How to add gitlab token for dag.gitsync on flux deployment?

[LeducH]

TL;DR
I'm trying to use a GitLab repository for my DAGs in Airflow.

Currently, I'm using a plain text token in the repository URL, which I feel isn't the best approach. However, I've encountered an issue: the DAGs aren't appearing or executing in the Airflow web interface as I expected.

I've gone through the documentation and noticed there are fields for HTTP that use a GitHub token. However, my setup is on GitLab. Here's the snippet of the configuration I'm referring to:

httpSecret: "airflow-http-git-secret"
httpSecretUsernameKey: "username"
httpSecretPasswordKey: "password"

I also attempted to use a secrets file, as suggested in the documentation:

kubectl apply -f <filename>.yaml

Unfortunately, this didn't resolve the issue either because I there was a problem with the injection.

I gave the token all the necessary access right and I am able to pull the repo as well.

Could someone kindly guide me on how to correctly set this up? Ideally, I'd like to avoid having the token as plain text in the URL. Perhaps injecting it using Kubernetes secrets?

For additional context, I'm deploying my instance with Flux on a K3s cluster. You can find all my configuration details further below.

Thanks in advance for your help and insights!

flux check
► checking prerequisites
✔ Kubernetes 1.25.12+k3s1 >=1.25.0-0
► checking controllers
✔ helm-controller: deployment ready
► ghcr.io/fluxcd/helm-controller:v0.36.1
✔ kustomize-controller: deployment ready
► ghcr.io/fluxcd/kustomize-controller:v1.1.0
✔ notification-controller: deployment ready
► ghcr.io/fluxcd/notification-controller:v1.1.0
✔ source-controller: deployment ready
► ghcr.io/fluxcd/source-controller:v1.1.1
► checking crds
✔ alerts.notification.toolkit.fluxcd.io/v1beta2
✔ buckets.source.toolkit.fluxcd.io/v1beta2
✔ gitrepositories.source.toolkit.fluxcd.io/v1
✔ helmcharts.source.toolkit.fluxcd.io/v1beta2
✔ helmreleases.helm.toolkit.fluxcd.io/v2beta1
✔ helmrepositories.source.toolkit.fluxcd.io/v1beta2
✔ kustomizations.kustomize.toolkit.fluxcd.io/v1
✔ ocirepositories.source.toolkit.fluxcd.io/v1beta2
✔ providers.notification.toolkit.fluxcd.io/v1beta2
✔ receivers.notification.toolkit.fluxcd.io/v1
✔ all checks passed

% cat repo.yaml
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: airflow
  namespace: flux-system
spec:
  interval: 1h
  url: https://airflow.apache.org

% cat release.yaml
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: airflow
  namespace: default
spec:
  interval: 1h
  chart:
    spec:
      chart: airflow
      version: 1.10.0
      sourceRef:
        kind: HelmRepository
        name: airflow
        namespace: flux-system
  values:
    dags:
       gitSync:
         enabled: true
         repo: https://oath2:<token>@gitlab.instance.example/group/airflow-dag-test.git
         branch: main
         depth: 1
         subpath: dags
    createUserJob:
      useHelmHooks: false
      applyCustomEnv: false
    migrateDatabaseJob:
      useHelmHooks: false
      applyCustomEnv: false

cat secret.yaml
---
apiVersion: v1
kind: Secret
metadata:
  namespace: default
  name: airflow-git-sync-secret
stringData:
  GIT_REPO_URL: https://oath2:<token>@gitlab.instance.example/group/airflow-dag-test.git