Spring Cloud Config Server连接Git仓库报git-upload-pack not permitted问题求助

核心报错特征 #

抛出org.eclipse.jgit.api.errors.TransportException: git-upload-pack not permitted异常，健康检查返回配置服务状态为DOWN，提示无法克隆或检出仓库。

已提供的参考信息 #

异常栈日志 #

2021-10-06 22:52:51.763  INFO 1 --- [nio-8080-exec-1] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring DispatcherServlet 'dispatcherServlet'
2021-10-06 22:52:51.764  INFO 1 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'
2021-10-06 22:52:51.765  INFO 1 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet        : Completed initialization in 1 ms
2021-10-06 22:52:54.769  WARN 1 --- [nio-8080-exec-1] .c.s.e.MultipleJGitEnvironmentRepository : Error occured cloning to base directory.

org.eclipse.jgit.api.errors.TransportException: https://github.asdf.asdf.asdf.com/asdfad/sdasdf: git-upload-pack not permitted on 'https://github.asdf.asdf.adsf.com/sdfdf/asdfsad-configs/'
    at org.eclipse.jgit.api.FetchCommand.call(FetchCommand.java:254) ~[org.eclipse.jgit-5.1.3.201810200350-r.jar!/:5.1.3.201810200350-r]
    at org.eclipse.jgit.api.CloneCommand.fetch(CloneCommand.java:306) ~[org.eclipse.jgit-5.1.3.201810200350-r.jar!/:5.1.3.201810200350-r]
    at org.eclipse.jgit.api.CloneCommand.call(CloneCommand.java:200) ~[org.eclipse.jgit-5.1.3.201810200350-r.jar!/:5.1.3.201810200350-r]
    at org.springframework.cloud.config.server.environment.JGitEnvironmentRepository.cloneToBasedir(JGitEnvironmentRepository.java:612) [spring-cloud-config-server-3.0.4.jar!/:3.0.4]
    at org.springframework.cloud.config.server.environment.JGitEnvironmentRepository.copyRepository(JGitEnvironmentRepository.java:587) [spring-cloud-config-server-3.0.4.jar!/:3.0.4]
    at org.springframework.cloud.config.server.environment.JGitEnvironmentRepository.createGitClient(JGitEnvironmentRepository.java:570) [spring-cloud-config-server-3.0.4.jar!/:3.0.4]
    at org.springframework.cloud.config.server.environment.JGitEnvironmentRepository.refresh(JGitEnvironmentRepository.java:267) [spring-cloud-config-server-3.0.4.jar!/:3.0.4]
    at org.springframework.cloud.config.server.environment.JGitEnvironmentRepository.getLocations(JGitEnvironmentRepository.java:245) [spring-cloud-config-server-3.0.4.jar!/:3.0.4]
    at org.springframework.cloud.config.server.environment.MultipleJGitEnvironmentRepository.getLocations(MultipleJGitEnvironmentRepository.java:139) [spring-cloud-config-server-3.0.4.jar!/:3.0.4]

应用配置 #

spring.cloud.config.server.git.uri=https://github.sdf.sdasdf.asdf.com/asdf/asdf-configs
          spring.cloud.config.server.git.username=github-token
          spring.cloud.config.server.git.password={github_token}

健康检查响应 #

{"status":"DOWN","components":{"clientConfigServer":{"status":"UNKNOWN","details":{"error":"no property sources located"}},"configServer":{"status":"DOWN","details":{"repository":{"application":"app","profiles":"default"},"error":"org.springframework.cloud.config.server.environment.NoSuchRepositoryException: Cannot clone or checkout repository: https://github-token@github.sdf.sdf.dsfs.com/sdf/sdfsd-configs"}},"discoveryComposite":{"description":"Discovery Client not initialized","status":"UNKNOWN","components":{"discoveryClient":{"description":"Discovery Client not initialized","status":"UNKNOWN"}}},"diskSpace":{"status":"UP","details":{"total":103880232960,"free":24558080000,"threshold":10485760,"exists":true}},"livenessState":{"status":"UP"},"ping":{"status":"UP"},"readinessState":{"status":"UP"},"refreshScope":{"status":"UP"}},"groups":["liveness","readiness"]}

排查步骤 #

• 第一步：验证Git凭证有效性
  直接在部署Config Server的机器上执行克隆命令测试：git clone https://<实际token值>@github.sdf.sdasdf.asdf.com/asdf/asdf-configs
  如果克隆失败，优先排查token问题：token是否过期、是否开启了目标仓库的读取权限、是否受企业Git平台的IP访问限制。
• 第二步：修正配置文件错误
  1. 去除spring.cloud.config.server.git.username和spring.cloud.config.server.git.password配置行前的缩进，properties文件行首空格会被识别为属性名的一部分，导致配置不生效
  2. 检查password配置是否多写了{}包裹符，实际值不需要加占位符括号
  3. 核对配置中的git uri与实际仓库地址一致，当前健康检查返回的仓库地址与配置的uri域名、路径均不匹配，存在配置写错的可能
  4. 如果是自签证书的私有Git平台，添加配置跳过SSL校验：spring.cloud.config.server.git.skip-ssl-validation=true
• 第三步：清理本地缓存目录
  Config Server默认会把仓库克隆到临时目录，残留的损坏文件会导致后续克隆失败，可手动指定缓存目录并提前清空：spring.cloud.config.server.git.basedir=/tmp/custom-config-repo
• 第四步：适配JGit版本兼容性
  当前使用的JGit 5.1.3版本较老，若Git平台使用了新的加密认证逻辑，可升级Spring Cloud Config版本匹配更高版本的JGit，或调整Git平台的认证兼容设置。

内容的提问来源于stack exchange，提问作者Avi