Skip to content

feat: AWS CodeCommit support #2035

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
taraspos wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat: AWS CodeCommit support #2035

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions api/v1/gitrepository_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,10 @@ const (
// GitProviderGitHub provides support for authentication to git
// repositories using GitHub App authentication
GitProviderGitHub string = "github"

// GitProviderAWS provides support for authentication to AWS CodeCommit
// repositories using IAM credentials.
GitProviderAWS string = "aws"
)

const (
Expand Down Expand Up @@ -77,7 +81,7 @@ const (

// GitRepositorySpec specifies the required configuration to produce an
// Artifact for a Git repository.
// +kubebuilder:validation:XValidation:rule="!has(self.serviceAccountName) || (has(self.provider) && self.provider == 'azure')",message="serviceAccountName can only be set when provider is 'azure'"
// +kubebuilder:validation:XValidation:rule="!has(self.serviceAccountName) || (has(self.provider) && (self.provider == 'azure' || self.provider == 'aws'))",message="serviceAccountName can only be set when provider is 'azure' or 'aws'"
type GitRepositorySpec struct {
// URL specifies the Git repository URL, it can be an HTTP/S or SSH address.
// +kubebuilder:validation:Pattern="^(http|https|ssh)://.*$"
Expand All @@ -93,14 +97,14 @@ type GitRepositorySpec struct {
// +optional
SecretRef *meta.LocalObjectReference `json:"secretRef,omitempty"`

// Provider used for authentication, can be 'azure', 'github', 'generic'.
// Provider used for authentication, can be 'aws', 'azure', 'github', 'generic'.
// When not specified, defaults to 'generic'.
// +kubebuilder:validation:Enum=generic;azure;github
// +kubebuilder:validation:Enum=generic;aws;azure;github
// +optional
Provider string `json:"provider,omitempty"`

// ServiceAccountName is the name of the Kubernetes ServiceAccount used to
// authenticate to the GitRepository. This field is only supported for 'azure' provider.
// authenticate to the GitRepository. This field is only supported for 'azure' and 'aws' providers.
// +optional
ServiceAccountName string `json:"serviceAccountName,omitempty"`

Expand Down
10 changes: 6 additions & 4 deletions config/crd/bases/source.toolkit.fluxcd.io_gitrepositories.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,10 +105,11 @@ spec:
type: string
provider:
description: |-
Provider used for authentication, can be 'azure', 'github', 'generic'.
Provider used for authentication, can be 'aws', 'azure', 'github', 'generic'.
When not specified, defaults to 'generic'.
enum:
- generic
- aws
- azure
- github
type: string
Expand Down Expand Up @@ -177,7 +178,7 @@ spec:
serviceAccountName:
description: |-
ServiceAccountName is the name of the Kubernetes ServiceAccount used to
authenticate to the GitRepository. This field is only supported for 'azure' provider.
authenticate to the GitRepository. This field is only supported for 'azure' and 'aws' providers.
type: string
sparseCheckout:
description: |-
Expand Down Expand Up @@ -242,8 +243,9 @@ spec:
type: object
x-kubernetes-validations:
- message: serviceAccountName can only be set when provider is 'azure'
rule: '!has(self.serviceAccountName) || (has(self.provider) && self.provider
== ''azure'')'
or 'aws'
rule: '!has(self.serviceAccountName) || (has(self.provider) && (self.provider
== ''azure'' || self.provider == ''aws''))'
status:
default:
observedGeneration: -1
Expand Down
8 changes: 4 additions & 4 deletions docs/api/v1/source.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -407,7 +407,7 @@ string
</td>
<td>
<em>(Optional)</em>
<p>Provider used for authentication, can be &lsquo;azure&rsquo;, &lsquo;github&rsquo;, &lsquo;generic&rsquo;.
<p>Provider used for authentication, can be &lsquo;aws&rsquo;, &lsquo;azure&rsquo;, &lsquo;github&rsquo;, &lsquo;generic&rsquo;.
When not specified, defaults to &lsquo;generic&rsquo;.</p>
</td>
</tr>
Expand All @@ -421,7 +421,7 @@ string
<td>
<em>(Optional)</em>
<p>ServiceAccountName is the name of the Kubernetes ServiceAccount used to
authenticate to the GitRepository. This field is only supported for &lsquo;azure&rsquo; provider.</p>
authenticate to the GitRepository. This field is only supported for &lsquo;azure&rsquo; and &lsquo;aws&rsquo; providers.</p>
</td>
</tr>
<tr>
Expand Down Expand Up @@ -2120,7 +2120,7 @@ string
</td>
<td>
<em>(Optional)</em>
<p>Provider used for authentication, can be &lsquo;azure&rsquo;, &lsquo;github&rsquo;, &lsquo;generic&rsquo;.
<p>Provider used for authentication, can be &lsquo;aws&rsquo;, &lsquo;azure&rsquo;, &lsquo;github&rsquo;, &lsquo;generic&rsquo;.
When not specified, defaults to &lsquo;generic&rsquo;.</p>
</td>
</tr>
Expand All @@ -2134,7 +2134,7 @@ string
<td>
<em>(Optional)</em>
<p>ServiceAccountName is the name of the Kubernetes ServiceAccount used to
authenticate to the GitRepository. This field is only supported for &lsquo;azure&rsquo; provider.</p>
authenticate to the GitRepository. This field is only supported for &lsquo;azure&rsquo; and &lsquo;aws&rsquo; providers.</p>
</td>
</tr>
<tr>
Expand Down
59 changes: 59 additions & 0 deletions docs/spec/v1/gitrepositories.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -245,6 +245,7 @@ used for authentication purposes.
Supported options are:

- `generic`
- `aws`
- `azure`
- `github`

Expand All @@ -254,6 +255,64 @@ mechanisms using `spec.secretRef` are used for authentication.
For a complete guide on how to set up authentication for cloud providers,
see the integration [docs](/flux/integrations/).

#### AWS
Copy link
Copy Markdown
Member

@matheuscscp matheuscscp Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This section needs a bit more color like the Azure one. Doesn't need too much detail, though, as those docs should be mostly pointing at https://fluxcd.io/flux/integrations/ by now

Copy link
Copy Markdown
Member

@matheuscscp matheuscscp Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@taraspos I don't see any pointers to the integrations docs

Copy link
Copy Markdown
Author

@taraspos taraspos Apr 21, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, sorry. Had to switch to something else and didn't finish the doc. Just push updated and simplified version.

Copy link
Copy Markdown
Author

@taraspos taraspos Apr 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@matheuscscp I didn't have a chance to test object level workload identity yet.
I will try to find time to do so tomorrow, and then we can merge this.


The `aws` provider can be used to authenticate to
[AWS CodeCommit](https://docs.aws.amazon.com/codecommit/latest/userguide/welcome.html)
repositories using IAM credentials sourced from the controller runtime identity.

**Note:** When the `aws` provider is used, `.spec.url` must be an AWS
CodeCommit HTTPS endpoint in the format
`https://git-codecommit.<region>.amazonaws.com/v1/repos/<repository-name>`.
For a full list of available regions and their endpoints, see the
[AWS CodeCommit regions documentation](https://docs.aws.amazon.com/codecommit/latest/userguide/regions.html#regions-git).

##### Pre-requisites

- An EKS cluster with either
[EKS Pod Identity](https://fluxcd.io/flux/integrations/aws/#with-eks-pod-identity)
or
[IAM Roles for Service Accounts (IRSA)](https://fluxcd.io/flux/integrations/aws/#with-oidc-federation)
configured.
- An IAM role with the `codecommit:GitPull` permission for the target
repository.

##### Configure Flux controller

1. Configure authentication using your preferred method - https://fluxcd.io/flux/integrations/aws/#authentication.
Copy link
Copy Markdown
Member

@matheuscscp matheuscscp Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
1. Configure authentication using your preferred method - https://fluxcd.io/flux/integrations/aws/#authentication.
1. Configure authentication using your preferred [method](https://fluxcd.io/flux/integrations/aws/#authentication).


Example IAM role policy:
Copy link
Copy Markdown
Member

@matheuscscp matheuscscp Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Example IAM role policy:
Example IAM role policy (see [docs](https://fluxcd.io/flux/integrations/aws/#for-amazon-codecommit) for more details):


```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "codecommit:GitPull",
"Resource": "arn:aws:codecommit:<region>:<account-id>:<repository-name>"
}
]
}
```

2. Configure AWS CodeCommit `GitRepository`

```yaml
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
name: codecommit-repository
namespace: flux-system
spec:
interval: 5m0s
provider: aws
url: https://git-codecommit.<region>.amazonaws.com/v1/repos/<repository-name>
Comment on lines +310 to +311
Copy link
Copy Markdown
Member

@matheuscscp matheuscscp Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
provider: aws
url: https://git-codecommit.<region>.amazonaws.com/v1/repos/<repository-name>
provider: aws
serviceAccountName: my-tenant # optional (used for object-level workload identity)
url: https://git-codecommit.<region>.amazonaws.com/v1/repos/<repository-name>

ref:
branch: main
```

#### Azure

The `azure` provider can be used to authenticate to Azure DevOps repositories
Expand Down
4 changes: 3 additions & 1 deletion internal/controller/gitrepository_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -670,11 +670,13 @@ func (r *GitRepositoryReconciler) getAuthOpts(ctx context.Context, obj *sourcev1
// Configure provider authentication if specified.
var getCreds func() (*authutils.GitCredentials, error)
switch provider := obj.GetProvider(); provider {
case sourcev1.GitProviderAzure: // If AWS or GCP are added in the future they can be added here separated by a comma.
// If other providers (GCP, etc.) are added in the future they can be added here separated by a comma.
case sourcev1.GitProviderAzure, sourcev1.GitProviderAWS:
getCreds = func() (*authutils.GitCredentials, error) {
opts := []auth.Option{
auth.WithClient(r.Client),
auth.WithServiceAccountNamespace(obj.GetNamespace()),
auth.WithGitURL(u),
Comment thread
taraspos marked this conversation as resolved.
}

if obj.Spec.ServiceAccountName != "" {
Expand Down
17 changes: 17 additions & 0 deletions internal/controller/gitrepository_controller_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -929,6 +929,23 @@ func TestGitRepositoryReconciler_getAuthOpts_provider(t *testing.T) {
},
wantErr: auth.FeatureGateObjectLevelWorkloadIdentity,
},
{
name: "aws provider with non codecommit URL",
url: "https://github.com/org/repo.git",
beforeFunc: func(obj *sourcev1.GitRepository) {
obj.Spec.Provider = sourcev1.GitProviderAWS
},
wantErr: "failed to create provider access token for the controller",
},
{
name: "aws provider with service account and feature gate for object-level identity disabled",
url: "https://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo",
beforeFunc: func(obj *sourcev1.GitRepository) {
obj.Spec.Provider = sourcev1.GitProviderAWS
obj.Spec.ServiceAccountName = "aws-sa"
},
wantErr: auth.FeatureGateObjectLevelWorkloadIdentity,
},
{
name: "github provider with no secret ref",
url: "https://github.com/org/repo.git",
Expand Down
Loading