fix/ESO upgrade (#123)

* Repo/ESO Updates

- ran patternizer against the repo to ensure that the latest goodness is
  from the vp framework is applied.
- updated ESO from upstream to openshift supported
- updated values-hub to use `argoProject{,s}`
- changed namespace definition from list to dictionary. this is
  currently required for the framework to support multiple versions of
an operator/service (golang-external-secrets/openshift-external-secrets)

* update to values-group-one.yaml

* rebasing branch

* changing eso apiVersion for qtodo-quay-pass

* updating pr

* removing hardcoded value for clusterGroup chart

* removing extra (unnecessary values) file

* update makefile

* removing duplicate seed entry

* Addtl Changes to pattern for ocp-eso support

- changed job behavior to match rhtpa-ingress-ca-extractor chart
- central-htpasswd is now operator-managed

* Add clustername to acs-secured-cluster

* Apply suggestion from @mlorenzofr

added policy

Co-authored-by: Manuel Lorenzo <mlorenzofr@gmail.com>

* Updated pattern.sh with Mac-specific handling:

1. Mac detection — sets MACHINE_TYPE=mac when uname -s is Darwin
2. TARGET_ORIGIN — exported as origin on Mac
3. Array expansion — on Mac, uses ${PKI_HOST_MOUNT_ARGS[@]+"${PKI_HOST_MOUNT_ARGS[@]}"} and ${EXTRA_ARGS_ARRAY[@]+"${EXTRA_ARGS_ARRAY[@]}"} via PKI_EXPAND and EXTRA_EXPAND before the podman run call

Linux behavior is unchanged.

* modified make targets to disable argocd app status

* removes the intermediate variables

---------

Co-authored-by: Manuel Lorenzo <mlorenzofr@gmail.com>

Author: day0hero

Makefile

@@ -1,26 +1,5 @@
-.PHONY: default
-default: help
+# Generated by patternizer
+# This Makefile includes the common pattern targets from Makefile-common
+# You can add custom targets above or below the include line
 
-.PHONY: help
-##@ Pattern tasks
-
-# No need to add a comment here as help is described in common/
-help:
-	@make -f common/Makefile MAKEFILE_LIST="Makefile common/Makefile" help
-
-%:
-	make -f common/Makefile $*
-
-.PHONY: install
-install: operator-deploy post-install ## installs the pattern and loads the secrets
-	@echo "Installed"
-
-.PHONY: post-install
-post-install: ## Post-install tasks
-	make load-secrets
-	make vault-config-jwt
-	@echo "Done"
-
-.PHONY: test
-test:
-	@make -f common/Makefile PATTERN_OPTS="-f values-global.yaml -f values-hub.yaml" test
+include Makefile-common

Makefile-common

@@ -0,0 +1,55 @@
+MAKEFLAGS += --no-print-directory
+ANSIBLE_STDOUT_CALLBACK ?= null # null silences all ansible output. Override this with default, minimal, oneline, etc. when debugging.
+ANSIBLE_RUN := ANSIBLE_STDOUT_CALLBACK=$(ANSIBLE_STDOUT_CALLBACK) ansible-playbook $(EXTRA_PLAYBOOK_OPTS)
+DOCS_URL := https://validatedpatterns.io/blog/2025-08-29-new-common-makefile-structure/
+
+.PHONY: help
+help: ## Print this help message
+	@echo "For a complete guide to these targets and the available overrides, please visit $(DOCS_URL)"
+	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^(\s|[a-zA-Z_0-9-])+:.*?##/ { printf "  \033[36m%-35s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
+
+##@ Pattern Install Tasks
+.PHONY: show
+show: ## Shows the template that would be applied by the `make install` target
+	@$(ANSIBLE_RUN) rhvp.cluster_utils.show
+
+.PHONY: operator-deploy
+operator-deploy operator-upgrade: ## Installs/updates the pattern on a cluster (DOES NOT load secrets)
+	@$(ANSIBLE_RUN) rhvp.cluster_utils.operator_deploy
+
+.PHONY: install
+#install: pattern-install  ## Installs the pattern onto a cluster (Loads secrets as well if configured)
+install: operator-deploy load-secrets
+
+.PHONY: uninstall ## Prints a notice that patterns cannot currently be uninstalled
+uninstall:
+	@echo "Uninstall is not possible at the moment so this target is empty. We are working to implement it as well as we can."
+
+.PHONY: pattern-install
+pattern-install:
+	@$(ANSIBLE_RUN) rhvp.cluster_utils.install
+
+.PHONY: load-secrets
+load-secrets: ## Loads secrets onto the cluster (unless explicitly disabled in values-global.yaml)
+	@$(ANSIBLE_RUN) rhvp.cluster_utils.load_secrets
+
+##@ Validation Tasks
+.PHONY: validate-prereq
+validate-prereq: ## verify pre-requisites
+	@$(ANSIBLE_RUN) rhvp.cluster_utils.validate_prereq
+
+.PHONY: validate-origin
+validate-origin: ## verify the git origin is available
+	@$(ANSIBLE_RUN) rhvp.cluster_utils.validate_origin
+
+.PHONY: validate-cluster
+validate-cluster: ## Do some cluster validations before installing
+	@$(ANSIBLE_RUN) rhvp.cluster_utils.validate_cluster
+
+.PHONY: validate-schema
+validate-schema: ## validates values files against schema in common/clustergroup
+	@$(ANSIBLE_RUN) rhvp.cluster_utils.validate_schema
+
+.PHONY: argo-healthcheck
+argo-healthcheck: ## Checks if all argo applications are synced
+	@$(ANSIBLE_RUN) rhvp.cluster_utils.argo_healthcheck

ansible.cfg

@@ -1,6 +1,15 @@
 [defaults]
 localhost_warning=False
 retry_files_enabled=False
-library=~/.ansible/plugins/modules:./ansible/plugins/modules:./common/ansible/plugins/modules:/usr/share/ansible/plugins/modules
-roles_path=~/.ansible/roles:./ansible/roles:./common/ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles
-filter_plugins=~/.ansible/plugins/filter:./ansible/plugins/filter:./common/ansible/plugins/filter:/usr/share/ansible/plugins/filter
+# Retry files disabled to avoid cluttering CI/CD environments
+interpreter_python=auto_silent
+timeout=30
+library=~/.ansible/plugins/modules:./ansible/plugins/modules:/usr/share/ansible/plugins/modules
+roles_path=~/.ansible/roles:./ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles
+filter_plugins=~/.ansible/plugins/filter:./ansible/plugins/filter:/usr/share/ansible/plugins/filter
+# use the collections from the util. container,
+# change below if you want to test local collections
+collections_path=/usr/share/ansible/collections
+
+[inventory]
+inventory_unparsed_warning=False

charts/acm-managed-clusters/templates/acm-external-secrets.yaml

@@ -1,7 +1,7 @@
 {{- $clusters := .Values.acmManagedClusters.clusters | default list }}
 {{- range $clusters }}
 ---
-apiVersion: "external-secrets.io/v1beta1"
+apiVersion: "external-secrets.io/v1"
 kind: ExternalSecret
 metadata:
   name: kubeconfig-{{ .name }}

charts/acs-central/templates/central-htpasswd-external-secret.yaml

@@ -1,5 +1,5 @@
 {{- if and .Values.central.enabled .Values.central.adminPassword.useExternalSecret }}
-apiVersion: "external-secrets.io/v1beta1"
+apiVersion: "external-secrets.io/v1"
 kind: ExternalSecret
 metadata:
   name: central-htpasswd-external-secret

charts/acs-central/templates/jobs/create-auth-provider.yaml

@@ -8,6 +8,8 @@ metadata:
     {{- include "acs-central.labels" . | nindent 4 }}
   annotations:
     argocd.argoproj.io/sync-wave: "44"
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
 spec:
   template:
     metadata:

charts/acs-central/templates/jobs/create-cluster-init-bundle.yaml

@@ -15,6 +15,8 @@ metadata:
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
     argocd.argoproj.io/sync-wave: "43"
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
 spec:
   template:
     metadata:

charts/acs-central/templates/jobs/create-htpasswd-field.yaml

@@ -8,6 +8,9 @@ metadata:
     {{- include "acs-central.labels" . | nindent 4 }}
   annotations:
     argocd.argoproj.io/sync-wave: "37"
+    # Jobs are immutable; delete and recreate on each sync when spec changes
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
 spec:
   template:
     metadata:
@@ -34,7 +37,7 @@ spec:
 
               echo "🔄 Generating htpasswd entry for admin user..."
 
-              # Check if central-htpasswd secret already has valid htpasswd field
+              # Check if admin password secret already has valid htpasswd field
               if oc get secret {{ .Values.central.adminPassword.secretName }} -n {{ .Release.Namespace }} -o jsonpath='{.data.htpasswd}' 2>/dev/null | base64 -d | grep -q "^admin:\$2[aby]\$"; then
                 echo "✅ htpasswd entry already exists and is valid (bcrypt format)"
                 exit 0

charts/acs-central/templates/keycloak-client-secret-external-secret.yaml

@@ -1,5 +1,5 @@
 {{- if and .Values.central.enabled .Values.integration.keycloak.enabled }}
-apiVersion: "external-secrets.io/v1beta1"
+apiVersion: "external-secrets.io/v1"
 kind: ExternalSecret
 metadata:
   name: {{ .Values.integration.keycloak.clientSecret.secretName }}

charts/acs-central/values.yaml

@@ -20,7 +20,7 @@ central:
   adminPassword:
     # Use external secret from Vault
     useExternalSecret: true
-    secretName: central-htpasswd
+    secretName: central-admin-htpasswd
     secretKey: password
 
   # Image configuration
@@ -195,4 +195,4 @@ securityContext:
 # Node selector and tolerations
 nodeSelector: {}
 tolerations: []
-affinity: {}
+affinity: {}