fix: universal fallback mechanism to read git credentials by j-zimnowoda · Pull Request #3438 · linode/apl-core

j-zimnowoda · 2026-07-10T12:26:23Z

📌 Summary

Make restoring git credentials universal (i.e.: support migration one external (BYO git) and internal git repository (Gitea).

Delete apl-operator Deployment, so the upgradeStrategy immutable field can be changed.

🔍 Reviewer Notes

Tested with BYO git, where branch not main

🧹 Checklist

Code is readable, maintainable, and robust.
Unit tests added/updated

Copilot

Pull request overview

Updates the legacy Git-credentials fallback path so components can retrieve repo credentials from Argo CD resources when the consolidated apl-secrets/apl-git-config Secret is not available.

Changes:

Switches legacy credential lookup to read from the argocd/argocd-repo-creds-git Secret.
Adds a lookup of the otomi/otomi-api ConfigMap to derive a fallback git branch value.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

    it('should return undefined when secret does not exist', async () => {
      mockGetK8sSecret.mockResolvedValue(undefined)
      const result = await getOldGitCredentials()
      expect(result).toEqual(undefined)
    })


Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

merll · 2026-07-11T10:55:39Z

+export async function deleteAplOperatorDeployment(appApi: AppsV1Api): Promise<void> {
+  // Due to update of the immutable Deployment field. spec.upgradeStrategy.
+  const d = terminal('deleteAplOperatorDeployment')
+  try {
+    await appApi.deleteNamespacedDeployment({ name: 'apl-operator', namespace: 'apl-operator' })
+    d.info('Deleted apl-operator deployment in apl-operator namespace')
+  } catch (error) {
+    d.error('Error deleting apl-operator deployment:', error)
+  }
+}


Usually I would agree, but it is rather unlikely the deployment does not exist when apl-operator runs this code.

merll · 2026-07-11T11:04:12Z

+      'apl-operator-apl-operator': {
+        post: async () => {
+          await deleteAplOperatorDeployment(k8s.app())
+        },
+      },


In a post-upgrade it is probably less likely to interrupt before the completion of the upgrade, but it still could before the state is updated. That would mean that this step could run repeatedly. I would suggest checking on the current upgradeStrategy before deleting the deployment.

+  const cm = await getK8sConfigMap('otomi', 'otomi-api', k8s.core())
+  const gitBranch = cm?.data?.GIT_BRANCH || GIT_DEFAULT_CONFIG.branch


Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

+  let secretData = await getK8sSecret('argocd-repo-creds-git', 'argocd')
+  if (!secretData) {
+    secretData = await getK8sSecret('argocd-repo-creds-gitea', 'argocd')
  }
-  secretData = await getK8sSecret('gitea-admin-secret', 'gitea')
-  if (secretData?.password) {
-    return {
-      ...GIT_LEGACY_CONFIG,
-      username: secretData.username,
-      password: secretData.password,
-    }
+  // With BYO, `url` contains the full repo URL; otherwise fall back to the legacy Gitea URL
+  const repoUrl = secretData?.url || GIT_LEGACY_CONFIG.repoUrl
+


+      'apl-operator-apl-operator': {
+        post: async () => {
+          await deleteAplOperatorDeployment(k8s.app())
+        },
+      },


+export async function deleteAplOperatorDeployment(appApi: AppsV1Api): Promise<void> {
+  // Due to update of the immutable Deployment field. spec.upgradeStrategy.
+  const d = terminal('deleteAplOperatorDeployment')
+  try {
+    await appApi.deleteNamespacedDeployment({ name: 'apl-operator', namespace: 'apl-operator' })
+    d.info('Deleted apl-operator deployment in apl-operator namespace')
+  } catch (error) {
+    d.error('Error deleting apl-operator deployment:', error)
+  }
+}


+export async function deleteAplOperatorDeployment(appApi: AppsV1Api): Promise<void> {
+  // Due to update of the immutable Deployment field. spec.upgradeStrategy.
+  const d = terminal('deleteAplOperatorDeployment')
+  try {
+    await appApi.deleteNamespacedDeployment({ name: 'apl-operator', namespace: 'apl-operator' })
+    d.info('Deleted apl-operator deployment in apl-operator namespace')
+  } catch (error) {
+    d.error('Error deleting apl-operator deployment:', error)
+  }
+}


+    it('should fall back to legacy gitea secret when git secret is missing', async () => {
+      mockGetK8sSecret.mockResolvedValueOnce(undefined).mockResolvedValueOnce({
+        url: 'http://gitea-http.gitea.svc.cluster.local:3000/otomi/values.git',
+        username: 'otomi-admin',
+        password: 'oldpass',
+      })
+      mockGetK8sConfigMap.mockResolvedValue({ data: { GIT_BRANCH: 'main' } })
+
+      const result = await getOldGitCredentials()
+      expect(result).toEqual({
+        repoUrl: 'http://gitea-http.gitea.svc.cluster.local:3000/otomi/values.git',
+        username: 'otomi-admin',
+        password: 'oldpass',
+        branch: 'main',
+      })
+      expect(mockGetK8sSecret).toHaveBeenNthCalledWith(1, 'argocd-repo-creds-git', 'argocd')
+      expect(mockGetK8sSecret).toHaveBeenNthCalledWith(2, 'argocd-repo-creds-gitea', 'argocd')
+    })


    it('should return undefined when secret does not exist', async () => {
      mockGetK8sSecret.mockResolvedValue(undefined)
      const result = await getOldGitCredentials()
      expect(result).toEqual(undefined)
+      expect(mockGetK8sSecret).toHaveBeenNthCalledWith(1, 'argocd-repo-creds-git', 'argocd')
+      expect(mockGetK8sSecret).toHaveBeenNthCalledWith(2, 'argocd-repo-creds-gitea', 'argocd')
+    })


merll · 2026-07-11T10:54:06Z

  return null
 }

+export async function deleteAplOperatorDeployment(appApi: AppsV1Api): Promise<void> {


This function is not really Istio-related, as the module name suggests. Should we move it to somewhere more generic?

merll · 2026-07-11T11:39:49Z

I generally agree with the change, I am just wondering if there is one source (or two resources in the same namespace) where we could obtain the credentials from.

fix: universal fallback mechanism to read git credentials

2c1c036

j-zimnowoda requested a review from Copilot July 10, 2026 12:26

Copilot started reviewing on behalf of j-zimnowoda July 10, 2026 12:26 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Comment thread src/common/git-config.ts

j-zimnowoda and others added 3 commits July 10, 2026 14:41

fix: set correct properties

82e20d6

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

fix: universal fallback mechanism to read git credentials

b55997d

test: fix

3ce61e8

j-zimnowoda marked this pull request as ready for review July 10, 2026 13:00

j-zimnowoda requested review from CasLubbers and ferruhcihan as code owners July 10, 2026 13:00

Copilot AI review requested due to automatic review settings July 10, 2026 13:00

Copilot started reviewing on behalf of j-zimnowoda July 10, 2026 13:01 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Comment thread src/common/git-config.ts

Comment thread src/common/git-config.test.ts

fix: . fallback to argocd-repo-creds-gitea

004aa3c

Copilot AI review requested due to automatic review settings July 10, 2026 13:48

Copilot started reviewing on behalf of j-zimnowoda July 10, 2026 13:49 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

test: fix

0bc6ac6

Copilot AI review requested due to automatic review settings July 10, 2026 13:56

Copilot started reviewing on behalf of j-zimnowoda July 10, 2026 13:57 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Comment thread src/common/git-config.ts

Comment thread src/common/git-config.test.ts

fix: deleteAplOperatorDeployemnt

9b9616b

Copilot AI review requested due to automatic review settings July 10, 2026 14:14

Copilot started reviewing on behalf of j-zimnowoda July 10, 2026 14:14 View session

fix: repourl

eda5aac

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 10, 2026 14:20

Copilot started reviewing on behalf of j-zimnowoda July 10, 2026 14:21 View session

fix: deleteAplOperatorDeployemnt

a0266e9

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Comment thread src/common/runtime-upgrades/runtime-upgrades.ts Outdated

Comment thread src/common/git-config.ts

Comment thread src/common/runtime-upgrades/restart-istio-sidecars.ts Outdated

Copilot AI review requested due to automatic review settings July 10, 2026 14:25

fix: deleteAplOperatorDeployemnt

f09000b

Copilot started reviewing on behalf of j-zimnowoda July 10, 2026 14:25 View session

fix: Potential fix for pull request finding

678e82d

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 10, 2026 14:31

Copilot started reviewing on behalf of j-zimnowoda July 10, 2026 14:32 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

merll reviewed Jul 11, 2026

View reviewed changes

		const cm = await getK8sConfigMap('otomi', 'otomi-api', k8s.core())
		const gitBranch = cm?.data?.GIT_BRANCH \|\| GIT_DEFAULT_CONFIG.branch

Uh oh!

Conversation

j-zimnowoda commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📌 Summary

🔍 Reviewer Notes

🧹 Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

merll Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

merll Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

merll Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

j-zimnowoda Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

merll commented Jul 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

j-zimnowoda commented Jul 10, 2026 •

edited

Loading