Git providers
Connect a Git provider with an OAuth application, so workspaces start from repositories.
With a Git provider, users create workspaces from repositories and push from them. Without one, workspaces start empty.
This release supports Gitea (kind: gitea).
How it works
Each user connects their account once, under Account settings → Git connections. The token stays in the platform, sealed with the master key. Workspaces never hold it: git in a workspace talks to core's git proxy, which adds the workspace owner's credentials and checks on every request that the owner may still read (or push to) the repository.
Create an OAuth application
At the provider, create an OAuth2 application with the redirect URI:
https://console.example.com/auth/git/gitea/callbackThe last path segment is the provider's id from the values below.
Store its credentials
kubectl -n harthelm-system create secret generic gitea-oauth \
--from-literal=clientID=<client id> --from-literal=clientSecret=<client secret>Add the provider
git:
providers:
- {id: gitea, kind: gitea, name: Gitea, url: https://git.example.com, existingSecret: gitea-oauth}
networkPolicy:
egress:
gitProvider: {to: [{ipBlock: {cidr: 192.0.2.20/32}}], ports: [443]}clientIDKey and clientSecretKey rename the Secret's keys. Upgrade the release.
| Value | Meaning |
|---|---|
git.providers | {id, kind, name, url, existingSecret, clientIDKey, clientSecretKey} per provider |
git.caConfigMap | A ConfigMap with an extra CA (git.caKey, default ca.crt) for a provider behind a private CA |
networkPolicy.egress.gitProvider | Where core may connect. Without to it opens port 443 to every address; the doctor warns about that |
Workspace owners
Every workspace has an owner, whose connection the git proxy uses. When the owner leaves the team, the workspace shows that it needs a new owner and the proxy refuses it until a team admin transfers the ownership. See Team administration.