the providerConfig for crossplane's provider-terraform supports git-credentials file for authentication to pull the terraform module from private git repo. ref: https://github.com/crossplane-contrib/provider-terraform#private-git-repository-support
kubevela's terraform provider should support private git using similar mechanism since it is already doing so for cloud credentials e.g. AWS through the provider