2.43.0 sources - re-use existing credentials?

[mortenmoulder]

Ask a Question!

Before updating to 2.43.0, I could simply create a new stack, point it at a GitHub repository, use my existing GitHub credentials, and it just worked. After 2.43.0 with the new Sources page, I have to re-enter my GitHub username and token, which means I now have to go and create a token for each repository and have to deal with X amount of re-roll of tokens, when they expire.

Is this the intended behavior? I am not going to keep a copy of my token laying around in plain text, so that I can re-use the same token and only have to roll it once.

[Nick-Portainer]

Hi,

Thanks for the detail, this helps clarify things.

The re-entry you're seeing is expected on Community Edition. CE has never supported saved or reusable Git credentials, so each stack (or each Source) needs its own set of credentials entered directly. This isn't a regression introduced by the new Sources page in 2.43.0, it's a longstanding CE limitation that the new page doesn't change.

Reusable, saved Git credentials (referenced by name across stacks, rather than re-entered each time) are a Business Edition feature, under Settings > Shared credentials. That's confirmed here: https://docs.portainer.io/admin/settings/credentials

So on CE, the practical options are:

1. Use a single GitHub token with access to all the repositories you deploy from, rather than one token per repo. That way you only re-roll one token when it expires.
2. Move to Business Edition, where the token is stored once as a Shared credential and referenced across stacks and Sources without retyping it.

[mortenmoulder]

Hey Nick and thanks for the reply! I'm using BE and was simply stating that I was previously able to simply point it at a GitHub repository, select my saved GitHub credentials, and it just worked. That was in 2.42.x.

Unfortunately Settings -> Shared Credentials does not include Git anymore. It's removed from the documentation you sent, if you point the version at 2.43.0 instead of 2.39.0. I can confirm on my running 2.43.0 instance that it's removed as well, so it's not the documentation that is wrong.

The way I see it, this might even be a bug, as I'm having a hard time understanding why Git was removed as a shared (or rather saved) credential. My old stacks were migrated from using one shared Git credential, to having one credential per stack (with the same value at the moment, because they were migrated).

I don't see how it's possible in 2.43.0 using BE to reuse a Git credential across stacks. When adding a new source, it's only possible to input values - not select from saved credentials (because these don't even exist anymore).

[Nick-Portainer]

Hey @mortenmoulder,

Thanks for clarifying, and you’re right. My first reply was based on how this worked previously with Shared Credentials, but that changed in 2.43.0 with the introduction of GitOps Sources. https://docs.portainer.io/sts/user/app-delivery/sources/add-a-new-source/add-a-new-git-repository-source

In 2.43.0, Git credentials have moved from Settings > Shared credentials into GitOps Sources. Existing Git credentials should have been migrated into GitOps Sources, and when creating a new stack that uses the same Git repository, you should be able to select the existing GitOps Source from the dropdown once it loads.

However, the important change is that a GitOps Source is tied to a specific Git repository. So if you deploy stacks from multiple repositories, you currently need to create a separate GitOps Source for each repository. That means re-entering the Git username/token when adding each new repository source, even if the same GitHub PAT is being used.

So your understanding is correct: previously, you could reuse one saved Git credential across multiple repositories. In 2.43.0, the model is now repository-based via GitOps Sources, so the workflow is different.

I can see how this would be confusing, especially as Git credentials no longer appear under Shared Credentials and there is not currently an in-app message directing users to GitOps Sources. I’ll raise this internally so we can improve the messaging around the change.

More details are explained in our FAQ - https://docs.portainer.io/sts/faqs/troubleshooting/stacks-deployments-and-updates/what-changed-with-git-credentials-with-the-introduction-of-gitops-sources

[mortenmoulder]

Hi @Nick-Portainer and thanks for the reply. But oh no, I was hoping this was simply a bug or an oversight. Now I have to manage one Git credential per repository, and since it's quite normal to split your projects into many repositories, this now means I need to manage 10+ credentials that do the exact same thing. So instead of rolling one credential and updating it once it expires, I now need to do that same exact task 10+ times.

Was this really the intention? I get why it's nice to have, because security wise you can create one for each repository and roll individual ones.. but you could do that before as well, which is why this is a huge downgrade for someone like me. I don't see why we can't have both options.

[Nick-Portainer]

Hey @mortenmoulder,

You've read it correctly, and your frustration is fair. Repository-scoped Sources work well for a single repo, but turn into ten-plus credentials holding the same PAT for anyone splitting across many. That wasn't meant to remove the reuse option for people who relied on it.

We're planning to bring reusable/shared Git credentials back, so you can save one credential and reference it across multiple Sources. No firm version yet, but I'll update this thread once it lands.

[Nick-Portainer]

internal ref: BE-13195

[mortenmoulder]

Sweet, @Nick-Portainer ! Thank you very much. Will be looking forward to that update in the future 😄