feat: add mTLS certificate-based Git authentication support for TestWorkflows#6871
Open
dhimanAbhi wants to merge 2 commits intokubeshop:mainfrom
Open
feat: add mTLS certificate-based Git authentication support for TestWorkflows#6871dhimanAbhi wants to merge 2 commits intokubeshop:mainfrom
dhimanAbhi wants to merge 2 commits intokubeshop:mainfrom
Conversation
Signed-off-by: Abhishek Dhiman <abhi2002dhiman@gmail.com>
dhimanAbhi
changed the title
Signed-off-by: Abhishek Dhiman <abhi2002dhiman@gmail.com>
Collaborator
|
@greptile |
Contributor
Greptile SummaryAdded comprehensive mTLS certificate-based Git authentication support for TestWorkflows, enabling Testkube to clone repositories requiring mutual TLS authentication. Key Changes:
Issues Found:
Confidence Score: 4/5
Important Files Changed
Sequence DiagramsequenceDiagram
participant User
participant API
participant Processor
participant Resolver
participant Toolkit
participant Git
User->>API: Submit TestWorkflow with mTLS certs
API->>Resolver: Extract credentials from spec
Resolver->>Resolver: Process CaCertFrom, ClientCertFrom, ClientKeyFrom
Resolver->>API: Return externalized secrets
API->>Processor: Process TestWorkflow
Processor->>Processor: Build clone command with cert args
Processor->>Toolkit: Execute clone with -c, -e, -k flags
Toolkit->>Toolkit: Create temp files for certs/keys
Toolkit->>Toolkit: Build git config args (http.sslCAInfo, http.sslCert, http.sslKey)
Toolkit->>Git: Execute git clone with cert config
Git->>Git: Perform TLS handshake with certificates
Git-->>Toolkit: Clone complete
Toolkit->>Toolkit: Cleanup temp cert files
Toolkit-->>Processor: Success
Processor-->>API: Workflow execution complete
Last reviewed commit: e62cdc2 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
|
||
| if err := os.WriteFile(keyPath, []byte(key), 0400); err != nil { | ||
| _ = os.Remove(keyPath) | ||
| return func() {}, "", fmt.Errorf("writing SSH key: %w", err) |
Contributor
There was a problem hiding this comment.
error message says "writing SSH key" but this function is generic and used for certificates too
Suggested change
| return func() {}, "", fmt.Errorf("writing SSH key: %w", err) | |
| return func() {}, "", fmt.Errorf("writing key file: %w", err) |
Comment on lines
+255
to
+269
| if opts.ClientCert != "" && opts.ClientKey != "" { | ||
| cleanupclientCertFile, clientCertFilePath, err := CreateTempFile(opts.ClientCert, "client-cert-*") | ||
| if err != nil { | ||
| return nil, cleanupFuncs, fmt.Errorf("creating temp file for Client Certificate: %w", err) | ||
| } | ||
| certAuthArgs = append(certAuthArgs, "-c", fmt.Sprintf("http.sslCert=%s", clientCertFilePath)) | ||
| cleanupFuncs = append(cleanupFuncs, cleanupclientCertFile) | ||
|
|
||
| cleanupclientKeyFile, clientKeyFilePath, err := CreateTempFile(opts.ClientKey, "client-key-*") | ||
| if err != nil { | ||
| return nil, cleanupFuncs, fmt.Errorf("creating temp file for Client Key: %w", err) | ||
| } | ||
| certAuthArgs = append(certAuthArgs, "-c", fmt.Sprintf("http.sslKey=%s", clientKeyFilePath)) | ||
| cleanupFuncs = append(cleanupFuncs, cleanupclientKeyFile) | ||
| } |
Contributor
There was a problem hiding this comment.
if only clientCert is provided without clientKey (or vice versa), git will fail but no validation error occurs
add validation:
} else if opts.ClientCert != "" || opts.ClientKey != "" {
return nil, cleanupFuncs, fmt.Errorf("both clientCert and clientKey must be provided together")
}
vsukhin
reviewed
Feb 20, 2026
Collaborator
vsukhin
left a comment
vsukhin
left a comment
There was a problem hiding this comment.
thank you @dhimanAbhi please check my and greptile comments. Also did you test it in k8s cluster? Is size still good enough for client CRDs?
| // authorization type for the credentials | ||
| AuthType testsv3.GitAuthType `json:"authType,omitempty" expr:"template"` | ||
| // plain text CA certificate to verify repository TLS connection | ||
| CaCert string `json:"caCert,omitempty"` |
Collaborator
There was a problem hiding this comment.
why didn't you add expr metatag there?
| // plain text CA certificate to verify repository TLS connection | ||
| CaCert string `json:"caCert,omitempty"` | ||
| // external CA certificate to verify repository TLS connection | ||
| CaCertFrom *corev1.EnvVarSource `json:"caCertFrom,omitempty" expr:"force"` |
| SshKey string `json:"sshKey,omitempty"` | ||
| SshKeyFrom *EnvVarSource `json:"sshKeyFrom,omitempty"` | ||
| AuthType *ContentGitAuthType `json:"authType,omitempty"` | ||
| // plain text CA certificate to verify repository TLS connection |
Collaborator
There was a problem hiding this comment.
I don't see corresponding OpenAPI spec changes
Member
|
@dhimanAbhi waiting for your feedback on review questions |
Author
|
Hi @olensmar, thanks for the reminder. I got pulled into another task earlier, but I’ll address the requested changes and update this PR by the end of the week. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull request description
This PR adds full support for certificate-based Git authentication (mTLS) in Testkube TestWorkflows.
This addresses the missing client-certificate functionality mentioned in #4588 , enabling Testkube to clone Git repositories that require mutual TLS authentication.
New Fields Introduced
caCert: CA certificate that Testkube should trust when establishing TLS connections to the Git server.caCertFrom: External CA certificate that Testkube should trust when establishing TLS connections to the Git server.clientCert: Client certificate that the Testkube presents during TLS handshake.clientCertFrom: External Client certificate that the Testkube presents during TLS handshake.clientKey: Private key that corresponds to clientCertclientKeyFrom: External Private key that corresponds to clientCertThese fields map to git options:
-c http.sslCAInfo=<"path">
-c http.sslCert=<"path">
-c http.sslKey=<"path">
Example Testworkflow Usage
Proof Manifests
I tested this feature by setting up a local Gitea Git server and placing an Nginx reverse proxy in front of it to enforce full mTLS. The server certificate and the client certificate used by Testkube were both signed by the same CA. I created a test repository containing a Cypress test suite (copied from test/cypress/cypress-12 in the official Testkube repo), and my TestWorkflow was able to successfully authenticate with mTLS and fetch the repository contents using the new certificate fields.
Checklist (choose whats happened)
Breaking changes
Changes
Fixes