Is it safe to rename Git repository specified in GitRepository?

[mloskot]

I have a Git repository hosted on GitHub.
I would like to rename it within the same organization.

In theory, I should not need to change the url in the GitRepository spec, because all existing information, with the exception of project site URLs, is automatically redirected to the new name. Am I correct?

However, to keep things clean, I would like to update the url in the GitRepository manifest:

apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
spec:
  url: ssh://[email protected]/contoso/abc.git  # rename to github.com/contoso/xyz.git
  ...

Is this as trivial and Flux will simply re-fetch from the new URL and continue its business as nothing happened?

Or, should I prepare for anything unexpected like deleting deployments, re-fetching from Git, re-creating deployments?

The only discussion about renaming anything w.r.t. GitRepository that I found is this #3230, but it asks about renaming a Kustomization too what is not my case, and remains unanswered.

[stefanprodan]

Is this as trivial and Flux will simply re-fetch from the new URL and continue its business as nothing happened?

Yes but you need to update the SSH private key to match the new repo deploy key, GitHub does not allow the reuse of deploy keys.

[matheuscscp]

Also, even if your GitRepository fails to sync for a while, your Kustomization won't do anything until the source is fixed, so it's safe.

[mloskot]

Excellent!

you need to update the SSH private key to match the new repo deploy key

Thank you for this remark, easily to be forgotten indeed.

How I deploy Flux?

To clarify my specific context,
I generate the key with Terraform, add it to GitHub repository and cache it in Azure Key Vault:

resource "tls_private_key" "github_repository_deploy_key" {
  algorithm   = "ECDSA"
  ecdsa_curve = "P256"
}
resource "github_repository_deploy_key" "gitops" {
  key        = tls_private_key.github_repository_deploy_key.public_key_openssh
  ...
}
resource "azurerm_key_vault_secret" "gitops_github_repository_deploy_key_private" {
  value        = tls_private_key.github_repository_deploy_key.private_key_pem
  ..
}

Then, I create Kubernetes secret with the key by importing it from Azure Key Vault into Kubernetes with https://external-secrets.io

Finally, I deploy Flux with Terraform specifying the key read from the Azure Key Vault:

provider "flux" {
  git = {
    url = "ssh://[email protected]/contoso/abc.git"
    ssh = {
      private_key = data.azurerm_key_vault_secret.gitops_github_repository_deploy_key_private.value
      username    = "git"
    }
  }
  kubernetes = {
    ...
  }
}

resource "flux_bootstrap_git" "flux" {
  namespace = kubernetes_namespace_v1.flux.metadata[0].name
  version   = "v${var.flux.version}"

  # Tell Flux to use pre-deployed Kubernetes Secret created by External Secrets
  # with GitHub deploy key sourced from Azure Key Vault.
  disable_secret_creation = true
  secret_name             = local.flux_github_secret
  ...
}

So, I'm hoping this is all I do to succeed:

1. Trigger re-creation of the tls_private_key.github_repository_deploy_key resource
2. Change url = "ssh://[email protected]/contoso/abc.git to refer to contoso/xyz.git
3. terraform plan && terraform apply

BTW, I've just learned about the Flux Operator and I'm realising I should consider migrating to it.

Thanks!

[mloskot]

UPDATE: Sorry for incomplete explanation above,, I've just corrected explanation of my Flux deployment.