kubernetes
/
git-sync
mirror of https://github.com/kubernetes/git-sync.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #584 from thockin/v4_cred_helper_cache 

v4: Change from "store" to "cache" for credentials
This commit is contained in:
Kubernetes Prow Robot 2022-07-14 10:10:59 -07:00 committed by GitHub
parent 9b5b8143b3 e8ef2c05be
commit 3a5b5ca4c8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 24 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
cmd/git-sync/main.go
View File

@ -506,10 +506,6 @@ func main() {
} }
*flPassword = string(passwordFileBytes) *flPassword = string(passwordFileBytes)
} }
if err := git.StoreCredentials(ctx, *flUsername, *flPassword); err != nil {
log.Error(err, "can't store git credentials")
os.Exit(1)
}
} }
if *flSSH { if *flSSH {
@ -615,6 +611,26 @@ func main() {
go exechookRunner.Run(context.Background()) go exechookRunner.Run(context.Background())
} }
// Craft a function that can be called to refresh credentials when needed.
refreshCreds := func(ctx context.Context) error {
// These should all be mutually-exclusive configs.
if *flUsername != "" {
if err := git.StoreCredentials(ctx, *flUsername, *flPassword); err != nil {
return err
}
}
if *flAskPassURL != "" {
// When using an auth URL, the credentials can be dynamic, it needs to be
// re-fetched each time.
if err := git.CallAskPassURL(ctx); err != nil {
askpassCount.WithLabelValues(metricKeyError).Inc()
return err
}
askpassCount.WithLabelValues(metricKeySuccess).Inc()
}
return nil
}
initialSync := true initialSync := true
failCount := 0 failCount := 0
for { for {
@ -629,7 +645,7 @@ func main() {
} }
} }
if changed, hash, err := git.SyncRepo(ctx); err != nil { if changed, hash, err := git.SyncRepo(ctx, refreshCreds); err != nil {
failCount++ failCount++
updateSyncMetrics(metricKeyError, start) updateSyncMetrics(metricKeyError, start)
if *flMaxSyncFailures != -1 && failCount > *flMaxSyncFailures { if *flMaxSyncFailures != -1 && failCount > *flMaxSyncFailures {
@ -1247,16 +1263,8 @@ func (git *repoSync) ResolveRef(ctx context.Context, ref string) (string, error)
// SyncRepo syncs the branch of a given repository to the link at the given rev. // SyncRepo syncs the branch of a given repository to the link at the given rev.
// returns (1) whether a change occured, (2) the new hash, and (3) an error if one happened // returns (1) whether a change occured, (2) the new hash, and (3) an error if one happened
func (git *repoSync) SyncRepo(ctx context.Context) (bool, string, error) { func (git *repoSync) SyncRepo(ctx context.Context, refreshCreds func(context.Context) error) (bool, string, error) {
if git.authURL != "" { refreshCreds(ctx)
// When using an auth URL, the credentials can be dynamic, it needs to be
// re-fetched each time.
if err := git.CallAskPassURL(ctx); err != nil {
askpassCount.WithLabelValues(metricKeyError).Inc()
return false, "", fmt.Errorf("failed to get credentials from auth URL: %v", err)
}
askpassCount.WithLabelValues(metricKeySuccess).Inc()
}
currentWorktreeGit := filepath.Join(git.link, ".git") currentWorktreeGit := filepath.Join(git.link, ".git")
var hash string var hash string
@ -1453,7 +1461,7 @@ func (git *repoSync) setupDefaultGitConfigs(ctx context.Context) error {
}, { }, {
// How to manage credentials (for those modes that need it). // How to manage credentials (for those modes that need it).
key: "credential.helper", key: "credential.helper",
val: "store", val: "cache --timeout 3600",
}} }}
for _, kv := range configs { for _, kv := range configs {
if _, err := git.run.Run(ctx, "", nil, git.cmd, "config", "--global", kv.key, kv.val); err != nil { if _, err := git.run.Run(ctx, "", nil, git.cmd, "config", "--global", kv.key, kv.val); err != nil {