Skip to content

Helm chart: Git-sync v4 incorrect mix of branch, ref, rev #42918

Open

Description

@yehoshuadimarsky

Official Helm Chart version

1.15.0 (latest released)

Apache Airflow version

2.5.3

Kubernetes Version

1.30.4-gke.1348000

Helm Chart configuration

dags:
  gitSync:
    branch: main
    rev: HEAD
    ref: v1.2.3
    repo: git@github.com:<ORG>/<REPO>.git
    depth: 1
    enabled: true
    sshKeySecret: <my-key>
    subPath: src/<MY>/<PATH>
    knownHosts: |
      github.com ssh-rsa <KEY>

Docker Image customizations

No response

What happened

I pushed code to the main branch, and this was picked up by the gitSync sidecar and it updated the Airflow Dags to use the new code

What you think should happen instead

It should not have updated the code, because the ref is "frozen" to version v1.2.3. This is a production environment, and that's the whole reason I froze it by pointing it at a Git tag - so that pushing new code won't automatically deploy until it is reviewed/tagged/released.

How to reproduce

  1. Have your git repo have a branch named main, and a tag named v1.2.3 that points to main.
  2. Set this in your values.yaml
images:
 gitSync:
   repository: registry.k8s.io/git-sync/git-sync
   tag: v4.1.0
dags:
 gitSync:
   branch: main
   rev: HEAD
   ref: v1.2.3
   repo: git@github.com:<ORG>/<REPO>.git
   enabled: true
  1. Deploy this
  2. Make a new commit to the main branch, and push it
  3. You will see that the gitSync container updates the code with the new commit, even though it is supposed to be "frozen" to v1.2.3

Anything else

I dug into this, and it's caused by incorrectly mapping 3 parameters to the gitSync container. The latest Helm chart (v1.15) by default uses this image

airflow/chart/values.yaml

Lines 124 to 127 in ff7463b

gitSync:
repository: registry.k8s.io/git-sync/git-sync
tag: v4.1.0
pullPolicy: IfNotPresent

which I believe is from this source code here https://github.com/kubernetes/git-sync/tree/v4.1.0.

The 3 incorrect params are:

  • branch
  • rev
  • ref

In v4.x of gitSync, the params branch and rev are deprecated, and only ref should be used. But if any of the deprecated params are specified, they override ref, which was the root cause of my issue.

These are explicitly marked as deprecated (from v3 to v4) in the migration guide here, and inspecting the source code you can see they are:

I fixed it using a hack, by setting branch and rev to empty strings, but this is not ideal.

Are you willing to submit PR?

  • Yes I am willing to submit a PR!

Code of Conduct

Activity

  1. potiuk commented on Oct 13, 2024

    @potiuk
    Member

    Nice. Feel free to make PR to fix it

  2. cjj1120 commented on May 27, 2025

    @cjj1120

    Faced the same issue. In my case I declared the branch under ref and branch as workaround:

    # Git sync 4.X
    dags:
      mountPath: /opt/airflow/xxx/xxx
      persistence:
        enabled: false
      gitSync:
        enabled: true
        subPath: dags
        repo: "https://github.com/xxx.git"
        ref: dev # The newer Git sync versions use --ref instead of --branch
        branch: dev
        maxFailures: 2
        credentialsSecret: airflow-xxx
        period: 15s
        wait: 15
        envFrom: ~
        containerName: git-sync
        uid: 65533
        extraVolumeMounts: []
        env:
          # - name: GITSYNC_VERBOSE
          #   value: "9" # TEST (DEBUGGING MODE)
          - name: GITSYNC_TIMEOUT
            value: "30"
        resources:
          requests:
            cpu: 100m
            memory: 256Mi
          limits:
            cpu: 200m
            memory: 256Mi
    
  3. potiuk commented on Mar 2, 2026

    @potiuk
    Member

    @yehoshuadimarsky We are unassigning you from this issue as part of our updated assignment policy.

    This is not meant to discourage your contribution — quite the opposite! You are still very welcome to work on this issue and submit a PR for it. Simply comment that you are working on it and open a PR when ready.

    We found that formal assignments were not working well, as they often prevented others from contributing when the assignee was not actively working on the issue.

  4. Miretpl commented on Sep 9, 2026

    @Miretpl
    Contributor

    To anyone who would like to start working on it - in the Helm Chart 2.0 (main branch) we will drop GitSync, so there is no need for this change there.

    To fix this issue for the 1.2x line, it would require separation between v3 and v4 of GitSync. There were multiple attempts in the past, and all of them were breaking changes, which we can not merge into the non-major release. Because of that, I would say that it is unlikely for this issue to be fixed, and I would encourage anyone needed it to move to the GitDagBundle setup. If someone does that, we as maintainers would really appreciate the PR with documentation on how to move from GitSync to GitDagBundle.

  5. added a commit that references this issue on Sep 13, 2026
    06b5abf
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions