I think we're going to do a similar thing to the git secrets, where we find the first secret that has the annotation kpack.io/blob: some.host.name.com and match on first secret with the same the hostname.

There will be 3 ways of configuring the secret:

1. username/password that gets encoded as Authorization: Basic <base64encode(username,password)>
2. bearer which gets encoded as Authorization: Bearer <token>
3. authorization as an escape hatch for non-standard auth, encoded as Authorization: <authorization>

data:
    username:
    password:
    bearer:
    authorization:

I see a potential enhancement by being able to provide arbitrary headers on the secret. But I'm not sure how useful that would be in reality, so I might just leave it until somebody raises a feature request for it

data:
    headers:
        x-my-special-header: value

@chenbh : It's a nice design, is it an ETA for this feature? We are happy to use this feature as we need to download jar file from a private maven repo via http basic authentication and we can't code the username&password in the spec due to securtiy concern.

@yilims I'm hoping to get it in and released by end of this month.

Awesome, that's really a cool feature that the community is waiting for!