Skip to content

Commit 9fee941

Browse files
anandrkskdanandrkskd
authored
Feat: disable GitOps Service and default instance on xKS clusters (#1172)
* disable default instance on xKS clusters Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com> * Dex with OpenShiftOAuth: true fails on vanilla K8s because oauth.openshift.io API doesn't exist. Gate on config.openshift.io presence before configuring SSO. assisted-by: claude-code Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com> * use IsOpenshitCluster to gate openshift specific capabilities Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com> * add proper logs, remove deadcode, fix test assisted-by: Cursor for code-review Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com> * fix unit test Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com> * fix comments and nit picks Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com> --------- Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com>
1 parent 426874a commit 9fee941

4 files changed

Lines changed: 59 additions & 9 deletions

File tree

‎cmd/main.go‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,7 @@ func main() {
223223
registerComponentOrExit(mgr, argov1beta1api.AddToScheme)
224224

225225
// Setup Scheme for OpenShift Config if available
226+
// Disables default Argo CD instance if the cluster doesn't contain OpenShift config API
226227
if util.IsConfigAPIFound() {
227228
registerComponentOrExit(mgr, configv1.AddToScheme)
228229
}
@@ -254,13 +255,17 @@ func main() {
254255
}
255256
}
256257

257-
if err = (&controllers.ReconcileGitopsService{
258-
Client: client,
259-
Scheme: mgr.GetScheme(),
260-
DisableDefaultInstall: strings.ToLower(os.Getenv(common.DisableDefaultInstallEnvVar)) == "true",
261-
}).SetupWithManager(mgr); err != nil {
262-
setupLog.Error(err, "unable to create controller", "controller", "GitopsService")
263-
os.Exit(1)
258+
if util.IsOpenShiftCluster() {
259+
if err = (&controllers.ReconcileGitopsService{
260+
Client: client,
261+
Scheme: mgr.GetScheme(),
262+
DisableDefaultInstall: strings.ToLower(os.Getenv(common.DisableDefaultInstallEnvVar)) == "true",
263+
}).SetupWithManager(mgr); err != nil {
264+
setupLog.Error(err, "unable to create controller", "controller", "GitopsService")
265+
os.Exit(1)
266+
}
267+
} else {
268+
setupLog.Info("skipping GitopsService controller setup", "reason", "OpenShift Config API not available")
264269
}
265270

266271
if util.IsRouteAPIFound() {

‎controllers/argocd/argocd.go‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,17 @@ import (
2121

2222
argoapp "github.com/argoproj-labs/argocd-operator/api/v1beta1"
2323
argoappController "github.com/argoproj-labs/argocd-operator/controllers/argocd"
24+
"github.com/redhat-developer/gitops-operator/controllers/util"
2425
v1 "k8s.io/api/core/v1"
2526
resourcev1 "k8s.io/apimachinery/pkg/api/resource"
2627
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2728
"sigs.k8s.io/controller-runtime/pkg/client"
29+
logf "sigs.k8s.io/controller-runtime/pkg/log"
2830
"sigs.k8s.io/yaml"
2931
)
3032

33+
var log = logf.Log.WithName("controller_argocd")
34+
3135
var (
3236
defaultAdminPolicy = "g, system:cluster-admins, role:admin\ng, cluster-admins, role:admin\n"
3337
defaultScope = "[groups]"
@@ -90,7 +94,12 @@ func getArgoDexSpec() *argoapp.ArgoCDDexSpec {
9094
}
9195

9296
func getArgoSSOSpec(client client.Client) *argoapp.ArgoCDSSOSpec {
93-
if argoappController.IsOpenShiftCluster() && argoappController.IsExternalAuthenticationEnabledOnCluster(context.TODO(), client) {
97+
if !util.IsOpenShiftCluster() {
98+
log.Info("non-OpenShift cluster detected, skipping SSO/Dex configuration")
99+
return nil
100+
}
101+
if argoappController.IsExternalAuthenticationEnabledOnCluster(context.TODO(), client) {
102+
log.Info("external authentication enabled on cluster, skipping SSO/Dex configuration")
94103
return nil
95104
}
96105
return &argoapp.ArgoCDSSOSpec{

‎controllers/argocd/argocd_test.go‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222

2323
argoapp "github.com/argoproj-labs/argocd-operator/api/v1beta1"
2424
configv1 "github.com/openshift/api/config/v1"
25+
"github.com/redhat-developer/gitops-operator/controllers/util"
2526
"gotest.tools/assert"
2627
v1 "k8s.io/api/core/v1"
2728
resourcev1 "k8s.io/apimachinery/pkg/api/resource"
@@ -30,6 +31,9 @@ import (
3031
)
3132

3233
func TestArgoCD(t *testing.T) {
34+
util.SetConfigAPIFound(true)
35+
defer util.SetConfigAPIFound(false)
36+
3337
scheme := runtime.NewScheme()
3438
_ = argoapp.AddToScheme(scheme)
3539
_ = configv1.AddToScheme(scheme)
@@ -199,6 +203,9 @@ func TestArgoCD(t *testing.T) {
199203
}
200204

201205
func TestDexConfiguration(t *testing.T) {
206+
util.SetConfigAPIFound(true)
207+
defer util.SetConfigAPIFound(false)
208+
202209
scheme := runtime.NewScheme()
203210
_ = argoapp.AddToScheme(scheme)
204211
_ = configv1.AddToScheme(scheme)
@@ -223,3 +230,20 @@ func TestDexConfiguration(t *testing.T) {
223230
}
224231
assert.DeepEqual(t, testArgoCD.Spec.RBAC, testRBAC)
225232
}
233+
234+
// kubernetes environment test, no defer required as the Config API is false by default
235+
func TestSSOSkippedOnNonOpenShift(t *testing.T) {
236+
util.SetConfigAPIFound(false)
237+
238+
scheme := runtime.NewScheme()
239+
_ = argoapp.AddToScheme(scheme)
240+
_ = configv1.AddToScheme(scheme)
241+
242+
fakeClient := fake.NewClientBuilder().
243+
WithScheme(scheme).
244+
Build()
245+
246+
testArgoCD, _ := NewCR("openshift-gitops", "openshift-gitops", fakeClient)
247+
248+
assert.Assert(t, testArgoCD.Spec.SSO == nil, "SSO should be nil on non-OpenShift clusters")
249+
}

‎controllers/util/util.go‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,11 +116,16 @@ func InspectCluster() error {
116116
return stderrors.Join(errs...)
117117
}
118118

119-
// used as a shortcut to check if the cluster is an OpenShift cluster
119+
// IsConfigAPIFound return true if the CRD config.openshift.io is available in the cluster and false otherwise.
120120
func IsConfigAPIFound() bool {
121121
return configAPIFound
122122
}
123123

124+
// IsOpenShiftCluster uses IsConfigAPIFound to check if the cluster is an OpenShift cluster.
125+
func IsOpenShiftCluster() bool {
126+
return IsConfigAPIFound()
127+
}
128+
124129
// verify if the Config.Openshift.io API is found
125130
func verifyConfigAPI() error {
126131
found, err := argoutil.VerifyAPI(configv1.GroupName, configv1.GroupVersion.Version)
@@ -131,6 +136,7 @@ func verifyConfigAPI() error {
131136
return nil
132137
}
133138

139+
// IsConsoleAPIFound return true if the CRD console.openshift.io is available in the cluster.
134140
func IsConsoleAPIFound() bool {
135141
return consoleAPIFound
136142
}
@@ -144,6 +150,7 @@ func verifyConsoleAPI() error {
144150
return nil
145151
}
146152

153+
// IsRouteAPIFound return true if the CRD route.openshift.io is available in the cluster.
147154
func IsRouteAPIFound() bool {
148155
return routeAPIFound
149156
}
@@ -169,10 +176,12 @@ func verifyMonitoringAPI() error {
169176
return nil
170177
}
171178

179+
// IsMonitoringAPIFound return true if the CRD monitoring.coreos.com is available in the cluster.
172180
func IsMonitoringAPIFound() bool {
173181
return monitoringAPIFound
174182
}
175183

184+
// IsTemplateAPIFound return true if the CRD template.openshift.io is available in the cluster.
176185
func IsTemplateAPIFound() bool {
177186
return templateAPIFound
178187
}
@@ -186,6 +195,7 @@ func verifyTemplateAPI() error {
186195
return nil
187196
}
188197

198+
// IsAppsAPIFound return true if the CRD apps.openshift.io is available in the cluster.
189199
func IsAppsAPIFound() bool {
190200
return appsAPIFound
191201
}
@@ -199,6 +209,7 @@ func verifyAppsAPI() error {
199209
return nil
200210
}
201211

212+
// IsOAuthAPIFound return true if the CRD oauth.openshift.io is available in the cluster.
202213
func IsOAuthAPIFound() bool {
203214
return oauthAPIFound
204215
}
@@ -212,6 +223,7 @@ func verifyOAuthAPI() error {
212223
return nil
213224
}
214225

226+
// IsOLMAPIFound return true if the CRD operators.coreos.com is available in the cluster.
215227
func IsOLMAPIFound() bool {
216228
return olmAPIFound
217229
}

0 commit comments

Comments
 (0)