Skip to content

Commit e59cd60

Browse files
committed
We must not create the namespace nor operator group when gitOpsSubNamespace is empty or null
Otherwise the old operator with the new chart will try and actually push the namespace + operatorgroup policies with names like this: - complianceType: mustonlyhave objectDefinition: apiVersion: v1 kind: Namespace metadata: {} - complianceType: mustonlyhave objectDefinition: apiVersion: operators.coreos.com/v1 kind: OperatorGroup metadata: name: -operator-group And they will never be compliant
1 parent 602f3df commit e59cd60

2 files changed

Lines changed: 39 additions & 1 deletion

File tree

templates/policies/ocp-gitops-policy.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ spec:
5353
namespace: openshift-gitops
5454
labels:
5555
config.openshift.io/inject-trusted-cabundle: 'true'
56-
{{- if ne $.Values.global.gitOpsSubNamespace "openshift-operators" }}
56+
{{- if and $.Values.global.gitOpsSubNamespace (ne $.Values.global.gitOpsSubNamespace "openshift-operators") }}
5757
- complianceType: mustonlyhave
5858
objectDefinition:
5959
apiVersion: v1

tests/gitops_sub_namespace_test.yaml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,44 @@ tests:
137137
path: spec.policy-templates[0].objectDefinition.spec.object-templates
138138
count: 2 # Just subscription and configmap
139139

140+
- it: should not create operatorgroup nor namespace object-template when gitOpsSubNamespace is set to null
141+
set:
142+
global:
143+
gitOpsSubNamespace: null
144+
clusterGroup:
145+
managedClusterGroups:
146+
region-one:
147+
name: region-one
148+
acmlabels:
149+
- name: clusterGroup
150+
value: region-one
151+
asserts:
152+
- documentSelector:
153+
path: metadata.name
154+
value: region-one-gitops-policy
155+
lengthEqual:
156+
path: spec.policy-templates[0].objectDefinition.spec.object-templates
157+
count: 2 # Just subscription and configmap
158+
159+
- it: should not create operatorgroup nor namespace object-template when gitOpsSubNamespace is set to empty
160+
set:
161+
global:
162+
gitOpsSubNamespace: ''
163+
clusterGroup:
164+
managedClusterGroups:
165+
region-one:
166+
name: region-one
167+
acmlabels:
168+
- name: clusterGroup
169+
value: region-one
170+
asserts:
171+
- documentSelector:
172+
path: metadata.name
173+
value: region-one-gitops-policy
174+
lengthEqual:
175+
path: spec.policy-templates[0].objectDefinition.spec.object-templates
176+
count: 2 # Just subscription and configmap
177+
140178
- it: should use gitOpsSubNamespace as subscription namespace when set
141179
set:
142180
global:

0 commit comments

Comments
 (0)