You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "electrical (via GitHub)" <gi...@apache.org> on 2026/03/10 10:39:18 UTC
[I] Gitsync fails to read new credentials when using ESO Github token generator [airflow]
electrical opened a new issue, #63253:
URL: https://github.com/apache/airflow/issues/63253
### Description
We use Github for our git repos.
To provide access from airflow we use External Secrets Operator to manage this using GithubAccessToken that uses a github app to create the access token.
This token only lives for 1 hour maximum.
Because of this lifespan, The gitsync container needs to re-read the secret to have the new token.
Unfortunately it seems that gitsync doesn't support re-reading the secret while it's running.
This causes it to fail the sync, exit and restarts.
Thankfully it will restart fine and syncs again.
### Use case/motivation
Gitsync project have released a new feature https://github.com/kubernetes/git-sync/pull/976 that allows for reading a file that contains the password and re-read it at each sync loop
Env vars are only set at startup time so won't detect a change, therefor the secret will have to be mounted inside the container which I think should allow for accepting token rotations?
### Related issues
_No response_
### Are you willing to submit a PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Gitsync fails to read new credentials when using ESO Github token generator [airflow]
Posted by "sidshas03 (via GitHub)" <gi...@apache.org>.
sidshas03 commented on issue #63253:
URL: https://github.com/apache/airflow/issues/63253#issuecomment-4030551180
Hi @electrical, thanks for raising this. I checked the flow, and issue is valid: with `dags.gitSync.credentialsSecret` the token goes as env var (`GITSYNC_PASSWORD`), so after ESO rotates it, running git-sync pod will not pick new value until restart. Better fix is to support secret file mount + `GITSYNC_PASSWORD_FILE` (file-based auth), so git-sync can read rotated token in sync loop without crashing/restarting. I can raise a PR with backward-compatible chart changes for this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Gitsync fails to read new credentials when using ESO Github token generator [airflow]
Posted by "electrical (via GitHub)" <gi...@apache.org>.
electrical commented on issue #63253:
URL: https://github.com/apache/airflow/issues/63253#issuecomment-4030631817
@sidshas03 Thank you so much for looking into this so quickly. Looking forward to the fix. Happy to do any testing if needed in our deployment for validation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org