Skip to content

Add ability to generate deploy keys to gitRepo controller - #354

Merged
HappyTetrahedron merged 7 commits into
masterfrom
feat/generate-deploykeys
Aug 19, 2026
Merged

Add ability to generate deploy keys to gitRepo controller#354
HappyTetrahedron merged 7 commits into
masterfrom
feat/generate-deploykeys

Conversation

@HappyTetrahedron

Copy link
Copy Markdown
Contributor

A separate field generatedDeployKeys is added to the gitRepo spec, where deploy keys can be listed without explicitly specifying a key. The gitRepo reconciler then duplicates these entries into the deployKeys field, generating a new keypair for each entry. The keypair is stored in a newly created secret.

If a secret already exists, it is not overwritten. Information from the secret takes precedence over information in the generatedDeployKeys field (this is relevant e.g. for the key type). However, secrets are not watched separately, so modifying the secret will not trigger a reconcile. (I consider this to be more of a corner case than a feature - the secret is not supposed to be edited.)

Checklist

  • Keep pull requests small so they can be easily reviewed.
  • Update the documentation.
  • Categorize the PR by setting a good title and adding one of the labels:
    bug, enhancement, documentation, change, breaking, dependency
    as they show up in the changelog

@HappyTetrahedron
HappyTetrahedron requested a review from a team August 18, 2026 09:52
@HappyTetrahedron HappyTetrahedron added the enhancement New feature or request label Aug 18, 2026
Comment thread controllers/gitrepo/steps.go Outdated
Comment thread controllers/gitrepo/steps.go Outdated
if instance.Spec.DeployKeys == nil {
instance.Spec.DeployKeys = make(map[string]synv1alpha1.DeployKey)
}
instance.Spec.DeployKeys[genKey] = synv1alpha1.DeployKey{

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd prefer tracking the generated deploy keys separately from externally provisioned deploy keys (I'd probably put the generated keys in .status.deployKeys and explicitly reference the associated secrets there).

Afaict, with the current approach, users could create chaos by requesting a generated deploy key named steward (if I read the code correctly, the generated key would win over the key supplied by steward, permanently breaking ArgoCD on such clusters).

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.
Naming conflicts are still an issue - Gitlab can in theory have multiple deploy keys with the same name, but our whole update and deletion logic relies on matching keys by name so that'll fall apart. So I decided to add a prefix to all generated keys. There's still nothing stopping the user from creating a naming conflict ... but it's less likely to happen by accident like this.

@HappyTetrahedron
HappyTetrahedron requested a review from simu August 19, 2026 09:05

@simu simu left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM overall, didn't verify test case in detail.

Some small suggestions inline.

Comment thread api/v1alpha1/gitrepo_types.go Outdated
Comment thread controllers/gitrepo/steps.go Outdated
Comment thread controllers/gitrepo/steps.go Outdated
@HappyTetrahedron
HappyTetrahedron merged commit 146a048 into master Aug 19, 2026
6 checks passed
@HappyTetrahedron
HappyTetrahedron deleted the feat/generate-deploykeys branch August 19, 2026 12:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants