The OCM component descriptor generates two Flux GitRepository sources that clone public github.com by commit, which forces a non-shallow fetch. On cc-d2 (platform-mesh 0.3.0) both fail with context deadline exceeded against the 60s timeout, several times a day.
Generated objects, namespace default:
gateway-api → https://github.com/kubernetes-sigs/gateway-apietcd-druid → https://github.com/gardener/etcd-druid
Both carry ref.commit, interval: 1m, timeout: 60s, no secretRef. github.com does not allow fetching an arbitrary commit (uploadpack.allowAnySHA1InWant off), so source-controller cannot --depth 1 clone — it pulls full history of both repos every minute. The clone sits right at the 60s line: mostly times out, occasionally succeeds, so it flaps red/green.
Source is .ocm/component-constructor-aggregate.yaml — the crds resource uses access.type: github with commit:. traefik in the same file already uses access.type: ociArtifact and never hits this.
Fix options, preferred first:
- serve the CRDs as an OCI artifact like
traefik, so there is no git clone
- or pin by tag instead of commit so source-controller can shallow-clone (the flux-system
gateway-api GitRepository uses tag: v1.5.1 + timeout: 5m and never fails)
- or raise the generated GitRepository
timeout to 5m
Impact is low on cc-d2 — gateway-api CRDs are applied from a separate flux-system source and etcd-druid runs off its OCIRepository — but it is constant alert noise plus a full-history clone of two repos every minute, and it will bite anywhere egress to github.com is slower.
source-controller evidence (cc-d2 platform shoot, 2026-07-16)
failed to checkout and determine revision: unable to clone 'https://github.com/kubernetes-sigs/gateway-api': context deadline exceeded
failed to checkout and determine revision: unable to clone 'https://github.com/gardener/etcd-druid': context deadline exceeded
GitRepository/default/gateway-api — ref={commit: 477d172…}, interval=1m, timeout=60s, secretRef=none
GitRepository/default/etcd-druid — ref={commit: f014482…}, interval=1m, timeout=60s, secretRef=none
recurring in the CC-D2 GitOps health monitor since ~2026-07-10; occasional successful reconciles confirm the clone is borderline against the 60s deadline rather than blocked.
The OCM component descriptor generates two Flux
GitRepositorysources that clone public github.com by commit, which forces a non-shallow fetch. On cc-d2 (platform-mesh 0.3.0) both fail withcontext deadline exceededagainst the 60s timeout, several times a day.Generated objects, namespace
default:gateway-api→https://github.com/kubernetes-sigs/gateway-apietcd-druid→https://github.com/gardener/etcd-druidBoth carry
ref.commit,interval: 1m,timeout: 60s, nosecretRef. github.com does not allow fetching an arbitrary commit (uploadpack.allowAnySHA1InWantoff), so source-controller cannot--depth 1clone — it pulls full history of both repos every minute. The clone sits right at the 60s line: mostly times out, occasionally succeeds, so it flaps red/green.Source is
.ocm/component-constructor-aggregate.yaml— thecrdsresource usesaccess.type: githubwithcommit:.traefikin the same file already usesaccess.type: ociArtifactand never hits this.Fix options, preferred first:
traefik, so there is no git clonegateway-apiGitRepository usestag: v1.5.1+timeout: 5mand never fails)timeoutto 5mImpact is low on cc-d2 — gateway-api CRDs are applied from a separate flux-system source and etcd-druid runs off its
OCIRepository— but it is constant alert noise plus a full-history clone of two repos every minute, and it will bite anywhere egress to github.com is slower.source-controller evidence (cc-d2 platform shoot, 2026-07-16)
GitRepository/default/gateway-api — ref={commit: 477d172…}, interval=1m, timeout=60s, secretRef=none
GitRepository/default/etcd-druid — ref={commit: f014482…}, interval=1m, timeout=60s, secretRef=none
recurring in the CC-D2 GitOps health monitor since ~2026-07-10; occasional successful reconciles confirm the clone is borderline against the 60s deadline rather than blocked.