[RFC-0014] Upgrade auth

go.mod

@@ -23,18 +23,19 @@ require (
 	github.com/docker/go-units v0.5.0
 	github.com/elazarl/goproxy v1.8.4
 	github.com/fluxcd/cli-utils v1.4.0
+	github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261019184916-07ce7833ecaf
 	github.com/fluxcd/pkg/apis/event v0.32.0
-	github.com/fluxcd/pkg/apis/meta v1.35.0
+	github.com/fluxcd/pkg/apis/meta v1.36.0
 	github.com/fluxcd/pkg/artifact v0.24.0
-	github.com/fluxcd/pkg/auth v0.62.0
+	github.com/fluxcd/pkg/auth v0.63.1-0.20261019184916-07ce7833ecaf
 	github.com/fluxcd/pkg/cache v0.17.0
 	github.com/fluxcd/pkg/git v0.55.0
 	github.com/fluxcd/pkg/gittestserver v0.32.0
 	github.com/fluxcd/pkg/helmtestserver v0.44.0
 	github.com/fluxcd/pkg/http/transport v0.9.0
 	github.com/fluxcd/pkg/masktoken v0.10.0
 	github.com/fluxcd/pkg/oci v0.72.0
-	github.com/fluxcd/pkg/runtime v0.119.0
+	github.com/fluxcd/pkg/runtime v0.120.1-0.20261019184916-07ce7833ecaf
 	github.com/fluxcd/pkg/sourceignore v0.21.0
 	github.com/fluxcd/pkg/ssh v0.28.0
 	github.com/fluxcd/pkg/tar v1.3.0
@@ -326,7 +327,7 @@ require (
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/cobra v1.10.2 // indirect
 	github.com/spf13/viper v1.21.0 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.7.0 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.9.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
 	github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834 // indirect

go.sum

@@ -350,14 +350,16 @@ github.com/fluxcd/gitkit v0.6.0 h1:iNg5LTx6ePo+Pl0ZwqHTAkhbUHxGVSY3YCxCdw7VIFg=
 github.com/fluxcd/gitkit v0.6.0/go.mod h1:svOHuKi0fO9HoawdK4HfHAJJseZDHHjk7I3ihnCIqNo=
 github.com/fluxcd/pkg/apis/acl v0.12.0 h1:UWpZDqKxpKDW38wdXIMHV8Uv3POPu2vUrra0JH1frH0=
 github.com/fluxcd/pkg/apis/acl v0.12.0/go.mod h1:PJrGIu5Bw/6/siO95uhS+pi5oKSU+gVJqHqsPHb8Kok=
+github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261019184916-07ce7833ecaf h1:hAkYvuN01e6JcSubaWz39lZs6OrgCxwVfGuswD8JuPY=
+github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261019184916-07ce7833ecaf/go.mod h1:bEwkDgBjLXMVJ2BwmVbbj32PkirmNSicabgl2Jvw7Dk=
 github.com/fluxcd/pkg/apis/event v0.32.0 h1:3zyjdUspwQN+EQJPlUXwCvCMbeqtB+azlNmeenAcbuE=
 github.com/fluxcd/pkg/apis/event v0.32.0/go.mod h1:ALma8dTqo+NbI+z4BawSzt0pAPjetCSNNUSSS/9p0VU=
-github.com/fluxcd/pkg/apis/meta v1.35.0 h1:/k5d7uEFrxkz/hf6JTrdsKBr3UQWVHW2J4G6VSSae/k=
-github.com/fluxcd/pkg/apis/meta v1.35.0/go.mod h1:1MLvK2Xu3UdTKBzg+Q1Oj7H9PHeiKsUB1UW3uwxAwiM=
+github.com/fluxcd/pkg/apis/meta v1.36.0 h1:sgT0N/tXPTLYPzYjO3WHt3LKaRBOlQIP+/dTrJRzvDQ=
+github.com/fluxcd/pkg/apis/meta v1.36.0/go.mod h1:1MLvK2Xu3UdTKBzg+Q1Oj7H9PHeiKsUB1UW3uwxAwiM=
 github.com/fluxcd/pkg/artifact v0.24.0 h1:j/3JrNDThWRwtkkU9u2N7wOFkSVwZjnMYQWHNG51PEA=
 github.com/fluxcd/pkg/artifact v0.24.0/go.mod h1:D1VCIh95degPgcfOOfVmRDHRqJqgRb2Z+PCCVODcHws=
-github.com/fluxcd/pkg/auth v0.62.0 h1:ZhrkfoLTaH5Q095sNGLZ47zLYw/AHw4nVnPAspGwT/c=
-github.com/fluxcd/pkg/auth v0.62.0/go.mod h1:46lKYjDvx5Q7fsq09ZC1BxXJcstTOfm2X/NFLLFn7wA=
+github.com/fluxcd/pkg/auth v0.63.1-0.20261019184916-07ce7833ecaf h1:+R6qBa2c9Nxi/6jkzdX0K5QUC7wCYCTHTq51GFZ0KsE=
+github.com/fluxcd/pkg/auth v0.63.1-0.20261019184916-07ce7833ecaf/go.mod h1:PvYIN2/ZUbka62QGIXJ2LR4blhmmo0aCh3w9YA1vWGI=
 github.com/fluxcd/pkg/cache v0.17.0 h1:197ST7bSJD2Nw4G01y5cMjtWQpwQsyjpl2ox4MaGeU8=
 github.com/fluxcd/pkg/cache v0.17.0/go.mod h1:OW3fncHhPnPZFZav5FdEa//cyMHSndI0JS+IM69LXOU=
 github.com/fluxcd/pkg/git v0.55.0 h1:jMdW0uAYuzcwIL5rJq5pmDd+jSrgOe6eIOZfdrcAvO8=
@@ -374,8 +376,8 @@ github.com/fluxcd/pkg/masktoken v0.10.0 h1:jY9tuBIS1T7z9F8nJc9ozT0QrI391Se9vMu0e
 github.com/fluxcd/pkg/masktoken v0.10.0/go.mod h1:zOCZp3trYmD5/csLOizvIGTi4gn76nnkTFu+vKOJufo=
 github.com/fluxcd/pkg/oci v0.72.0 h1:nUTGHTd/2qq2yT66anHfXiwE19uJl6VL36zm74iFwbU=
 github.com/fluxcd/pkg/oci v0.72.0/go.mod h1:5ngbB6SDvo6daD29HZtBbC6CcnHxuI+5JJR/YqtZhKM=
-github.com/fluxcd/pkg/runtime v0.119.0 h1:cY2KpQ4WwpQKG+pFToslSIXUjKK8ckHQ7cvPUc/QHiY=
-github.com/fluxcd/pkg/runtime v0.119.0/go.mod h1:7LJFbZPXwl++ATADx6bt63Jh9CverBoXQxbluxPwspw=
+github.com/fluxcd/pkg/runtime v0.120.1-0.20261019184916-07ce7833ecaf h1:ceYaUQAHZjFEEbx0K1qPLxH9bbDxWMIHwhOip40rufo=
+github.com/fluxcd/pkg/runtime v0.120.1-0.20261019184916-07ce7833ecaf/go.mod h1:Cw0CQ/tVKS9lgJoyKVouZr1qVnoJcYnSHw3QDzIOOjA=
 github.com/fluxcd/pkg/sourceignore v0.21.0 h1:p65j81RzXAeL4KJKgbkFRou+xiA0841CUdAsOCSAb5o=
 github.com/fluxcd/pkg/sourceignore v0.21.0/go.mod h1:N9NFuxbEMm+UPtP9t+Oyx5LEs0uHu7W+WVPmdlIbCeY=
 github.com/fluxcd/pkg/ssh v0.28.0 h1:DbqDtvJGKzrSfXfB8Hi9T2mbTnNBodijpRZRfxx59wE=
@@ -903,8 +905,8 @@ github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
 github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
-github.com/spiffe/go-spiffe/v2 v2.7.0 h1:uXe1MflJoHw58wAUvxVlcM7WpKtijWG7I1UidcGh6g4=
-github.com/spiffe/go-spiffe/v2 v2.7.0/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U=
+github.com/spiffe/go-spiffe/v2 v2.9.0 h1:g5qTg3qIP1HXV+GzuyEfSJFVxUCpEP5Ui1OINVJHPB4=
+github.com/spiffe/go-spiffe/v2 v2.9.0/go.mod h1:w2CLWKLMTX/PPYUEUPv3ltH0RXsw5S8suwNF46w9/Aw=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=

internal/controller/bucket_controller.go

@@ -41,6 +41,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	cryptov1 "github.com/fluxcd/pkg/apis/crypto/v1"
 	eventv1 "github.com/fluxcd/pkg/apis/event/v1"
 	"github.com/fluxcd/pkg/apis/meta"
 	intdigest "github.com/fluxcd/pkg/artifact/digest"
@@ -132,6 +133,10 @@ type BucketReconciler struct {
 	ControllerName string
 	TokenCache     *cache.TokenCache
 
+	DefaultServiceAccount string
+
+	ObjectLevelWorkloadIdentity bool
+
 	patchOptions []patch.Option
 }
 
@@ -435,7 +440,7 @@ func (r *BucketReconciler) reconcileStorage(ctx context.Context, sp *patch.Seria
 func (r *BucketReconciler) reconcileSource(ctx context.Context, sp *patch.SerialPatcher, obj *sourcev1.Bucket, index *index.Digester, dir string) (sreconcile.Result, error) {
 	usesObjectLevelWorkloadIdentity := obj.Spec.Provider != "" && obj.Spec.Provider != sourcev1.BucketProviderGeneric && obj.Spec.ServiceAccountName != ""
 	if usesObjectLevelWorkloadIdentity {
-		if !auth.IsObjectLevelWorkloadIdentityEnabled() {
+		if !r.ObjectLevelWorkloadIdentity {
 			const gate = auth.FeatureGateObjectLevelWorkloadIdentity
 			const msgFmt = "to use spec.serviceAccountName for provider authentication please enable the %s feature gate in the controller"
 			err := fmt.Errorf(msgFmt, gate)
@@ -839,35 +844,78 @@ func (r *BucketReconciler) setupCredentials(ctx context.Context, obj *sourcev1.B
 // createBucketProvider creates a provider-specific bucket client using the given credentials and configuration.
 // It handles different bucket providers (AWS, GCP, Azure, generic) and returns the appropriate client.
 func (r *BucketReconciler) createBucketProvider(ctx context.Context, obj *sourcev1.Bucket, creds *bucketCredentials) (BucketProvider, error) {
-	authOpts := []auth.Option{
-		auth.WithClient(r.Client),
-		auth.WithServiceAccountNamespace(obj.GetNamespace()),
+	// Determine the cryptov1 service provider and resolve the ServiceAccount
+	// once, applying the default ServiceAccount when the object does not
+	// specify one. The generic provider does not support a ServiceAccount.
+	var serviceProvider string
+	switch obj.Spec.Provider {
+	case sourcev1.BucketProviderAmazon:
+		serviceProvider = cryptov1.ProviderAWS
+	case sourcev1.BucketProviderGoogle:
+		serviceProvider = cryptov1.ProviderGCP
+	case sourcev1.BucketProviderAzure:
+		serviceProvider = cryptov1.ProviderAzure
 	}
 
-	if obj.Spec.ServiceAccountName != "" {
-		authOpts = append(authOpts, auth.WithServiceAccountName(obj.Spec.ServiceAccountName))
+	var sa *corev1.ServiceAccount
+	if serviceProvider != "" {
+		saName := obj.Spec.ServiceAccountName
+		if saName == "" {
+			saName = r.DefaultServiceAccount
+		}
+		if saName != "" {
+			sa = &corev1.ServiceAccount{}
+			saRef := client.ObjectKey{Namespace: obj.GetNamespace(), Name: saName}
+			if err := r.Get(ctx, saRef, sa); err != nil {
+				return nil, fmt.Errorf("failed to get service account '%s': %w", saRef, err)
+			}
+		}
 	}
 
-	if r.TokenCache != nil {
-		involvedObject := cache.InvolvedObject{
-			Kind:      sourcev1.BucketKind,
-			Name:      obj.GetName(),
-			Namespace: obj.GetNamespace(),
-			Operation: cache.OperationReconcile,
+	var cryptoSpec *cryptov1.Spec
+	if sa != nil {
+		buildOpts := []cryptov1.Option{
+			cryptov1.WithAnnotations(sa.Annotations),
+			cryptov1.WithServiceProvider(serviceProvider),
+		}
+		if sts := obj.Spec.STS; sts != nil {
+			buildOpts = append(buildOpts, cryptov1.WithSTSEndpoint(sts.Provider, sts.Endpoint))
+		}
+		if obj.Spec.CertSecretRef != nil ||
+			(obj.Spec.STS != nil && obj.Spec.STS.CertSecretRef != nil) {
+			buildOpts = append(buildOpts, cryptov1.WithCertSecretRef())
+		}
+		var err error
+		cryptoSpec, err = cryptov1.BuildSpec(buildOpts...)
+		if err != nil {
+			return nil, fmt.Errorf("failed to build spec for service account '%s/%s': %w",
+				sa.Namespace, sa.Name, err)
 		}
-		authOpts = append(authOpts, auth.WithCache(*r.TokenCache, involvedObject))
 	}
 
+	var authOpts []auth.Option
+	if cryptoSpec != nil {
+		authOpts = auth.OptionsFromSpec(cryptoSpec.Auth)
+	}
+	authOpts = append(authOpts,
+		auth.WithClient(r.Client),
+		auth.WithObject(sourcev1.GroupVersion.Group, sourcev1.BucketKind, obj))
+	if sa != nil {
+		authOpts = append(authOpts, auth.WithServiceAccountName(sa.Name))
+	}
+	if r.TokenCache != nil {
+		authOpts = append(authOpts,
+			auth.WithCache(*r.TokenCache),
+			auth.WithCacheOperation(cache.OperationReconcile))
+	}
 	if creds.proxyURL != nil {
 		authOpts = append(authOpts, auth.WithProxyURL(*creds.proxyURL))
 	}
-
 	if obj.Spec.Region != "" {
-		authOpts = append(authOpts, auth.WithSTSRegion(obj.Spec.Region))
+		authOpts = append(authOpts, auth.WithAWSRegion(obj.Spec.Region))
 	}
-
 	if sts := obj.Spec.STS; sts != nil {
-		authOpts = append(authOpts, auth.WithSTSEndpoint(sts.Endpoint))
+		authOpts = append(authOpts, auth.WithAWSSTSEndpoint(sts.Endpoint))
 	}
 
 	switch obj.Spec.Provider {

internal/controller/bucket_controller_test.go

@@ -40,7 +40,6 @@ import (
 	"github.com/fluxcd/pkg/apis/meta"
 	intdigest "github.com/fluxcd/pkg/artifact/digest"
 	"github.com/fluxcd/pkg/artifact/storage"
-	"github.com/fluxcd/pkg/auth"
 	"github.com/fluxcd/pkg/runtime/conditions"
 	conditionscheck "github.com/fluxcd/pkg/runtime/conditions/check"
 	"github.com/fluxcd/pkg/runtime/events"
@@ -1438,16 +1437,11 @@ func TestBucketReconciler_reconcileSource_gcs(t *testing.T) {
 			}
 
 			r := &BucketReconciler{
-				Recorder:     events.NewFakeRecorder(32, false),
-				Client:       clientBuilder.Build(),
-				Storage:      testStorage,
-				patchOptions: getPatchOptions(bucketReadyCondition.Owned, "sc"),
-			}
-
-			// Handle ObjectLevelWorkloadIdentity feature gate
-			if !tt.disableObjectLevelWorkloadIdentity {
-				auth.EnableObjectLevelWorkloadIdentity()
-				t.Cleanup(auth.DisableObjectLevelWorkloadIdentity)
+				Recorder:                    events.NewFakeRecorder(32, false),
+				Client:                      clientBuilder.Build(),
+				Storage:                     testStorage,
+				patchOptions:                getPatchOptions(bucketReadyCondition.Owned, "sc"),
+				ObjectLevelWorkloadIdentity: !tt.disableObjectLevelWorkloadIdentity,
 			}
 
 			tmpDir := t.TempDir()

internal/controller/gitrepository_controller.go

@@ -49,6 +49,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	cryptov1 "github.com/fluxcd/pkg/apis/crypto/v1"
 	eventv1 "github.com/fluxcd/pkg/apis/event/v1"
 	"github.com/fluxcd/pkg/apis/meta"
 	"github.com/fluxcd/pkg/artifact/storage"
@@ -66,7 +67,6 @@ import (
 
 	sourcev1 "github.com/fluxcd/source-controller/api/v1"
 	serror "github.com/fluxcd/source-controller/internal/error"
-	"github.com/fluxcd/source-controller/internal/features"
 	sreconcile "github.com/fluxcd/source-controller/internal/reconcile"
 	"github.com/fluxcd/source-controller/internal/reconcile/summarize"
 	"github.com/fluxcd/source-controller/internal/util"
@@ -173,8 +173,11 @@ type GitRepositoryReconciler struct {
 	ControllerName string
 	TokenCache     *cache.TokenCache
 
+	DefaultServiceAccount string
+
+	ObjectLevelWorkloadIdentity bool
+
 	requeueDependency time.Duration
-	features          map[string]bool
 
 	patchOptions []patch.Option
 }
@@ -193,10 +196,6 @@ func (r *GitRepositoryReconciler) SetupWithManager(mgr ctrl.Manager, opts GitRep
 
 	r.requeueDependency = opts.DependencyRequeueInterval
 
-	if r.features == nil {
-		r.features = features.FeatureGates()
-	}
-
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&sourcev1.GitRepository{}, builder.WithPredicates(
 			predicate.Or(predicate.GenerationChangedPredicate{}, predicates.ReconcileRequestedPredicate{}),
@@ -707,45 +706,92 @@ func (r *GitRepositoryReconciler) getAuthOpts(ctx context.Context, obj *sourcev1
 	}
 
 	// Configure provider authentication if specified.
+	provider := obj.GetProvider()
+	withCerts := len(opts.ClientCert) > 0 || len(opts.ClientKey) > 0 || len(opts.CAFile) > 0
+
+	// Check the object-level workload identity feature gate for the providers
+	// that use the ServiceAccount for authentication.
+	switch provider {
+	case sourcev1.GitProviderAzure, sourcev1.GitProviderAWS:
+		if obj.Spec.ServiceAccountName != "" && !r.ObjectLevelWorkloadIdentity {
+			const gate = auth.FeatureGateObjectLevelWorkloadIdentity
+			const msgFmt = "to use spec.serviceAccountName for provider authentication please enable the %s feature gate in the controller"
+			err := serror.NewStalling(fmt.Errorf(msgFmt, gate), meta.FeatureGateDisabledReason)
+			conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, meta.FeatureGateDisabledReason, "%s", err)
+			return nil, err
+		}
+	}
+
+	// Resolve the ServiceAccount once, applying the default ServiceAccount when
+	// the object does not specify one.
+	saName := obj.Spec.ServiceAccountName
+	if saName == "" {
+		saName = r.DefaultServiceAccount
+	}
+	var sa *corev1.ServiceAccount
+	if saName != "" {
+		sa = &corev1.ServiceAccount{}
+		saRef := types.NamespacedName{Namespace: obj.GetNamespace(), Name: saName}
+		if err := r.Get(ctx, saRef, sa); err != nil {
+			e := serror.NewGeneric(
+				fmt.Errorf("failed to get service account '%s': %w", saRef, err),
+				sourcev1.AuthenticationFailedReason,
+			)
+			conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
+			return nil, e
+		}
+	}
+
+	// Build the authentication spec. This is done even when no
+	// ServiceAccount is specified, as some inputs are validated regardless.
+	var cryptoSpec *cryptov1.Spec
+	if sa != nil || (provider != "" && provider != sourcev1.GitProviderGeneric) {
+		buildOpts := []cryptov1.Option{
+			cryptov1.WithServiceProvider(provider),
+		}
+		if sa != nil {
+			buildOpts = append(buildOpts, cryptov1.WithAnnotations(sa.Annotations))
+		}
+		if withCerts {
+			buildOpts = append(buildOpts, cryptov1.WithSecretRefCerts())
+		}
+		if provider == sourcev1.GitProviderGitHub && len(authData[githubapp.KeyAppBaseURL]) > 0 {
+			buildOpts = append(buildOpts, cryptov1.WithGitHubEnterpriseServer())
+		}
+		var err error
+		cryptoSpec, err = cryptov1.BuildSpec(buildOpts...)
+		if err != nil {
+			e := serror.NewGeneric(
+				fmt.Errorf("failed to validate configuration: %w", err),
+				sourcev1.AuthenticationFailedReason,
+			)
+			conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
+			return nil, e
+		}
+	}
+
 	var getCreds func() (*auth.GitCredentials, error)
-	switch provider := obj.GetProvider(); provider {
+	switch provider {
 	// If other providers (GCP, etc.) are added in the future they can be added here separated by a comma.
 	case sourcev1.GitProviderAzure, sourcev1.GitProviderAWS:
 		getCreds = func() (*auth.GitCredentials, error) {
-			opts := []auth.Option{
+			authOpts := auth.OptionsFromSpec(cryptoSpec.Auth)
+			authOpts = append(authOpts,
 				auth.WithClient(r.Client),
-				auth.WithServiceAccountNamespace(obj.GetNamespace()),
 				auth.WithGitURL(u),
+				auth.WithObject(sourcev1.GroupVersion.Group, sourcev1.GitRepositoryKind, obj))
+			if sa != nil {
+				authOpts = append(authOpts, auth.WithServiceAccountName(sa.Name))
 			}
-
-			if obj.Spec.ServiceAccountName != "" {
-				// Check object-level workload identity feature gate.
-				if !auth.IsObjectLevelWorkloadIdentityEnabled() {
-					const gate = auth.FeatureGateObjectLevelWorkloadIdentity
-					const msgFmt = "to use spec.serviceAccountName for provider authentication please enable the %s feature gate in the controller"
-					err := serror.NewStalling(fmt.Errorf(msgFmt, gate), meta.FeatureGateDisabledReason)
-					conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, meta.FeatureGateDisabledReason, "%s", err)
-					return nil, err
-				}
-				// Set ServiceAccountName only if explicitly specified
-				opts = append(opts, auth.WithServiceAccountName(obj.Spec.ServiceAccountName))
-			}
-
 			if r.TokenCache != nil {
-				involvedObject := cache.InvolvedObject{
-					Kind:      sourcev1.GitRepositoryKind,
-					Name:      obj.GetName(),
-					Namespace: obj.GetNamespace(),
-					Operation: cache.OperationReconcile,
-				}
-				opts = append(opts, auth.WithCache(*r.TokenCache, involvedObject))
+				authOpts = append(authOpts,
+					auth.WithCache(*r.TokenCache),
+					auth.WithCacheOperation(cache.OperationReconcile))
 			}
-
 			if proxyURL != nil {
-				opts = append(opts, auth.WithProxyURL(*proxyURL))
+				authOpts = append(authOpts, auth.WithProxyURL(*proxyURL))
 			}
-
-			return authutils.GetGitCredentials(ctx, provider, opts...)
+			return authutils.GetGitCredentials(ctx, provider, authOpts...)
 		}
 	case sourcev1.GitProviderGitHub:
 		// if provider is github, but secret ref is not specified