Skip to content

Conversation

@PatrickLaabs
Copy link
Collaborator

What this PR does / why we need it:
This PR introduces the first implementation for using a secretRef within our API to pull/clone from private repositories.

Which issue(s) this PR fixes:
Fixes #20

@PatrickLaabs PatrickLaabs added this to the v1.0.0 milestone Oct 17, 2025
@PatrickLaabs PatrickLaabs self-assigned this Oct 17, 2025
@PatrickLaabs PatrickLaabs added the enhancement New feature or request label Oct 17, 2025
@PatrickLaabs PatrickLaabs force-pushed the 20 branch 2 times, most recently from 4b90af7 to f99d949 Compare October 17, 2025 19:01
@PatrickLaabs
Copy link
Collaborator Author

E1017 19:22:01.296709       1 git.go:51] "Failed on retrieve the token from the tokenContent" err="ssh: no key found" controller="cdk8sappproxy" controllerGroup="addons.cluster.x-k8s.io" controllerKind="Cdk8sAppProxy" Cdk8sAppProxy="default/cdk8s-sample-app-go" namespace="default" name="cdk8s-sample-app-go" reconcileID="bfb14c49-b836-4a76-a860-42ae7ed0186d" cdk8sappproxy="default/cdk8s-sample-app-go"

@PatrickLaabs
Copy link
Collaborator Author

Skill Issue:

I1017 19:44:14.620913       1 controller.go:314] "Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes reqeueuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler" controller="cdk8sappproxy" controllerGroup="addons.cluster.x-k8s.io" controllerKind="Cdk8sAppProxy" Cdk8sAppProxy="caapc-system/cdk8s-sample-app-go" namespace="caapc-system" name="cdk8s-sample-app-go" reconcileID="c735f95d-3d58-4761-936e-0c6a06d6d90a"

@PatrickLaabs
Copy link
Collaborator Author

PatrickLaabs commented Oct 17, 2025

Other git interface seem to need the authentication aswell. At least the Polling interface.
Anyway.
Was able to clone the repo with the given credentials:

I1017 20:13:38.743681       1 reflector.go:368] Caches populated for *v1.Secret from k8s.io/[email protected]/tools/cache/reflector.go:243
Enumerating objects: 848, done.
Counting objects: 100% (848/848), done.
Compressing objects: 100% (390/390), done.
Total 848 (delta 463), reused 794 (delta 453), pack-reused 0 (from 0)
E1017 20:13:56.666735       1 git.go:139] "Failed to open local repo" err="repository does not exist" controller="cdk8sappproxy" controllerGroup="addons.cluster.x-k8s.io" controllerKind="Cdk8sAppProxy" Cdk8sAppProxy="caapc-system/cdk8s-sample-app-go" namespace="caapc-system" name="cdk8s-sample-app-go" reconcileID="383005a8-b635-4bf0-94ac-2a3d5d47512d" cdk8sappproxy="caapc-system/cdk8s-sample-app-go" repo="[email protected]:PatrickLaabs/cdk8s-sample-deployment.git"
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
/ $ ls -lah /tmp/cdk8s-caapc-system-cdk8s-sample-app-go-main/deployments/dist/
total 4K
drwxr-xr-x    2 nonroot  nonroot       38 Oct 17 20:17 .
drwxr-xr-x    4 nonroot  nonroot      106 Oct 17 20:17 ..
-rw-r--r--    1 nonroot  nonroot      374 Oct 17 20:17 getting-started.k8s.yaml

@PatrickLaabs PatrickLaabs requested a review from RegWin32 October 17, 2025 20:19
@PatrickLaabs PatrickLaabs marked this pull request as draft October 17, 2025 20:20
@PatrickLaabs PatrickLaabs force-pushed the 20 branch 2 times, most recently from 5f51ecd to c83c4b0 Compare October 22, 2025 15:31
@PatrickLaabs PatrickLaabs changed the title ⚠️ API CHANGE: Adding secretRef to API ⚠️ Feature: Adding the option to pull from a private repository Oct 22, 2025
@PatrickLaabs
Copy link
Collaborator Author

PatrickLaabs commented Oct 22, 2025

Reconcile + Redeployment still active. For testing purposes, in favor of improvements, the poll interval has been removed. I'll re-work the implementation within this pr.

Overall, the implementation of pulling cdk8s deployment definition from a private repository, using a ssh token is working.

Next up:

  • ✅ Setting a custom secret token, instead of hard coded 'api-token'
  • ✅ Allow pulling from public and private repositories. For this, we might want a helper function, which decides which road we go.
  • ✅ KnownHosts implementation
  • re-implement poll interval.

Implemented CheckAcess on reconciler
@PatrickLaabs PatrickLaabs marked this pull request as ready for review October 23, 2025 14:30
@PatrickLaabs PatrickLaabs force-pushed the 20 branch 2 times, most recently from 2fc651b to 66a46bc Compare October 24, 2025 07:30
@PatrickLaabs
Copy link
Collaborator Author

The Poll Interval has been removed. We should re-work the reconciler as a whole.
But this will not happen within this PR.

@PatrickLaabs
Copy link
Collaborator Author

I also commented the Git polling and Hashing implementation for now. Since we need to re-work the Poll Interval, we are save to keep this commented.

➜  ~ k get pods
NAME                                                    READY   STATUS              RESTARTS   AGE
cdk8s-public-test-deployment-c8493fce-5dcb97c5b-87fd4   0/1     ContainerCreating   0          7s
getting-started-deployment-c80c7257-76cfc4576b-c9psm    1/1     Running             0          47s

Copy link
Collaborator

@RegWin32 RegWin32 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tests looked fine, great code. LGTM

@RegWin32 RegWin32 merged commit e1ad2f9 into main Oct 24, 2025
6 checks passed
@RegWin32 RegWin32 deleted the 20 branch October 24, 2025 09:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

✨ Add Authentication for private git repositories

3 participants