GitRepository authentication required but secretRef set

[Nemergal]

Hello 👋

I want to add a GitRepository resource linked to a repository self-hosted GitLab instance but I encountered an error "failed to checkout and determine revision: unable to clone 'https://gitlab.domain/myapp.git': authentication required".

The setup:

• Self-hosted GitLab instance under self-signed certificate, no 2FA for the flux account
• secretRef inside GitRepository set to gitlab-authentication secret
• gitlab-authentication secret has 3 fields in data: username, password and ca.crt
• if I try to remove ca.crt field from the secret, the GitRepository return an tls verify error which is logic but mean that the secret is read when the field is set
• the username/password is valid on gitlab, this account has full access to the repository
• flux 2.2.3 on fresh k3s v1.30.4+k3s1 cluster

Secret:

---

apiVersion: v1
kind: Secret
metadata:
  name: gitlab-authentication
  namespace: flux-system
type: Opaque
data:
  username: <username in base64>
  password: <password in base64>
  ca.crt: <ca-chain in base64>

GitRepository

---
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
  name: myapp
  namespace: flux-system
spec:
  interval: 10m0s
  ref:
    branch: main
  secretRef:
    name: gitlab-authentication
  url: https://gitlab.domain/myapp.git

I was able to setup it right in the past but today I having hard time to find where I've made a mistake.

If you have any idea, thank you!

[stefanprodan]

It could be that the base64 username or password contain some \n encoded. You can generate the secret with the Flux CLI like this:

  flux create secret git gitlab-authentication \
    --url=https://gitlab.domain/myapp.git \
    --username=username \
    --password=password \
    --ca-crt-file=path/to/ca.crt

[Nemergal]

Hello Stefan,

Good catch. I use SOPS to encrypt Secrets before they goes to my repository. A clear .data field like:

[removed for example]
data:
  username: <username in base64>
  password: <password in base64>
  ca.crt: <ca-chain in base64>

Are encrypted on my side with SOPS then decrypted in the cluster by the Kustomization like this:

# gitlab-authentication secret
[removed for example]
data:
  username: |
    <username in base64>
  password: |
    <password in base64>
  ca.crt: |
    <ca-chain in base64>

If I set the username/password with an 'inline' value or If I use the flux createcommand, no problem, the authentication work. Thank you!

What I don't understand is why when I decrypt the encrypted secret, on my laptop with sops -d <file>, the multiline symbol « | » don't appear on the resulted file but only when it's decrypted in the cluster?

[stefanprodan]

I guess the SOPS CLI does some trimming on the output. The flux create secret command can be used to write the secret to stdout and that can be piped to sops. Run it with —help to see an example.