You could use it as shown here:

from prefect import Flow
from prefect.storage import GitHub

flow = Flow(
    "github-flow",
    GitHub(
        repo="org/repo",                           # name of repo
        path="flows/my_flow.py",                   # location of flow file in repo
        access_token_secret="GITHUB_ACCESS_TOKEN"  # name of personal access token secret
    )
)

You can see more GitHub examples incl. KubernetesRun here: https://github.com/anna-geller/packaging-prefect-flows/tree/master/flows

Looking at the git storage doc I can’t see a way to pass a token for authentication to the git resource. Github had this env variable GITHUB_ACCESS_TOKEN but git doesn’t. Am I forced to use ssh keys considering that everything is self hosted?

then:

flow.storage = Git(git_token_secret_name="GITHUB_ACCESS_TOKEN", ...)

not sure but it seems like the default answer if I set use_local_secrets to true: https://github.com/PrefectHQ/prefect/blob/8dfa18701c2ed8705d776f4da59637b7c49b427f/src/prefect/client/secrets.py#L143

btw, for the #1 they are configured into the deployment so the pod starts with them set. I have added the config to all containers besides the postgres

HI @Anna Geller, I was able to make it work ( then it fails on another error that seems more code related) but It needed nome tricks on the deployment in order to make it run. TLDR; the agent spins up k8s jobs that download the repos. Those Jobs needs the env variables you mentioned. Long: 1. create a secret containing the GIT token (

github

) 2. Configure a config map containing the env vars you mentioned (

prefecttoml

) defining the job template:

job.yml: |
      apiVersion: batch/v1
      kind: Job
      spec:
        template:
          spec:
            containers:
              - name: flow
                env:
                - name: PREFECT__CLOUD__USE_LOCAL_SECRETS
                  value: "true"
                - name: PREFECT__CONTEXT__SECRETS__GITHUB_ACCESS_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: github
                      key: access_token

3. set the

agent:
  jobTemplateFilePath: "/root/.prefect/job.yml"

4. edit the deloyment to mount the config map as volume in the agent container (NOT supported by the helm ):

kubectl get deployments -n prefect prefect-agent  -o yaml
...
        volumeMounts:
        - mountPath: /root/.prefect/
          name: config
          readOnly: true
...
      volumes:
      - configMap:
          defaultMode: 420
          name: prefecttoml
        name: config
...

the error that I am getting now is in the retrieve task state:

Failed to retrieve task state with error: ClientError([{'message': 'Expected type UUID!, found ""; Could not parse UUID: ', 'locations': [{'line': 2, 'column': 5}], 'path': ['get_or_create_task_run_info'], 'extensions': {'code': 'INTERNAL_SERVER_ERROR', 'exception': {'message': 'Expected type UUID!, found ""; Could not parse UUID: '}}}])
Traceback (most recent call last):
  File "/usr/local/lib/python3.7/site-packages/prefect/engine/cloud/task_runner.py", line 157, in initialize_run
    map_index=context.get("map_index"),
  File "/usr/local/lib/python3.7/site-packages/prefect/client/client.py", line 1798, in get_task_run_info
    result = self.graphql(mutation)  # type: Any
  File "/usr/local/lib/python3.7/site-packages/prefect/client/client.py", line 569, in graphql
    raise ClientError(result["errors"])
prefect.exceptions.ClientError: [{'message': 'Expected type UUID!, found ""; Could not parse UUID: ', 'locations': [{'line': 2, 'column': 5}], 'path': ['get_or_create_task_run_info'], 'extensions': {'code': 'INTERNAL_SERVER_ERROR', 'exception': {'message': 'Expected type UUID!, found ""; Could not parse UUID: '}}}]