flux create secret git fails for HTTPS without --username

For HTTPS git sources, flux create secret git requires both --username and --password - a token alone is not enough, and the controller reads exactly those two keys. Pass any username (the token is what matters) with the token as --password. For GitHub that is your username plus a classic token with repo scope.

The error

(flux create secret git refuses HTTPS without a username, or the source fails auth with a password-only secret)

What to do

1. Create the secret with both fields:

flux create secret git [name] --namespace flux-system \
  --url=https://github.com/[org]/[repo] \
  --username [github-user] --password [token]

Expected: Secret created.

2. Verify the keys:

kubectl -n flux-system get secret [name] -o jsonpath='{.data}' | tr ',' '\n'

Expected: Shows username and password keys.

3. Reference it from the GitRepository secretRef and reconcile. Expected: Source authenticates and goes Ready.

When this applies

• flux create secret git for HTTPS remotes
• password-only secrets that fail auth
• GitHub/GitLab HTTPS sources

When it does NOT apply

• SSH git sources (use --private-key-file instead)
• already-correct secrets failing for other reasons

Works with

flux CLI 2.x

token-only secret works with plain git but not flux

Plain git accepts token-as-username tricks; the controller wants the literal keys. Same fix.

Why it happens

source-controller's git client does HTTP basic auth with the secret's username and password keys. A secret missing username has no complete credential, so auth fails even when the token is valid.

Edge cases

• The username value is ignored by GitHub when a token is the password - any non-empty username works.
• Rotate by recreating the secret and reconciling; the controller picks up the new secret on the next interval.

Resolved from

gh:fluxcd/flux2#778 - https://github.com/fluxcd/flux2/issues/778