Repository navigation
feat(operator): support private OCI registry credentials for platform source - #2472
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
📝 WalkthroughWalkthroughAdds a ChangesPlatform source secret wiring
Sequence Diagram(s)sequenceDiagram
participant Template as cozystack-operator.yaml template
participant Main as cozystack-operator main
participant Install as installPlatformSourceResource
participant OCI as generateOCIRepository
participant Git as generateGitRepository
participant FluxOCI as OCIRepository
participant FluxGit as GitRepository
Template->>Main: --platform-source-secret
Main->>Install: platformSourceSecret
alt platformSourceUrl is OCI
Install->>OCI: secretName
OCI->>FluxOCI: set spec.secretRef
else platformSourceUrl is Git
Install->>Git: secretName
Git->>FluxGit: set spec.secretRef
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Aleksei Sviridkin (lexfrei)
left a comment
Aleksei Sviridkin (lexfrei)
left a comment
There was a problem hiding this comment.
NOT LGTM — the operator binary and its unit tests do not compile in their current state; both are blockers.
This adds a --platform-source-secret flag so the operator attaches spec.secretRef to the generated OCIRepository/GitRepository, enabling a private platform source.
On the secret-handling concerns: the design is sound. The operator only references the secret by name (it never reads the credentials, and only the name — not any secret content — is logged); the credentials are consumed by the Flux source-controller under its existing RBAC, so no new operator RBAC is required; and the empty default leaves existing public-registry installs unchanged. The blockers below are compile-level, not security-level.
Blockers
-
The operator does not compile.
metav1.LocalObjectReferencedoes not exist ink8s.io/apimachinery/pkg/apis/meta/v1. The FluxSecretReffield is typed*meta.LocalObjectReferencefromgithub.com/fluxcd/pkg/apis/meta, so neithermetav1nor the already-importedcorev1.LocalObjectReferencesatisfies it — importgithub.com/fluxcd/pkg/apis/metaand use&meta.LocalObjectReference{Name: secretName}.go build ./cmd/cozystack-operatorfails withundefined: metav1.LocalObjectReference. Evidence: cmd/cozystack-operator/main.go:545 and cmd/cozystack-operator/main.go:587. -
The unit tests do not compile.
generateOCIRepositoryandgenerateGitRepositorygained a requiredsecretNameparameter, but the existing test callers still pass three arguments, sogo test ./cmd/cozystack-operatorfails with "not enough arguments". No test covers the new secretRef behavior either. Evidence: new signatures at cmd/cozystack-operator/main.go:513 and main.go:554; unchanged 3-argument callers at cmd/cozystack-operator/main_test.go:490, :516, :526 (OCI) and :534, :560, :570 (Git).
Non-blocking
- The credential-format guidance is wrong for Git sources. The value comment and the flag help both state the secret is
kubernetes.io/dockerconfigjsontype, but a GitRepository source authenticates with basic-auth (username/password) or SSH (identity/known_hosts) secrets — a dockerconfigjson secret will fail Git authentication. The PR description itself useskubectl create secret genericfor the Git example, contradicting the inline docs. Document the OCI and Git secret formats separately. Evidence: packages/core/installer/values.yaml:7-9 and cmd/cozystack-operator/main.go:114.
… source
Added --platform-source-secret flag to cozystack-operator that allows
specifying a Secret name for registry authentication. This enables using
private OCI registries and Git repositories as platform sources.
Changes:
- cmd/cozystack-operator/main.go:
- Add --platform-source-secret flag
- Pass secretName to generateOCIRepository() and generateGitRepository()
- Set spec.secretRef in generated resources when secret is specified
- packages/core/installer/values.yaml:
- Add cozystackOperator.platformSourceSecret parameter
- packages/core/installer/templates/cozystack-operator.yaml:
- Pass --platform-source-secret flag to operator container
Usage:
1. Create registry credentials secret in cozy-system namespace:
kubectl create secret docker-registry my-registry-creds \
--namespace cozy-system \
--docker-server=registry.example.com \
--docker-username=user \
--docker-password=token
2. Configure Helm values:
cozystackOperator:
platformSourceUrl: 'oci://registry.example.com/repo/packages'
platformSourceSecret: 'my-registry-creds'
Closes #2455
Signed-off-by: IvanHunters <[email protected]>
28a8029 to
0427b18
Compare
github-actions
Bot
added
area/uncategorized
- Run `go mod tidy` to move github.com/fluxcd/pkg/apis/meta from indirect to direct require: it became a direct import after the SecretRef type fix. - Refine the --platform-source-secret flag docstring and the matching values.yaml comment: drop identity.pub from the SSH required-keys list (Flux source-controller only consumes identity + known_hosts) and mention bearerToken as an alternative to username+password for Git over HTTPS. - Note in values.yaml that the Secret must exist in cozy-system before the operator reconciles; otherwise source-controller reports a failed condition until the Secret is created. Signed-off-by: Ivan Okhotnikov <[email protected]>
dosubot
Bot
added
the
area/platform
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enables authentication for platform sources by allowing users to specify a Kubernetes Secret containing credentials for private OCI or Git repositories. This change ensures that the operator can securely fetch packages from private sources while maintaining backward compatibility for public registries. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new --platform-source-secret command-line flag to the cozystack-operator to support private platform sources. When specified, this secret is set as the spec.secretRef on the generated Flux OCIRepository or GitRepository resources. The changes include updating the operator's main logic, adding corresponding unit tests, updating the Helm chart templates and values.yaml to expose this option, and promoting the github.com/fluxcd/pkg/apis/meta dependency to a direct requirement in go.mod. There are no review comments, and we have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Aleksei Sviridkin (lexfrei)
left a comment
Aleksei Sviridkin (lexfrei)
left a comment
There was a problem hiding this comment.
LGTM — all three findings from the prior review are fixed and verified (build, tests, vet, helm render all clean); the dual-model pass surfaced no new blockers.
Business context: enable a private OCI registry or Git repo as the platform source by attaching spec.secretRef to the generated Flux OCIRepository/GitRepository (closes #2455).
Verified against the current head:
- Compilation fixed — now imports
github.com/fluxcd/pkg/apis/metaand sets&fluxmeta.LocalObjectReference{Name: secretName};go build ./cmd/cozystack-operatorpasses. - Tests fixed and extended — all callers updated to the 4-arg signature, plus new
_WithSecretcases and nil assertions for the empty-secret path on both OCI and Git;go test ./cmd/cozystack-operatorpasses. - Secret-type guidance corrected — values.yaml and the flag help now document the OCI (kubernetes.io/dockerconfigjson), Git-over-HTTPS (username+password or bearerToken), and Git-over-SSH (identity + known_hosts) formats separately, matching the upstream source-controller CRD.
Also confirmed: go vet/gofmt/go mod tidy clean, go.mod correctly promotes the meta package to a direct dependency, the installer chart renders the flag only when the value is non-empty (backward compatible), and the secret namespace (cozy-system) matches where the source resource is created.
Move private-repository credential handling off a proposed PackageSourceRef.secretRef field and onto the Flux source created at tap time, matching the merged cozystack/cozystack#2472 pattern: the PackageSource reconciler only reads SourceRef to build the ArtifactGenerator and never creates the source, so the field would have had no reconcile path. Derive marketplace state from PackageSource plus ApplicationDefinition rather than a new marketplace.yaml, and align tap and untap semantics, the community index, and the validation reuse with community#12. No CRD change and no migration. Signed-off-by: IvanHunters <[email protected]>
Move private-repository credential handling off a proposed PackageSourceRef.secretRef field and onto the Flux source created at tap time, matching the merged cozystack/cozystack#2472 pattern: the PackageSource reconciler only reads SourceRef to build the ArtifactGenerator and never creates the source, so the field would have had no reconcile path. Derive marketplace state from PackageSource plus ApplicationDefinition rather than a new marketplace.yaml, and align tap and untap semantics, the community index, and the validation reuse with community#12. No CRD change and no migration. Signed-off-by: IvanHunters <[email protected]>
Summary
Implements support for private OCI registry and Git repository credentials in platform sources. Adds
--platform-source-secretflag to the operator and corresponding Helm chart parameter.Closes #2455
Changes
Operator (
cmd/cozystack-operator/main.go)--platform-source-secretflag for specifying Secret namegenerateOCIRepository()to setspec.secretRefwhen secret is providedgenerateGitRepository()to setspec.secretRefwhen secret is providedcozy-systemnamespaceHelm Chart
packages/core/installer/values.yaml: AddedcozystackOperator.platformSourceSecretparameter with documentationpackages/core/installer/templates/cozystack-operator.yaml: Pass--platform-source-secretflag to operator containerUsage Example
For private OCI registry (e.g., GitLab Container Registry):
For private Git repository:
Testing
Manually verified:
spec.secretRefwhen secret name is providedspec.secretRefwhen secret name is providedspec.secretRefwhen secret name is empty (backward compatible)platformSourceSecretparameterChecklist
Release note
Summary by CodeRabbit
New Features
Bug Fixes
Documentation