Skip to content

Introduce support for looking up GH app installation ID #1963

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
matheuscscp merged 1 commit into from
Jan 19, 2026
+16 −15
Merged

Introduce support for looking up GH app installation ID #1963

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 13 additions & 12 deletions docs/spec/v1/gitrepositories.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -346,19 +346,14 @@ The `github` provider can be used to authenticate to Git repositories using
The GitHub App information is specified in `.spec.secretRef` in the format
specified below:

- Get the App ID from the app settings page at
`https://github.com/settings/apps/<app-name>`.
- Get the App Installation ID from the app installations page at
`https://github.com/settings/installations`. Click the installed app, the URL
will contain the installation ID
`https://github.com/settings/installations/<installation-id>`. For
organizations, the first part of the URL may be different, but it follows the
same pattern.
- Get the App ID from the app settings page at `https://github.com/settings/apps/<app-name>`.
- The private key that was generated in the pre-requisites.
- (Optional) GitHub Enterprise Server users can set the base URL to
`http(s)://HOSTNAME/api/v3`.
- (Optional) If GitHub Enterprise Server uses a private CA, include its bundle (root and any intermediates) in `ca.crt`.
If the `ca.crt` is specified, then it will be used for TLS verification for all API / Git over `HTTPS` requests to the GitHub Enterprise Server.
- (Optional) If GitHub Enterprise Server uses a private CA, include its
bundle (root and any intermediates) in `ca.crt`.
If the `ca.crt` is specified, then it will be used for TLS verification
for all API / Git over `HTTPS` requests to the GitHub Enterprise Server.

**NOTE:** If the secret contains `tls.crt`, `tls.key` then [mutual TLS configuration](#https-mutual-tls-authentication) will be automatically enabled.
Omit these keys if the GitHub server does not support mutual TLS.
Expand All @@ -371,6 +366,7 @@ metadata:
type: Opaque
stringData:
githubAppID: "<app-id>"
githubAppInstallationOwner: "<github-org-or-user>"
githubAppInstallationID: "<app-installation-id>"
githubAppPrivateKey: |
-----BEGIN RSA PRIVATE KEY-----
Expand All @@ -383,14 +379,19 @@ stringData:
-----END CERTIFICATE-----
```

Exactly one of `githubAppInstallationOwner` or `githubAppInstallationID` must be provided.
If neither or both are provided, the reconciliation will fail with a misconfiguration error.
When `githubAppInstallationOwner` is provided, the controller will look for the installation
ID corresponding to the owner using the GitHub API.

Alternatively, the Flux CLI can be used to automatically create the secret with
the github app authentication information.

```sh
flux create secret githubapp ghapp-secret \
--app-id=1 \
--app-installation-id=3 \
--app-private-key=~/private-key.pem
--app-installation-owner=my-org \
--app-private-key=~/private-key.pem
```

### Service Account reference
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ require (
github.com/fluxcd/pkg/artifact v0.5.0
github.com/fluxcd/pkg/auth v0.33.0
github.com/fluxcd/pkg/cache v0.12.0
github.com/fluxcd/pkg/git v0.39.0
github.com/fluxcd/pkg/git v0.40.0
github.com/fluxcd/pkg/gittestserver v0.23.0
github.com/fluxcd/pkg/helmtestserver v0.34.0
github.com/fluxcd/pkg/http/transport v0.7.0
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -378,8 +378,8 @@ github.com/fluxcd/pkg/auth v0.33.0 h1:3ccwqpBr8uWEQgl15b7S0PwJ9EgtcKObg4J1jnaof2
github.com/fluxcd/pkg/auth v0.33.0/go.mod h1:ZAFC8pNZxhe+7RV2cQO1K9X62HM8BbRBnCE118oY/0A=
github.com/fluxcd/pkg/cache v0.12.0 h1:mabABT3jIfuo84VbIW+qvfqMZ7PbM5tXQgQvA2uo2rc=
github.com/fluxcd/pkg/cache v0.12.0/go.mod h1:HL/9cgBmwCdKIr3JH57rxrGdb7rOgX5Z1eJlHsaV1vE=
github.com/fluxcd/pkg/git v0.39.0 h1:QydLWcsOso1BkO/ctE6ELlCFkhnGwpF2dUVa+R4aLp0=
github.com/fluxcd/pkg/git v0.39.0/go.mod h1:MPhYH/ir7jr7cgQd75kWPHCGuJBu+sg7jzi0JPTSkKA=
github.com/fluxcd/pkg/git v0.40.0 h1:B23gcdNqHQcVpp9P2BU4mrfFXGA8XFYi9mpy+5RDAQA=
github.com/fluxcd/pkg/git v0.40.0/go.mod h1:MPhYH/ir7jr7cgQd75kWPHCGuJBu+sg7jzi0JPTSkKA=
github.com/fluxcd/pkg/gittestserver v0.23.0 h1:o4tb4ic2GHf2xWHTf/07w/wVLFSvbybQ9bdhtWgDnS8=
github.com/fluxcd/pkg/gittestserver v0.23.0/go.mod h1:b+rbFRu8HTtTFJ7mr437nHIO12pEodYqvQ3QUDHgFIQ=
github.com/fluxcd/pkg/helmtestserver v0.34.0 h1:a6toTMPO6WfdohrkYCrs6vwOJK4VXpODLKc5311GawY=
Expand Down