Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

flux create source git with --password fails to create secret #3892

Open
1 task done
DeyvsonL opened this issue May 17, 2023 · 7 comments · May be fixed by #4119
Open
1 task done

flux create source git with --password fails to create secret #3892

DeyvsonL opened this issue May 17, 2023 · 7 comments · May be fixed by #4119
Assignees
@mounilKshah
Labels
good first issue Good for newcomers

Comments

@DeyvsonL
Copy link

Describe the bug

When using flux cli, I expect to be able to use Azure DevOps personal access token (PAT). But the command "flux create source git" delete the Kubernetes secret when the username is not specified. If we modify the secret manually, removing the username, everything still working.

Steps to reproduce

  1. install flux in a Kubernetes cluster
  2. run command line "flux create source git password='${my-PAT}' --url='${my-git-repo}' name"
  3. flux gitreposity created but authentication fails
  4. secret with the same as the gitrepository

Expected behavior

A kubernetes secret shoul be created without username but with password field.

Screenshots and recordings

No response

OS / Distro

Ubuntu 20.04

Flux version

v0.34.0

Flux check

► checking prerequisites
✗ flux 0.34.0 <2.0.0-rc.3 (new version is available, please upgrade)
✔ Kubernetes 1.23.7 >=1.20.6-0
✔ helm-controller: deployment ready
✔ image-automation-controller: deployment ready
✔ image-reflector-controller: deployment ready
✔ kustomize-controller: deployment ready
✔ notification-controller: deployment ready
✔ source-controller: deployment ready
✔ alerts.notification.toolkit.fluxcd.io/v1beta1
✔ buckets.source.toolkit.fluxcd.io/v1beta2
✔ gitrepositories.source.toolkit.fluxcd.io/v1beta2
✔ helmcharts.source.toolkit.fluxcd.io/v1beta2
✔ helmreleases.helm.toolkit.fluxcd.io/v2beta1
✔ helmrepositories.source.toolkit.fluxcd.io/v1beta2
✔ imagepolicies.image.toolkit.fluxcd.io/v1beta1
✔ imagerepositories.image.toolkit.fluxcd.io/v1beta1
✔ imageupdateautomations.image.toolkit.fluxcd.io/v1beta1
✔ kustomizations.kustomize.toolkit.fluxcd.io/v1beta2
✔ providers.notification.toolkit.fluxcd.io/v1beta1
✔ receivers.notification.toolkit.fluxcd.io/v1beta1
✔ all checks passed

Git provider

Azure DevOps

Container Registry provider

No response

Additional context

No response

Code of Conduct

  • I agree to follow this project's Code of Conduct
@makkes makkes added the good first issue Good for newcomers label May 31, 2023
@kingdonb
Copy link
Member

The current version of the CLI is Flux v2 2.0.0-rc.4 – the 0.34 release is a very old one.

I tested your scenario against the latest CLI, and it did not delete the token. However, flux create source git with a --password and no --username does indeed fail to create the associated secret. Is it possible for you to include a username? (Will that break the authentication with Azure DevOps?)

I only have GitHub to work with right now, I cannot test on DevOps today, but if you're seeing a secret that gets deleted by flux create source git I would definitely call that a bug. However since I cannot replicate it in the current version, I'd like to ask you to try a current version instead, and let us know if it reproduces the same. That way if there is still an issue, we can re-scope your report and make it clearer what still remains about it to be fixed today.

Can you try the current Flux release please?

@talife
Copy link
Contributor

talife commented Jul 26, 2023

Is this scenario still valid where we could have the password flag without the username ?
I could make it but I'd be more comfortable introducing a new flag, something like --pat to avoid confusion

@kingdonb
Copy link
Member

Typically the convention is to use the username git when connection is over SSH, and for HTTPS many git hosts will disregard the username altogether when you're using token auth, as the token alone is enough information to identify your user (or the permitted entity, and whatever user sits behind it).

I think there is a minor UX issue here but I'm not quite sure what it is. I'm renaming this issue because I think we've established that it's not deleting any secrets, that would be bad. I think you should be able to use create source git with only --password and it's reasonable to expect the result to be, the creation of a GitRepository source and a secret with only the password field in it. Is that what's needed? I'm not sure what class of user needs this behavior but I am not in it.

We need someone to make the case for change a bit clearer in order to follow this up.

@kingdonb
Copy link
Member

Let's change the issue title to:

"flux create source git" with --password fails to create secret

(Turns out I don't have "edit issue/PR title" permissions here, with only the triage role)

@hiddeco hiddeco changed the title "flux create source git" deleting secret flux create source git with --password fails to create secret Jul 27, 2023
@talife
Copy link
Contributor

talife commented Jul 27, 2023

I see, it makes sense. I will have time this weekend to submit the PR

@talife talife linked a pull request Aug 1, 2023 that will close this issue
Open
@mounilKshah
Copy link

If no one else is working on this issue, may I work on it? The PR created has the tag on hold, so is it fine if I take up this issue? @kingdonb

@kingdonb
Copy link
Member

kingdonb commented Dec 3, 2023 •
edited

Absolutely, thanks for volunteering and welcome to ping me for reviews 🙇

Can you see the issue with the linked PR #4119? It's not clear to me from the comment thread yet

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@mounilKshah mounilKshah

Labels
good first issue Good for newcomers
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Make username optional for flux create secret git talife/flux2
5 participants
@makkes @kingdonb @talife @DeyvsonL @mounilKshah