Skip to content

Commit c94a5b5

Browse files
mbaldessarimbaldessari
authored
Merge pull request #34 from mbaldessari/ishubcluster
Make clusterGroup.isHubCluster optional
2 parents 46cf092 + b938324 commit c94a5b5

7 files changed

Lines changed: 456 additions & 4 deletions

‎templates/_helpers.tpl‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,3 +196,26 @@ health_status.status = "Progressing"
196196
health_status.message = "An install plan for a subscription is pending installation"
197197
return health_status
198198
{{- end }} {{- /*acm.subscription.healthcheck.lua */}}
199+
200+
{{/*
201+
Determines if the current cluster is a hub cluster.
202+
First checks if clusterGroup.isHubCluster is explicitly set and uses that value.
203+
If not set, falls back to comparing global.localClusterDomain and global.hubClusterDomain.
204+
If domains are equal or localClusterDomain is not set (defaults to hubClusterDomain), this is a hub cluster.
205+
Usage: {{ include "acm.ishubcluster" . }}
206+
Returns: "true" or "false" as a string
207+
*/}}
208+
{{- define "acm.ishubcluster" -}}
209+
{{- if and (hasKey .Values.clusterGroup "isHubCluster") (not (kindIs "invalid" .Values.clusterGroup.isHubCluster)) -}}
210+
{{- .Values.clusterGroup.isHubCluster | toString -}}
211+
{{- else if $.Values.global.hubClusterDomain -}}
212+
{{- $localDomain := coalesce $.Values.global.localClusterDomain $.Values.global.hubClusterDomain -}}
213+
{{- if eq $localDomain $.Values.global.hubClusterDomain -}}
214+
true
215+
{{- else -}}
216+
false
217+
{{- end -}}
218+
{{- else -}}
219+
false
220+
{{- end -}}
221+
{{- end }}

‎templates/policies/acm-hub-ca-policy.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# This pushes out the HUB's Certificate Authorities on to the imported clusters
2-
{{- if .Values.clusterGroup.isHubCluster }}
2+
{{- if eq (include "acm.ishubcluster" .) "true" }}
33
{{- range .Values.clusterGroup.managedClusterGroups }}
44
{{- $group := . }}
55
---
@@ -217,4 +217,4 @@ spec:
217217

218218
{{- end }}{{/* if (eq ((($.Values.global).secretStore).backend) "vault") */}}
219219
{{- end }}{{/* range .Values.clusterGroup.managedClusterGroups */}}
220-
{{- end }}{{/* isHubCluster */}}
220+
{{- end }}{{/* ishubcluster */}}

‎templates/policies/private-repo-policies.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ spec:
8484
"group" $group
8585
) | nindent 2 }}
8686
{{- end }}{{- /* range .Values.clusterGroup.managedClusterGroups */}}
87-
{{ if $.Values.clusterGroup.isHubCluster }}
87+
{{ if eq (include "acm.ishubcluster" $) "true" }}
8888
---
8989
apiVersion: policy.open-cluster-management.io/v1
9090
kind: Policy
@@ -153,5 +153,5 @@ spec:
153153
values:
154154
- 'true'
155155
---
156-
{{ end }}{{- /* if .Values.clusterGroup.isHubCluster */}}
156+
{{ end }}{{- /* if ishubcluster */}}
157157
{{- end }}{{- /* if $.Values.global.privateRepo */}}

‎tests/hub_cluster_additional_scenarios_test.yaml‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
suite: Test Hub Cluster Detection Additional Scenarios
2+
templates:
3+
- templates/policies/acm-hub-ca-policy.yaml
4+
release:
5+
name: release-test
6+
tests:
7+
# Test subdomain variations (domain-based detection)
8+
- it: should differentiate between similar domains
9+
set:
10+
global:
11+
repoURL: https://github.com/test/repo
12+
hubClusterDomain: "apps.hub.example.com"
13+
localClusterDomain: "apps.hub-spoke.example.com" # Similar but different
14+
secretStore:
15+
backend: "vault"
16+
pattern: "test-pattern"
17+
clusterGroup:
18+
isHubCluster: null # Explicitly unset to enable domain-based detection
19+
managedClusterGroups:
20+
test:
21+
name: test-cluster
22+
asserts:
23+
- hasDocuments:
24+
count: 0
25+
26+
# Test with special characters (domain-based detection)
27+
- it: should handle domains with special characters
28+
set:
29+
global:
30+
repoURL: https://github.com/test/repo
31+
hubClusterDomain: "apps.hub-cluster_1.example-domain.com"
32+
localClusterDomain: "apps.hub-cluster_1.example-domain.com"
33+
secretStore:
34+
backend: "vault"
35+
pattern: "test-pattern"
36+
clusterGroup:
37+
isHubCluster: null # Explicitly unset to enable domain-based detection
38+
managedClusterGroups:
39+
test:
40+
name: test-cluster
41+
asserts:
42+
- hasDocuments:
43+
count: 9
44+
45+
# Test with missing managedClusterGroups
46+
- it: should handle missing managedClusterGroups gracefully
47+
set:
48+
global:
49+
repoURL: https://github.com/test/repo
50+
hubClusterDomain: "apps.hub.example.com"
51+
localClusterDomain: "apps.hub.example.com"
52+
secretStore:
53+
backend: "vault"
54+
pattern: "test-pattern"
55+
clusterGroup:
56+
isHubCluster: null # Explicitly unset to enable domain-based detection
57+
managedClusterGroups: null # Explicitly unset
58+
asserts:
59+
- hasDocuments:
60+
count: 0 # No managed cluster groups means no policies
61+
62+
# Test with empty managedClusterGroups
63+
- it: should handle empty managedClusterGroups
64+
set:
65+
global:
66+
repoURL: https://github.com/test/repo
67+
hubClusterDomain: "apps.hub.example.com"
68+
localClusterDomain: "apps.hub.example.com"
69+
secretStore:
70+
backend: "vault"
71+
pattern: "test-pattern"
72+
clusterGroup:
73+
isHubCluster: null # Explicitly unset to enable domain-based detection
74+
managedClusterGroups: {} # Empty
75+
asserts:
76+
- hasDocuments:
77+
count: 0 # Empty managed cluster groups means no policies
78+
79+
# Test explicit isHubCluster takes precedence over domain-based detection
80+
- it: should respect explicit isHubCluster even when domains match
81+
set:
82+
global:
83+
repoURL: https://github.com/test/migration
84+
hubClusterDomain: "apps.migration-hub.example.com"
85+
localClusterDomain: "apps.migration-hub.example.com"
86+
secretStore:
87+
backend: "vault"
88+
pattern: "migration-test"
89+
clusterGroup:
90+
# Explicit isHubCluster takes precedence over domain-based detection
91+
isHubCluster: false # Explicitly set to false, should be respected
92+
managedClusterGroups:
93+
migrationTarget:
94+
name: migration-target
95+
labels:
96+
- name: migration
97+
value: in-progress
98+
asserts:
99+
# Explicit isHubCluster: false is respected even though domains match
100+
- hasDocuments:
101+
count: 0
102+
103+
# Test multiple cluster groups with domain-based logic (no explicit isHubCluster)
104+
- it: should handle multiple cluster groups with domain-based hub detection
105+
set:
106+
global:
107+
repoURL: https://github.com/test/multi-cluster
108+
hubClusterDomain: "apps.prod-hub.company.com"
109+
localClusterDomain: "apps.prod-hub.company.com"
110+
secretStore:
111+
backend: "vault"
112+
pattern: "multi-cluster-test"
113+
clusterGroup:
114+
isHubCluster: null # Explicitly unset to enable domain-based detection
115+
managedClusterGroups:
116+
prodEast:
117+
name: prod-east
118+
labels:
119+
- name: environment
120+
value: production
121+
stagingWest:
122+
name: staging-west
123+
labels:
124+
- name: environment
125+
value: staging
126+
asserts:
127+
# Should have CA policies for 2 cluster groups (9 docs each)
128+
- hasDocuments:
129+
count: 18
130+
# Verify specific policies exist
131+
- documentSelector:
132+
path: metadata.name
133+
value: hub-argo-ca-prod-east-policy
134+
isKind:
135+
of: Policy
136+
- documentSelector:
137+
path: metadata.name
138+
value: hub-argo-ca-staging-west-policy
139+
isKind:
140+
of: Policy

‎tests/hub_cluster_detection_private_repo_test.yaml‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
suite: Test Hub Cluster Detection Logic - Private Repo Policies
2+
templates:
3+
- templates/policies/private-repo-policies.yaml
4+
release:
5+
name: release-test
6+
tests:
7+
# Test 1: Hub cluster when localClusterDomain equals hubClusterDomain (includes private hub policy)
8+
- it: should render private hub policy when localClusterDomain equals hubClusterDomain
9+
set:
10+
global:
11+
repoURL: https://github.com/validatedpatterns/multicloud-gitops
12+
hubClusterDomain: "apps.hub.example.com"
13+
localClusterDomain: "apps.hub.example.com"
14+
privateRepo: true
15+
pattern: "test-pattern"
16+
clusterGroup:
17+
isHubCluster: null # Explicitly unset to enable domain-based detection
18+
managedClusterGroups:
19+
testRegion:
20+
name: region-one
21+
labels:
22+
- name: clusterGroup
23+
value: region-one
24+
asserts:
25+
- documentSelector:
26+
path: metadata.name
27+
value: vp-private-hub-policy
28+
isKind:
29+
of: Policy
30+
- hasDocuments:
31+
count: 6
32+
33+
# Test 2: Not hub cluster when localClusterDomain differs from hubClusterDomain (no private hub policy)
34+
- it: should not render private hub policy when localClusterDomain differs from hubClusterDomain
35+
set:
36+
global:
37+
repoURL: https://github.com/validatedpatterns/multicloud-gitops
38+
hubClusterDomain: "apps.hub.example.com"
39+
localClusterDomain: "apps.spoke.example.com"
40+
privateRepo: true
41+
pattern: "test-pattern"
42+
clusterGroup:
43+
isHubCluster: null # Explicitly unset to enable domain-based detection
44+
managedClusterGroups:
45+
testRegion:
46+
name: region-one
47+
labels:
48+
- name: clusterGroup
49+
value: region-one
50+
asserts:
51+
# Should have the managed cluster policies but not the hub policy
52+
- documentSelector:
53+
path: metadata.name
54+
value: private-region-one-policy
55+
isKind:
56+
of: Policy
57+
- hasDocuments:
58+
count: 3
59+
60+
# Test 3: Fallback to isHubCluster when domains are not set (true)
61+
- it: should render private hub policy when fallback to isHubCluster true
62+
set:
63+
global:
64+
repoURL: https://github.com/validatedpatterns/multicloud-gitops
65+
# No domain configuration provided
66+
privateRepo: true
67+
pattern: "test-pattern"
68+
clusterGroup:
69+
isHubCluster: true
70+
managedClusterGroups:
71+
testRegion:
72+
name: region-one
73+
labels:
74+
- name: clusterGroup
75+
value: region-one
76+
asserts:
77+
- documentSelector:
78+
path: metadata.name
79+
value: vp-private-hub-policy
80+
isKind:
81+
of: Policy
82+
- hasDocuments:
83+
count: 6
84+
85+
# Test 4: Fallback to isHubCluster false when no domain configuration is provided
86+
- it: should not render private hub policy when fallback to isHubCluster false
87+
set:
88+
global:
89+
repoURL: https://github.com/validatedpatterns/multicloud-gitops
90+
# No domain configuration provided
91+
privateRepo: true
92+
pattern: "test-pattern"
93+
clusterGroup:
94+
isHubCluster: false
95+
managedClusterGroups:
96+
testRegion:
97+
name: region-one
98+
labels:
99+
- name: clusterGroup
100+
value: region-one
101+
asserts:
102+
# Should have the managed cluster policies but not the hub policy
103+
- documentSelector:
104+
path: metadata.name
105+
value: private-region-one-policy
106+
isKind:
107+
of: Policy
108+
- hasDocuments:
109+
count: 3
110+
111+
# Test 5: No policies when privateRepo is false
112+
- it: should not render any private repo policies when privateRepo is false
113+
set:
114+
global:
115+
repoURL: https://github.com/validatedpatterns/multicloud-gitops
116+
hubClusterDomain: "apps.hub.example.com"
117+
localClusterDomain: "apps.hub.example.com"
118+
privateRepo: false
119+
pattern: "test-pattern"
120+
clusterGroup:
121+
isHubCluster: true
122+
managedClusterGroups:
123+
testRegion:
124+
name: region-one
125+
labels:
126+
- name: clusterGroup
127+
value: region-one
128+
asserts:
129+
- hasDocuments:
130+
count: 0

0 commit comments

Comments
 (0)