Skip to content

Commit d6072b3

Browse files
mbaldessarimbaldessari
committed
Allow clusterwide namespace to be a parameter
1 parent 746f480 commit d6072b3

12 files changed

Lines changed: 485 additions & 27 deletions

‎templates/_helpers.tpl‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,8 @@ if this chart gets DeleteSpokeChildApps, it will set deletePattern to DeleteChil
6969
{{- end }}
7070
- name: global.gitOpsSubNamespace
7171
value: {{ $.Values.global.gitOpsSubNamespace }}
72+
- name: global.vpArgoNamespace
73+
value: {{ $.Values.global.vpArgoNamespace }}
7274
{{- end }} {{- /*acm.app.policies.helmparameters */}}
7375

7476
{{- define "acm.app.clusterSelector" -}}

‎templates/policies/acm-hub-ca-policy.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ spec:
172172
apiVersion: v1
173173
metadata:
174174
name: trusted-hub-bundle
175-
namespace: openshift-gitops
175+
namespace: {{ $.Values.global.vpArgoNamespace }}
176176
data:
177177
hub-kube-root-ca.crt: |
178178
{{ `{{hub fromConfigMap "" "kube-root-ca.crt" "ca.crt" | autoindent hub}}` }}

‎templates/policies/application-policies.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -34,25 +34,25 @@ spec:
3434
apiVersion: rbac.authorization.k8s.io/v1
3535
kind: ClusterRoleBinding
3636
metadata:
37-
name: openshift-gitops-cluster-admin-rolebinding
37+
name: {{ $.Values.global.vpArgoNamespace }}-cluster-admin-rolebinding
3838
roleRef:
3939
apiGroup: rbac.authorization.k8s.io
4040
kind: ClusterRole
4141
name: cluster-admin
4242
subjects:
4343
- kind: ServiceAccount
44-
name: openshift-gitops-argocd-application-controller
45-
namespace: openshift-gitops
44+
name: {{ $.Values.global.vpArgoNamespace }}-argocd-application-controller
45+
namespace: {{ $.Values.global.vpArgoNamespace }}
4646
- kind: ServiceAccount
47-
name: openshift-gitops-argocd-server
48-
namespace: openshift-gitops
47+
name: {{ $.Values.global.vpArgoNamespace }}-argocd-server
48+
namespace: {{ $.Values.global.vpArgoNamespace }}
4949
- complianceType: mustonlyhave
5050
objectDefinition:
5151
apiVersion: argoproj.io/v1alpha1
5252
kind: Application
5353
metadata:
5454
name: {{ $.Values.global.pattern }}-{{ .name }}
55-
namespace: openshift-gitops
55+
namespace: {{ $.Values.global.vpArgoNamespace }}
5656
finalizers:
5757
- resources-finalizer.argocd.argoproj.io/foreground
5858
spec:

‎templates/policies/ocp-gitops-policy.yaml‎

Lines changed: 28 additions & 3 deletions
Large diffs are not rendered by default.

‎templates/policies/private-repo-policies.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
# We copy the vp-private-repo-credentials from the "openshift-gitops" namespace
1+
# We copy the vp-private-repo-credentials from the ArgoCD namespace
22
# to the "open-cluster-management" via the "private-hub-policy"
33
#
44
# Then we copy the secret from the "open-cluster-management" namespace to the
5-
# managed clusters "openshift-gitops" instance
5+
# managed clusters ArgoCD instance
66
#
77
# And we also copy the same secret to the namespaced argo's namespace
88
{{ if $.Values.global.privateRepo }}
@@ -38,7 +38,7 @@ spec:
3838
type: Opaque
3939
metadata:
4040
name: vp-private-repo-credentials
41-
namespace: openshift-gitops
41+
namespace: {{ $.Values.global.vpArgoNamespace }}
4242
labels:
4343
argocd.argoproj.io/secret-type: repository
4444
data: '{{ `{{hub copySecretData "open-cluster-management" "vp-private-repo-credentials" hub}}` }}'
@@ -116,7 +116,7 @@ spec:
116116
namespace: open-cluster-management
117117
labels:
118118
argocd.argoproj.io/secret-type: repository
119-
data: '{{ `{{copySecretData "openshift-gitops" "vp-private-repo-credentials"}}` }}'
119+
data: '{{ `{{copySecretData "` }}{{ $.Values.global.vpArgoNamespace }}{{ `" "vp-private-repo-credentials"}}` }}'
120120
---
121121
apiVersion: policy.open-cluster-management.io/v1
122122
kind: PlacementBinding

‎tests/application_policy_test.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -87,8 +87,8 @@ tests:
8787
path: spec.predicates[0].requiredClusterSelector.labelSelector.matchLabels.clusterGroup
8888
value: group-two
8989

90-
# Test for openshift-gitops-cluster-admin-rolebinding CRB
91-
- it: Should precreate the openshift-gitops-cluster-admin-rolebinding ClusterRoleBinding
90+
# Test for cluster-admin-rolebinding CRB (uses default vpArgoNamespace: openshift-gitops)
91+
- it: Should precreate the cluster-admin-rolebinding ClusterRoleBinding
9292
values:
9393
- ./clusterselector_values.yaml
9494
set:
@@ -268,7 +268,7 @@ tests:
268268
value: group-one-clustergroup-policy
269269
lengthEqual:
270270
path: spec.policy-templates[0].objectDefinition.spec.object-templates[1].objectDefinition.spec.sources[1].helm.parameters
271-
count: 20 # 17 (in the helper) +3 (1 override, and 1 clusterGroup.name)
271+
count: 21 # 18 (in the helper) +3 (1 override, and 1 clusterGroup.name)
272272
- documentSelector:
273273
path: metadata.name
274274
value: group-one-clustergroup-policy
@@ -303,7 +303,7 @@ tests:
303303
value: group-one-clustergroup-policy
304304
lengthEqual:
305305
path: spec.policy-templates[0].objectDefinition.spec.object-templates[1].objectDefinition.spec.sources[1].helm.parameters
306-
count: 20 # 17 (in the helper) +3 (1 override, and 1 clusterGroup.name)
306+
count: 21 # 18 (in the helper) +3 (1 override, and 1 clusterGroup.name)
307307
- documentSelector:
308308
path: metadata.name
309309
value: group-one-clustergroup-policy

‎tests/gitops_sub_namespace_test.yaml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -78,13 +78,13 @@ tests:
7878
path: metadata.name
7979
value: region-one-gitops-policy
8080
equal:
81-
path: spec.policy-templates[0].objectDefinition.spec.object-templates[2].objectDefinition.kind
81+
path: spec.policy-templates[0].objectDefinition.spec.object-templates[3].objectDefinition.kind
8282
value: Namespace
8383
- documentSelector:
8484
path: metadata.name
8585
value: region-one-gitops-policy
8686
equal:
87-
path: spec.policy-templates[0].objectDefinition.spec.object-templates[2].objectDefinition.metadata.name
87+
path: spec.policy-templates[0].objectDefinition.spec.object-templates[3].objectDefinition.metadata.name
8888
value: yolo
8989

9090
- it: should create operatorgroup object-template when gitOpsSubNamespace is set to something other than openshift-operators
@@ -103,19 +103,19 @@ tests:
103103
path: metadata.name
104104
value: region-one-gitops-policy
105105
equal:
106-
path: spec.policy-templates[0].objectDefinition.spec.object-templates[3].objectDefinition.kind
106+
path: spec.policy-templates[0].objectDefinition.spec.object-templates[4].objectDefinition.kind
107107
value: OperatorGroup
108108
- documentSelector:
109109
path: metadata.name
110110
value: region-one-gitops-policy
111111
equal:
112-
path: spec.policy-templates[0].objectDefinition.spec.object-templates[3].objectDefinition.metadata.name
112+
path: spec.policy-templates[0].objectDefinition.spec.object-templates[4].objectDefinition.metadata.name
113113
value: my-gitops-ns-operator-group
114114
- documentSelector:
115115
path: metadata.name
116116
value: region-one-gitops-policy
117117
equal:
118-
path: spec.policy-templates[0].objectDefinition.spec.object-templates[3].objectDefinition.metadata.namespace
118+
path: spec.policy-templates[0].objectDefinition.spec.object-templates[4].objectDefinition.metadata.namespace
119119
value: my-gitops-ns
120120

121121
- it: should not create operatorgroup nor namespace object-template when gitOpsSubNamespace is set to openshift-operators
@@ -135,7 +135,7 @@ tests:
135135
value: region-one-gitops-policy
136136
lengthEqual:
137137
path: spec.policy-templates[0].objectDefinition.spec.object-templates
138-
count: 2 # Just subscription and configmap
138+
count: 3 # Subscription, namespace (vpArgoNamespace), and configmap
139139

140140
- it: should not create operatorgroup nor namespace object-template when gitOpsSubNamespace is set to null
141141
set:
@@ -154,7 +154,7 @@ tests:
154154
value: region-one-gitops-policy
155155
lengthEqual:
156156
path: spec.policy-templates[0].objectDefinition.spec.object-templates
157-
count: 2 # Just subscription and configmap
157+
count: 3 # Subscription, namespace (vpArgoNamespace), and configmap
158158

159159
- it: should not create operatorgroup nor namespace object-template when gitOpsSubNamespace is set to empty
160160
set:
@@ -173,7 +173,7 @@ tests:
173173
value: region-one-gitops-policy
174174
lengthEqual:
175175
path: spec.policy-templates[0].objectDefinition.spec.object-templates
176-
count: 2 # Just subscription and configmap
176+
count: 3 # Subscription, namespace (vpArgoNamespace), and configmap
177177

178178
- it: should use gitOpsSubNamespace as subscription namespace when set
179179
set:
@@ -191,5 +191,5 @@ tests:
191191
path: metadata.name
192192
value: region-one-gitops-policy
193193
matchRegex:
194-
path: spec.policy-templates[0].objectDefinition.spec.object-templates[3].objectDefinition.metadata.namespace
194+
path: spec.policy-templates[0].objectDefinition.spec.object-templates[4].objectDefinition.metadata.namespace
195195
pattern: ^my-gitops-ns$

‎tests/vp_argo_namespace_app_test.yaml‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
suite: Test vpArgoNamespace in application-policies
2+
templates:
3+
- templates/policies/application-policies.yaml
4+
release:
5+
name: release-test
6+
tests:
7+
- it: should use custom vpArgoNamespace in ClusterRoleBinding name
8+
values:
9+
- ./clusterselector_values.yaml
10+
set:
11+
global:
12+
vpArgoNamespace: custom-argocd
13+
multiSourceSupport: true
14+
multiSourceRepoUrl: "https://charts.example.com"
15+
multiSourceTargetRevision: "0.1.0"
16+
asserts:
17+
- documentSelector:
18+
path: metadata.name
19+
value: group-one-clustergroup-policy
20+
equal:
21+
path: spec.policy-templates[0].objectDefinition.spec.object-templates[0].objectDefinition.metadata.name
22+
value: custom-argocd-cluster-admin-rolebinding
23+
24+
- it: should use custom vpArgoNamespace in ServiceAccount subjects
25+
values:
26+
- ./clusterselector_values.yaml
27+
set:
28+
global:
29+
vpArgoNamespace: custom-argocd
30+
multiSourceSupport: true
31+
multiSourceRepoUrl: "https://charts.example.com"
32+
multiSourceTargetRevision: "0.1.0"
33+
asserts:
34+
- documentSelector:
35+
path: metadata.name
36+
value: group-one-clustergroup-policy
37+
contains:
38+
path: spec.policy-templates[0].objectDefinition.spec.object-templates[0].objectDefinition.subjects
39+
content:
40+
kind: ServiceAccount
41+
name: custom-argocd-argocd-application-controller
42+
namespace: custom-argocd
43+
- documentSelector:
44+
path: metadata.name
45+
value: group-one-clustergroup-policy
46+
contains:
47+
path: spec.policy-templates[0].objectDefinition.spec.object-templates[0].objectDefinition.subjects
48+
content:
49+
kind: ServiceAccount
50+
name: custom-argocd-argocd-server
51+
namespace: custom-argocd
52+
53+
- it: should use custom vpArgoNamespace for Application namespace
54+
values:
55+
- ./clusterselector_values.yaml
56+
set:
57+
global:
58+
vpArgoNamespace: custom-argocd
59+
multiSourceSupport: true
60+
multiSourceRepoUrl: "https://charts.example.com"
61+
multiSourceTargetRevision: "0.1.0"
62+
asserts:
63+
- documentSelector:
64+
path: metadata.name
65+
value: group-one-clustergroup-policy
66+
equal:
67+
path: spec.policy-templates[0].objectDefinition.spec.object-templates[1].objectDefinition.metadata.namespace
68+
value: custom-argocd
69+
70+
- it: should pass vpArgoNamespace as a helm parameter
71+
values:
72+
- ./clusterselector_values.yaml
73+
set:
74+
global:
75+
vpArgoNamespace: custom-argocd
76+
multiSourceSupport: true
77+
multiSourceRepoUrl: "https://charts.example.com"
78+
multiSourceTargetRevision: "0.1.0"
79+
asserts:
80+
- documentSelector:
81+
path: metadata.name
82+
value: group-one-clustergroup-policy
83+
contains:
84+
path: spec.policy-templates[0].objectDefinition.spec.object-templates[1].objectDefinition.spec.sources[1].helm.parameters
85+
content:
86+
name: global.vpArgoNamespace
87+
value: custom-argocd

0 commit comments

Comments
 (0)