+
ca.crt: <BASE64>
177178
```
178179

179180
#### SSH authentication

internal/controller/gitrepository_controller_test.go

+26
Original file line numberDiff line numberDiff line change
@@ -410,6 +410,32 @@ func TestGitRepositoryReconciler_reconcileSource_authStrategy(t *testing.T) {
410410
*conditions.UnknownCondition(meta.ReadyCondition, meta.ProgressingReason, "building artifact: new upstream revision 'master@sha1:<commit>'"),
411411
},
412412
},
413+
{
414+
name: "HTTPS with CAFile secret with both ca.crt and caFile keys makes Reconciling=True and ignores caFile",
415+
protocol: "https",
416+
server: options{
417+
publicKey: tlsPublicKey,
418+
privateKey: tlsPrivateKey,
419+
ca: tlsCA,
420+
},
421+
secret: &corev1.Secret{
422+
ObjectMeta: metav1.ObjectMeta{
423+
Name: "ca-file",
424+
},
425+
Data: map[string][]byte{
426+
"ca.crt": tlsCA,
427+
"caFile": []byte("invalid"),
428+
},
429+
},
430+
beforeFunc: func(obj *sourcev1.GitRepository) {
431+
obj.Spec.SecretRef = &meta.LocalObjectReference{Name: "ca-file"}
432+
},
433+
want: sreconcile.ResultSuccess,
434+
assertConditions: []metav1.Condition{
435+
*conditions.TrueCondition(meta.ReconcilingCondition, meta.ProgressingReason, "building artifact: new upstream revision 'master@sha1:<commit>'"),
436+
*conditions.UnknownCondition(meta.ReadyCondition, meta.ProgressingReason, "building artifact: new upstream revision 'master@sha1:<commit>'"),
437+
},
438+
},
413439
{
414440
name: "HTTPS with invalid CAFile secret makes CheckoutFailed=True and returns error",
415441
protocol: "https",

0 commit comments

Comments
 (0)