chartsync: support Git HTTPS credentials using secret

[richardcase]

Started to add https basic authentication to the git chart source. the
username and password can be set as a static value or from a secret.
For example:

spec:
  releaseName: my-app
  chart:
    git: https://github.com/someonesomerepo.git
    ref: master
    path: charts/my-app
    secretRef:
      name: git-credentials

Still a work in progress

Relates to: #94

[stefanprodan]

@richardcase I think this should be paused until we decide how to handle git/helm repos outside the HelmRelease spec. See #142

[richardcase]

@richardcase I think this should be paused until we decide how to handle git/helm repos outside the HelmRelease spec. See #142

@stefanprodan - Sure. Although i really need this functionality for a specific scenario i'm working on. I'll work from a fork. If you need any help with #142 let me know

[stefanprodan]

If you need this then please make it more compact like in my proposal:

spec:
  releaseName: my-app
  chart:
    git: https://github.com/someonesomerepo.git
    ref: master
    path: charts/my-app
    secretRef: #optional
      name: git-basic-auth #required

apiVersion: v1
kind: Secret
metadata:
  name: git-basic-auth
type: Opaque
data:
  username: <BASE64> #required
  password: <BASE64> #required

[richardcase]

If you need this then please make it more compact like in my proposal

Sure i can do that. I will make that change now

[hiddeco]

In addition to all of the above, instead of merging in master it is better for reviewers and Git history clutter to rebase on top of master.

[richardcase]

In addition to all of the above, instead of merging in master it is better for reviewers and Git history clutter to rebase on top of master.

Understood, that was a mess up my side....a case of PEBKAC

[richardcase]

@stefanprodan @hiddeco - i've made the change to simplify the specifiying of the creds as suggested. So as suggested you have:

spec:
  releaseName: my-release
  chart:
    git: https://github.com/someorg/somerepo.git
    ref: master
    path: charts/my-chart
    secretRef:
      name: git-pwd

apiVersion: v1
kind: Secret
metadata:
  name: git-pwd
type: Opaque
data:
  password: supersecret
  username: joeblogs

[hiddeco]

Besides the in-code comments, I think the mirrorName function needs to be made smarter as the credentials from other HelmRelease resources (and namespaces) will now leak by configuring a source.GitURL (without credentials) that is already in use by another HelmRelease (with credentials).

You may get away with just adding the namespace, if I am not mistaken this is the same approach Flux uses for image pull secrets.

[richardcase]

You may get away with just adding the namespace, if I am not mistaken this is the same approach Flux uses for image pull secrets.

@hiddeco - i checked and flux does use the namespace. I changed the mirrorName to use a composite of namespace, auth secret name, git url. Do you think this is ok?

[hiddeco]

@richardcase thanks a lot 🥇

@stefanprodan can you take a look and see if this matches your expectations for the issue you mentioned? Feature wise it looks fine and mergeable to me (after I get rid of the persistent alias caused by the linter).

[stefanprodan]

@hiddeco it looks Ok to me, it needs a rebase with master are you going to do that when fixing the aliases?

[hiddeco]

@stefanprodan yep, will do the rebase and some minor fixes that triggered my OCD 👍

[hiddeco]

Rebased and tidied up, awesome contribution @richardcase 🙌 🍰

[stefanprodan]

In the future we should consider adding support for cross-namespace secrets like we have done in #219

[stefanprodan]

LGTM