Skip to content

Commit 2aa99fc

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #586 from sector2000/add-argoadmins
Allow additional Argo admins
2 parents f8e1fd6 + cda5736 commit 2aa99fc

5 files changed

Lines changed: 69 additions & 40 deletions

File tree

‎internal/controller/argo.go‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -56,10 +56,19 @@ const (
5656
ConsoleLinkResource = "consolelinks"
5757
)
5858

59-
func newArgoCD(name, namespace string) *argooperator.ArgoCD {
60-
argoPolicy := `g, system:cluster-admins, role:admin
61-
g, cluster-admins, role:admin
62-
g, admin, role:admin`
59+
func newArgoCD(name, namespace string, patternsOperatorConfig PatternsOperatorConfig) *argooperator.ArgoCD {
60+
argoPolicies := []string{
61+
"g, system:cluster-admins, role:admin",
62+
"g, cluster-admins, role:admin",
63+
"g, admin, role:admin",
64+
}
65+
for argoAdmin := range strings.SplitSeq(patternsOperatorConfig.getValueWithDefault("gitops.additionalArgoAdmins"), ",") {
66+
argoAdmin = strings.TrimSpace(argoAdmin)
67+
if argoAdmin != "" {
68+
argoPolicies = append(argoPolicies, "g, "+argoAdmin+", role:admin")
69+
}
70+
}
71+
argoPolicy := strings.Join(argoPolicies, "\n")
6372
defaultPolicy := "role:readonly"
6473
argoScopes := "[groups,email]"
6574
trueBool := true
@@ -403,8 +412,8 @@ func haveArgo(client dynamic.Interface, name, namespace string) bool {
403412
return err == nil
404413
}
405414

406-
func createOrUpdateArgoCD(client dynamic.Interface, fullClient kubernetes.Interface, name, namespace string) error {
407-
argo := newArgoCD(name, namespace)
415+
func createOrUpdateArgoCD(client dynamic.Interface, fullClient kubernetes.Interface, name, namespace string, patternsOperatorConfig PatternsOperatorConfig) error {
416+
argo := newArgoCD(name, namespace, patternsOperatorConfig)
408417
gvr := schema.GroupVersionResource{Group: ArgoCDGroup, Version: ArgoCDVersion, Resource: ArgoCDResource}
409418

410419
var err error

‎internal/controller/argo_test.go‎

Lines changed: 37 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -824,15 +824,17 @@ var _ = Describe("NewApplicationValues", func() {
824824

825825
var _ = Describe("NewArgoCD", func() {
826826
var (
827-
name string
828-
namespace string
829-
argoCD *argooperator.ArgoCD
827+
name string
828+
namespace string
829+
argoCD *argooperator.ArgoCD
830+
patternsOperatorConfig PatternsOperatorConfig
830831
)
831832

832833
BeforeEach(func() {
833834
name = "test-argocd"
834835
namespace = "test-namespace"
835-
argoCD = newArgoCD(name, namespace)
836+
patternsOperatorConfig = DefaultPatternsOperatorConfig
837+
argoCD = newArgoCD(name, namespace, patternsOperatorConfig)
836838
})
837839

838840
Context("when creating a new ArgoCD object", func() {
@@ -962,10 +964,11 @@ var _ = Describe("haveArgo", func() {
962964

963965
var _ = Describe("CreateOrUpdateArgoCD", func() {
964966
var (
965-
dynamicClient dynamic.Interface
966-
gvr schema.GroupVersionResource
967-
name string
968-
namespace string
967+
dynamicClient dynamic.Interface
968+
gvr schema.GroupVersionResource
969+
name string
970+
namespace string
971+
patternsOperatorConfig PatternsOperatorConfig
969972
)
970973

971974
BeforeEach(func() {
@@ -975,11 +978,12 @@ var _ = Describe("CreateOrUpdateArgoCD", func() {
975978
})
976979
name = argoName
977980
namespace = argoNS
981+
patternsOperatorConfig = DefaultPatternsOperatorConfig
978982
})
979983

980984
Context("when the ArgoCD instance does not exist", func() {
981985
It("should create a new ArgoCD instance", func() {
982-
err := createOrUpdateArgoCD(dynamicClient, nil, name, namespace)
986+
err := createOrUpdateArgoCD(dynamicClient, nil, name, namespace, patternsOperatorConfig)
983987
Expect(err).ToNot(HaveOccurred())
984988

985989
argoCD, err := dynamicClient.Resource(gvr).Namespace(namespace).Get(context.TODO(), name, metav1.GetOptions{})
@@ -1007,7 +1011,7 @@ var _ = Describe("CreateOrUpdateArgoCD", func() {
10071011
})
10081012

10091013
It("should update the existing ArgoCD instance", func() {
1010-
err := createOrUpdateArgoCD(dynamicClient, nil, name, namespace)
1014+
err := createOrUpdateArgoCD(dynamicClient, nil, name, namespace, patternsOperatorConfig)
10111015
Expect(err).ToNot(HaveOccurred())
10121016

10131017
argoCD, err := dynamicClient.Resource(gvr).Namespace(namespace).Get(context.TODO(), name, metav1.GetOptions{})
@@ -1038,7 +1042,7 @@ var _ = Describe("CreateOrUpdateArgoCD", func() {
10381042
})
10391043

10401044
It("should propagate the error and not update the existing argocd", func() {
1041-
err := createOrUpdateArgoCD(dynamicClient, nil, name, namespace)
1045+
err := createOrUpdateArgoCD(dynamicClient, nil, name, namespace, patternsOperatorConfig)
10421046
Expect(err).To(HaveOccurred())
10431047

10441048
argoCD, err := dynamicClient.Resource(gvr).Namespace(namespace).Get(context.TODO(), name, metav1.GetOptions{})
@@ -2098,72 +2102,82 @@ var _ = Describe("newArgoGiteaApplication", func() {
20982102
})
20992103

21002104
var _ = Describe("newArgoCD", func() {
2105+
var argo *argooperator.ArgoCD
2106+
21012107
It("should create an ArgoCD with the correct name and namespace", func() {
2102-
argo := newArgoCD("test-argo", "test-ns")
2108+
argo = newArgoCD("test-argo", "test-ns", DefaultPatternsOperatorConfig)
21032109
Expect(argo.Name).To(Equal("test-argo"))
21042110
Expect(argo.Namespace).To(Equal("test-ns"))
21052111
})
21062112

21072113
It("should have the argoproj.io/finalizer", func() {
2108-
argo := newArgoCD("test-argo", "test-ns")
2114+
argo = newArgoCD("test-argo", "test-ns", DefaultPatternsOperatorConfig)
21092115
Expect(argo.Finalizers).To(ContainElement("argoproj.io/finalizer"))
21102116
})
21112117

21122118
It("should have HA disabled", func() {
2113-
argo := newArgoCD("test-argo", "test-ns")
2119+
argo = newArgoCD("test-argo", "test-ns", DefaultPatternsOperatorConfig)
21142120
Expect(argo.Spec.HA.Enabled).To(BeFalse())
21152121
})
21162122

21172123
It("should have monitoring disabled", func() {
2118-
argo := newArgoCD("test-argo", "test-ns")
2124+
argo = newArgoCD("test-argo", "test-ns", DefaultPatternsOperatorConfig)
21192125
Expect(argo.Spec.Monitoring.Enabled).To(BeFalse())
21202126
})
21212127

21222128
It("should have notifications disabled", func() {
2123-
argo := newArgoCD("test-argo", "test-ns")
2129+
argo = newArgoCD("test-argo", "test-ns", DefaultPatternsOperatorConfig)
21242130
Expect(argo.Spec.Notifications.Enabled).To(BeFalse())
21252131
})
21262132

21272133
It("should have SSO configured with Dex provider", func() {
2128-
argo := newArgoCD("test-argo", "test-ns")
2134+
argo = newArgoCD("test-argo", "test-ns", DefaultPatternsOperatorConfig)
21292135
Expect(argo.Spec.SSO).ToNot(BeNil())
21302136
Expect(argo.Spec.SSO.Provider).To(Equal(argooperator.SSOProviderTypeDex))
21312137
Expect(argo.Spec.SSO.Dex).ToNot(BeNil())
21322138
Expect(argo.Spec.SSO.Dex.OpenShiftOAuth).To(BeTrue())
21332139
})
21342140

21352141
It("should have server route enabled with reencrypt TLS", func() {
2136-
argo := newArgoCD("test-argo", "test-ns")
2142+
argo = newArgoCD("test-argo", "test-ns", DefaultPatternsOperatorConfig)
21372143
Expect(argo.Spec.Server.Route.Enabled).To(BeTrue())
21382144
Expect(argo.Spec.Server.Route.TLS).ToNot(BeNil())
21392145
Expect(argo.Spec.Server.Route.TLS.Termination).To(Equal(routev1.TLSTerminationReencrypt))
21402146
})
21412147

21422148
It("should have resource exclusions for tekton", func() {
2143-
argo := newArgoCD("test-argo", "test-ns")
2149+
argo = newArgoCD("test-argo", "test-ns", DefaultPatternsOperatorConfig)
21442150
Expect(argo.Spec.ResourceExclusions).To(ContainSubstring("tekton.dev"))
21452151
Expect(argo.Spec.ResourceExclusions).To(ContainSubstring("TaskRun"))
21462152
Expect(argo.Spec.ResourceExclusions).To(ContainSubstring("PipelineRun"))
21472153
})
21482154

21492155
It("should have resource health checks for Subscription", func() {
2150-
argo := newArgoCD("test-argo", "test-ns")
2156+
argo = newArgoCD("test-argo", "test-ns", DefaultPatternsOperatorConfig)
21512157
Expect(argo.Spec.ResourceHealthChecks).To(HaveLen(1))
21522158
Expect(argo.Spec.ResourceHealthChecks[0].Group).To(Equal("operators.coreos.com"))
21532159
Expect(argo.Spec.ResourceHealthChecks[0].Kind).To(Equal("Subscription"))
21542160
})
21552161

21562162
It("should have init containers for CA cert fetching", func() {
2157-
argo := newArgoCD("test-argo", "test-ns")
2163+
argo = newArgoCD("test-argo", "test-ns", DefaultPatternsOperatorConfig)
21582164
Expect(argo.Spec.Repo.InitContainers).To(HaveLen(1))
21592165
Expect(argo.Spec.Repo.InitContainers[0].Name).To(Equal("fetch-ca"))
21602166
})
21612167

2162-
It("should have correct RBAC policy", func() {
2163-
argo := newArgoCD("test-argo", "test-ns")
2168+
It("should have correct RBAC policy with defaults", func() {
2169+
argo = newArgoCD("test-argo", "test-ns", DefaultPatternsOperatorConfig)
21642170
Expect(argo.Spec.RBAC.Policy).ToNot(BeNil())
21652171
Expect(*argo.Spec.RBAC.Policy).To(ContainSubstring("cluster-admins"))
21662172
})
2173+
2174+
It("should have correct RBAC policy with additional admin", func() {
2175+
argo = newArgoCD("test-argo", "test-ns", PatternsOperatorConfig{"gitops.additionalArgoAdmins": "test-admins"})
2176+
Expect(argo.Spec.RBAC.Policy).ToNot(BeNil())
2177+
Expect(*argo.Spec.RBAC.Policy).To(ContainSubstring("cluster-admins"))
2178+
Expect(*argo.Spec.RBAC.Policy).To(ContainSubstring("test-admins"))
2179+
})
2180+
21672181
})
21682182

21692183
var _ = Describe("commonSyncPolicy", func() {

‎internal/controller/defaults.go‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -87,16 +87,17 @@ const (
8787
// Currently none
8888

8989
var DefaultPatternsOperatorConfig = map[string]string{
90-
"gitops.catalogSource": GitOpsDefaultCatalogSource,
91-
"gitops.channel": GitOpsDefaultChannel,
92-
"gitops.sourceNamespace": GitOpsDefaultCatalogSourceNamespace,
93-
"gitops.installApprovalPlan": GitOpsDefaultApprovalPlan,
94-
"gitops.csv": GitOpsDefaultCSV,
95-
"gitea.chartName": GiteaChartName,
96-
"gitea.helmRepoUrl": GiteaHelmRepoUrl,
97-
"gitea.chartVersion": GiteaDefaultChartVersion,
98-
"analytics.enabled": "true",
99-
"catalog.image": "",
90+
"gitops.catalogSource": GitOpsDefaultCatalogSource,
91+
"gitops.channel": GitOpsDefaultChannel,
92+
"gitops.sourceNamespace": GitOpsDefaultCatalogSourceNamespace,
93+
"gitops.installApprovalPlan": GitOpsDefaultApprovalPlan,
94+
"gitops.csv": GitOpsDefaultCSV,
95+
"gitops.additionalArgoAdmins": "",
96+
"gitea.chartName": GiteaChartName,
97+
"gitea.helmRepoUrl": GiteaHelmRepoUrl,
98+
"gitea.chartVersion": GiteaDefaultChartVersion,
99+
"analytics.enabled": "true",
100+
"catalog.image": "",
100101
}
101102

102103
type PatternsOperatorConfig map[string]string

‎internal/controller/defaults_test.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,11 @@ var _ = Describe("PatternsOperatorConfig getValueWithDefault", func() {
3636
Expect(config.getValueWithDefault("gitops.installApprovalPlan")).To(Equal(GitOpsDefaultApprovalPlan))
3737
})
3838

39+
It("should return the default value for gitops.additionalArgoAdmins", func() {
40+
config := PatternsOperatorConfig{}
41+
Expect(config.getValueWithDefault("gitops.additionalArgoAdmins")).To(Equal(""))
42+
})
43+
3944
It("should return the default value for gitea.chartName", func() {
4045
config := PatternsOperatorConfig{}
4146
Expect(config.getValueWithDefault("gitea.chartName")).To(Equal(GiteaChartName))

‎internal/controller/pattern_controller.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -250,7 +250,7 @@ func (r *PatternReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
250250
}
251251

252252
// We only update the clusterwide argo instance so we can define our own 'initcontainers' section
253-
err = createOrUpdateArgoCD(r.dynamicClient, r.fullClient, getClusterWideArgoName(), clusterWideNS)
253+
err = createOrUpdateArgoCD(r.dynamicClient, r.fullClient, getClusterWideArgoName(), clusterWideNS, patternsOperatorConfig)
254254
if err != nil {
255255
return r.actionPerformed(qualifiedInstance, "created or updated clusterwide argo instance", err)
256256
}

0 commit comments

Comments
 (0)