Repository: rancher/fleet

Issue:
Panic error deploying simple repo on 2.11
### Is there an existing issue for this?

- [x] I have searched the existing issues

### Current Behavior

Issue:
After upgrade to  `fleet:106.0.1+up0.12.1-beta.2` we cannot deploy simple giterepo outputing panic error:

Steps:

Deploy latest Rancher 2.11 with Fleet `fleet:106.0.1+up0.12.1-beta.2``
Deploy: https://github.com/rancher/fleet-examples/tree/master/simple

Observe gitrepo is not deployed and error is outputed:


![Image](https://github.com/user-attachments/assets/dbd723b3-3d19-4a23-bde8-9b2e81079f7b)

Error:

```
 {"level":"error","ts":"2025-04-10T14:15:44Z","msg":"Reconciler error","controller":"gitrepo","controllerGroup":"fleet.cattle.io","controllerKind":"GitRepo","GitRepo":{"name":"local-cluster-fleet-62","namespace":"fleet-local"},"namespace":"fleet-local","name" │
│ :"local-cluster-fleet-62","reconcileID":"bf811975-adcf-497f-b3d9-b39d6c2082b3","error":"panic: assignment to entry in nil map [recovered]","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/home/runne │
│ r/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.2/pkg/internal/controller/controller.go:341\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.2/pkg │
│ /internal/controller/controller.go:288\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.2/pkg/internal/controller/controller.go:249"} 
```

### Expected Behavior

_No response_

### Steps To Reproduce

_No response_

### Environment

```markdown
- Architecture:
- Fleet Version:
- Cluster:
  - Provider:
  - Options:
  - Kubernetes Version:
```

### Logs

```markdown

```

### Anything else?

_No response_

Hints from issue comments:
@mmartin24: This issue seems fixed.

Tested with Rancher `v2.11-7d4f68fbc7676943f00c116ee2d3f4243f4b0135-head'` +  `fleet:106.0.1+up0.12.1-rc.1`.

Repo described able to deploy
No panic errors
Ci on [2.11-dev](https://github.com/rancher/fleet-e2e/actions/runs/14403615294/job/40394762509) confirmed normal 

![Image](https://github.com/user-attachments/assets/167773df-4fa3-40f9-ac05-7980b2cabd35)

Tried as well with `--set insecureSkipHostKeyChecks=true` and also ok.

Solution patch:
diff --git a/pkg/git/fetch.go b/pkg/git/fetch.go
index 6273618b..60ac185e 100644
--- a/pkg/git/fetch.go
+++ b/pkg/git/fetch.go
@@ -70,7 +70,7 @@ func (f *Fetch) LatestCommit(ctx context.Context, gitrepo *v1alpha1.GitRepo, cli
 		knownHosts = kh
 	}
 
-	if f.KnownHosts != nil && !f.KnownHosts.IsStrict() {
+	if secret.Data != nil && f.KnownHosts != nil && !f.KnownHosts.IsStrict() {
 		// This prevents errors about keys being mismatch or not found when host key checks are disabled.
 		secret.Data["known_hosts"] = nil
 	}



Test patch:
diff --git a/pkg/git/fetch_test.go b/pkg/git/fetch_test.go
index 882bf015..a667a61a 100644
--- a/pkg/git/fetch_test.go
+++ b/pkg/git/fetch_test.go
@@ -164,6 +164,32 @@ var _ = Describe("git fetch's LatestCommit tests", func() {
 		Expect(commit).To(Equal("2ada7cca738877df8459b3a34839a15e5683edaa"))
 	})
 
+	It("returns the commit for the expected branch with no secret", func() {
+		gr := &fleetv1.GitRepo{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "test-gitrepo",
+				Namespace: "test-ns",
+			},
+			Spec: fleetv1.GitRepoSpec{
+				ClientSecretName: "test-secret",
+				Repo:             fakeGithub.URL,
+				Branch:           "master",
+			},
+			Status: fleetv1.GitRepoStatus{
+				Commit: "",
+			},
+		}
+		c := newTestClient()
+		f := git.Fetch{
+			KnownHosts: mockKnownHostsGetter{
+				data: "foo",
+			},
+		}
+		commit, err := f.LatestCommit(context.Background(), gr, c)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(commit).To(Equal("2ada7cca738877df8459b3a34839a15e5683edaa"))
+	})
+
 	It("returns an error when secret's type is not expected", func() {
 		secret := &corev1.Secret{
 			ObjectMeta: metav1.ObjectMeta{