@@ -380,6 +380,18 @@ func (r *HelmRepositoryReconciler) reconcileStorage(ctx context.Context, sp *pat
380380 return sreconcile .ResultSuccess , nil
381381}
382382
383+ func (r * HelmRepositoryReconciler ) getSecret (ctx context.Context , name , namespace string ) (* corev1.Secret , error ) {
384+ key := types.NamespacedName {
385+ Namespace : namespace ,
386+ Name : name ,
387+ }
388+ var secret corev1.Secret
389+ if err := r .Get (ctx , key , & secret ); err != nil {
390+ return nil , err
391+ }
392+ return & secret , nil
393+ }
394+
383395// reconcileSource attempts to fetch the Helm repository index using the
384396// specified configuration on the v1beta2.HelmRepository object.
385397//
@@ -399,25 +411,52 @@ func (r *HelmRepositoryReconciler) reconcileSource(ctx context.Context, sp *patc
399411 helmgetter .WithPassCredentialsAll (obj .Spec .PassCredentials ),
400412 }
401413
402- // Configure any authentication related options
403- if obj .Spec .SecretRef != nil {
404- // Attempt to retrieve secret
405- name := types.NamespacedName {
406- Namespace : obj .GetNamespace (),
407- Name : obj .Spec .SecretRef .Name ,
408- }
409- var secret corev1.Secret
410- if err := r .Client .Get (ctx , name , & secret ); err != nil {
414+ getTLSConfig := func (secret * corev1.Secret ) error {
415+ var err error
416+ tlsConfig , err = getter .TLSClientConfigFromSecret (* secret , obj .Spec .URL )
417+ if err != nil {
411418 e := & serror.Event {
412- Err : fmt .Errorf ("failed to get secret '%s' : %w" , name . String () , err ),
419+ Err : fmt .Errorf ("failed to create TLS client config with secret data : %w" , err ),
413420 Reason : sourcev1 .AuthenticationFailedReason ,
414421 }
415422 conditions .MarkTrue (obj , sourcev1 .FetchFailedCondition , e .Reason , e .Err .Error ())
416- return sreconcile .ResultEmpty , e
423+ return e
424+ }
425+ return nil
426+ }
427+
428+ // Check certSecretRef first as it takes precedence over secretRef for TLS.
429+ if obj .Spec .CertSecretRef != nil {
430+ secret , err := r .getSecret (ctx , obj .Spec .CertSecretRef .Name , obj .GetNamespace ())
431+ if err != nil {
432+ e := serror .NewGeneric (
433+ fmt .Errorf ("failed to get TLS authentication secret '%s/%s': %w" , obj .GetNamespace (), obj .Spec .CertSecretRef .Name , err ),
434+ sourcev1 .AuthenticationFailedReason ,
435+ )
436+ conditions .MarkTrue (obj , sourcev1 .FetchFailedCondition , e .Reason , e .Err .Error ())
437+ return sreconcile .ResultEmpty , err
438+ }
439+
440+ if err := getTLSConfig (secret ); err != nil {
441+ // Requeue as content of secret might change
442+ return sreconcile .ResultEmpty , err
443+ }
444+ }
445+
446+ // Configure any authentication related options
447+ if obj .Spec .SecretRef != nil {
448+ secret , err := r .getSecret (ctx , obj .Spec .SecretRef .Name , obj .GetNamespace ())
449+ if err != nil {
450+ e := serror .NewGeneric (
451+ fmt .Errorf ("failed to get authentication secret '%s/%s': %w" , obj .GetNamespace (), obj .Spec .SecretRef .Name , err ),
452+ sourcev1 .AuthenticationFailedReason ,
453+ )
454+ conditions .MarkTrue (obj , sourcev1 .FetchFailedCondition , e .Reason , e .Err .Error ())
455+ return sreconcile .ResultEmpty , err
417456 }
418457
419458 // Construct actual options
420- opts , err := getter .ClientOptionsFromSecret (secret )
459+ opts , err := getter .ClientOptionsFromSecret (* secret )
421460 if err != nil {
422461 e := & serror.Event {
423462 Err : fmt .Errorf ("failed to configure Helm client with secret data: %w" , err ),
@@ -429,15 +468,17 @@ func (r *HelmRepositoryReconciler) reconcileSource(ctx context.Context, sp *patc
429468 }
430469 clientOpts = append (clientOpts , opts ... )
431470
432- tlsConfig , err = getter .TLSClientConfigFromSecret (secret , obj .Spec .URL )
433- if err != nil {
434- e := & serror.Event {
435- Err : fmt .Errorf ("failed to create TLS client config with secret data: %w" , err ),
436- Reason : sourcev1 .AuthenticationFailedReason ,
471+ if tlsConfig == nil {
472+ if err := getTLSConfig (secret ); err != nil {
473+ // Return err as the content of the secret may change.
474+ return sreconcile .ResultEmpty , err
475+ }
476+ // If we constructed a TLS config using the secret specified in `.spec.secretRef`,
477+ // then alert users that this behavior is deprecated.
478+ if tlsConfig != nil {
479+ r .Event (obj , "Warning" , "DeprecatedBehaviorReason" ,
480+ "specifying TLS authentication data via `.spec.secretRef` is deprecated, please use `.spec.certSecretRef` instead" )
437481 }
438- conditions .MarkTrue (obj , sourcev1 .FetchFailedCondition , e .Reason , e .Err .Error ())
439- // Requeue as content of secret might change
440- return sreconcile .ResultEmpty , e
441482 }
442483 }
443484
0 commit comments