Skip to content

Commit 80f1349

Browse files
mbaldessarimbaldessari
authored
Merge pull request #109 from mbaldessari/ourown-gitops
Allow clusterwide namespace to be a parameter
2 parents bf4d1de + 92ae690 commit 80f1349

8 files changed

Lines changed: 185 additions & 20 deletions

File tree

‎templates/_helpers.tpl‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ Default always defined top-level variables for helm charts
3838
value: {{ $.Values.global.deletePattern }}
3939
- name: global.gitOpsSubNamespace
4040
value: {{ $.Values.global.gitOpsSubNamespace | default "" }}
41+
- name: global.vpArgoNamespace
42+
value: {{ $.Values.global.vpArgoNamespace }}
4143
{{- end }} {{/* clustergroup.globalvaluesparameters */}}
4244

4345

@@ -127,13 +129,14 @@ Called from common/clustergroup/templates/plumbing/projects.yaml
127129
{{- $projects := index . 0 }}
128130
{{- $namespace := index . 1 }}
129131
{{- $enabled := index . 2 }}
132+
{{- $argoNamespace := index . 3 }}
130133
{{- range $k, $v := $projects}}
131134
apiVersion: argoproj.io/v1alpha1
132135
kind: AppProject
133136
metadata:
134137
name: {{ $k }}
135138
{{- if (eq $enabled "plumbing") }}
136-
namespace: openshift-gitops
139+
namespace: {{ $argoNamespace }}
137140
{{- else }}
138141
namespace: {{ $namespace }}
139142
{{- end }}
@@ -155,21 +158,22 @@ status: {}
155158
{{- end }}
156159
{{- end }}
157160

158-
{{/*
161+
{{/*
159162
Helper function to generate AppProject from a list object.
160-
Called from common/clustergroup/templates/plumbing/projects.yaml
163+
Called from common/clustergroup/templates/plumbing/projects.yaml
161164
*/}}
162165
{{- define "clustergroup.template.plumbing.projects.list" -}}
163166
{{- $projects := index . 0 }}
164167
{{- $namespace := index . 1 }}
165168
{{- $enabled := index . 2 }}
169+
{{- $argoNamespace := index . 3 }}
166170
{{- range $projects}}
167171
apiVersion: argoproj.io/v1alpha1
168172
kind: AppProject
169173
metadata:
170174
name: {{ . }}
171175
{{- if (eq $enabled "plumbing") }}
172-
namespace: openshift-gitops
176+
namespace: {{ $argoNamespace }}
173177
{{- else }}
174178
namespace: {{ $namespace }}
175179
{{- end }}

‎templates/imperative/_helpers.tpl‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,15 +46,15 @@
4646
- 'sh'
4747
- '-c'
4848
- >-
49-
if ! oc get secrets -n openshift-gitops vp-private-repo-credentials &> /dev/null; then
49+
if ! oc get secrets -n {{ $.Values.global.vpArgoNamespace }} vp-private-repo-credentials &> /dev/null; then
5050
URL="{{ $.Values.global.repoURL }}";
5151
else
52-
if ! oc get secrets -n openshift-gitops vp-private-repo-credentials -o go-template='{{ `{{index .data.sshPrivateKey | base64decode}}` }}' &>/dev/null; then
53-
U="$(oc get secret -n openshift-gitops vp-private-repo-credentials -o go-template='{{ `{{index .data.username | base64decode }}` }}')";
54-
P="$(oc get secret -n openshift-gitops vp-private-repo-credentials -o go-template='{{ `{{index .data.password | base64decode }}` }}')";
52+
if ! oc get secrets -n {{ $.Values.global.vpArgoNamespace }} vp-private-repo-credentials -o go-template='{{ `{{index .data.sshPrivateKey | base64decode}}` }}' &>/dev/null; then
53+
U="$(oc get secret -n {{ $.Values.global.vpArgoNamespace }} vp-private-repo-credentials -o go-template='{{ `{{index .data.username | base64decode }}` }}')";
54+
P="$(oc get secret -n {{ $.Values.global.vpArgoNamespace }} vp-private-repo-credentials -o go-template='{{ `{{index .data.password | base64decode }}` }}')";
5555
URL=$(echo {{ $.Values.global.repoURL }} | sed -E "s/(https?:\/\/)/\1${U}:${P}@/");
5656
else
57-
S="$(oc get secret -n openshift-gitops vp-private-repo-credentials -o go-template='{{ `{{index .data.sshPrivateKey | base64decode }}` }}')";
57+
S="$(oc get secret -n {{ $.Values.global.vpArgoNamespace }} vp-private-repo-credentials -o go-template='{{ `{{index .data.sshPrivateKey | base64decode }}` }}')";
5858
mkdir -p --mode 0700 "${HOME}/.ssh";
5959
echo "${S}" > "${HOME}/.ssh/id_rsa";
6060
chmod 0600 "${HOME}/.ssh/id_rsa";

‎templates/plumbing/argoProjects.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
{{- end }}
1919

2020
{{- if kindIs "map" $projects }}
21-
{{- template "clustergroup.template.plumbing.projects.map" (list $projects $namespace $.Values.enabled) }}
21+
{{- template "clustergroup.template.plumbing.projects.map" (list $projects $namespace $.Values.enabled $.Values.global.vpArgoNamespace) }}
2222
{{- else }}
2323
{{- range $projects }}
2424
apiVersion: argoproj.io/v1alpha1

‎templates/plumbing/argocd-super-role.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,24 @@
11
# WARNING: ONLY USE THIS FOR MANAGING CLUSTERS NOT FOR REGULAR USERS
22
# This CRB is also pre-created by the ACM policy (application-policies.yaml)
3-
# on managed clusters to ensure the openshift-gitops controller has cluster-admin
3+
# on managed clusters to ensure the ArgoCD controller has cluster-admin
44
# before the first sync. It's kept here for non-ACM deployments.
55
# See the commit messages around this change for a full explanation
66
apiVersion: rbac.authorization.k8s.io/v1
77
kind: ClusterRoleBinding
88
metadata:
9-
name: openshift-gitops-cluster-admin-rolebinding
9+
name: {{ $.Values.global.vpArgoNamespace }}-cluster-admin-rolebinding
1010
roleRef:
1111
apiGroup: rbac.authorization.k8s.io
1212
kind: ClusterRole
1313
name: cluster-admin
1414
subjects:
1515
- kind: ServiceAccount
16-
name: openshift-gitops-argocd-application-controller
17-
namespace: openshift-gitops
16+
name: {{ $.Values.global.vpArgoNamespace }}-argocd-application-controller
17+
namespace: {{ $.Values.global.vpArgoNamespace }}
1818
# NOTE: THIS MUST BE FIXED FOR MULTITENANT SETUP
1919
- kind: ServiceAccount
20-
name: openshift-gitops-argocd-server
21-
namespace: openshift-gitops
20+
name: {{ $.Values.global.vpArgoNamespace }}-argocd-server
21+
namespace: {{ $.Values.global.vpArgoNamespace }}
2222
---
2323
# WARNING: ONLY USE THIS FOR MANAGING CLUSTERS NOT FOR REGULAR USERS
2424
apiVersion: rbac.authorization.k8s.io/v1

‎tests/application_multi_source_test.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ tests:
6262
value: acm
6363
lengthEqual:
6464
path: spec.sources[1].helm.parameters
65-
count: 18
65+
count: 19
6666
- documentSelector:
6767
path: metadata.name
6868
value: vault
@@ -96,4 +96,4 @@ tests:
9696
value: acm
9797
lengthEqual:
9898
path: spec.sources[1].helm.parameters
99-
count: 20
99+
count: 21

‎tests/argocd_super_role_test.yaml‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
suite: Test argocd-super-role with vpArgoNamespace
2+
templates:
3+
- templates/plumbing/argocd-super-role.yaml
4+
release:
5+
name: release-test
6+
tests:
7+
- it: should use default vpArgoNamespace (openshift-gitops) in first ClusterRoleBinding
8+
set:
9+
global:
10+
pattern: common
11+
vpArgoNamespace: openshift-gitops
12+
clusterGroup:
13+
name: hub
14+
asserts:
15+
- documentIndex: 0
16+
isKind:
17+
of: ClusterRoleBinding
18+
- documentIndex: 0
19+
equal:
20+
path: metadata.name
21+
value: openshift-gitops-cluster-admin-rolebinding
22+
- documentIndex: 0
23+
equal:
24+
path: subjects[0].name
25+
value: openshift-gitops-argocd-application-controller
26+
- documentIndex: 0
27+
equal:
28+
path: subjects[0].namespace
29+
value: openshift-gitops
30+
- documentIndex: 0
31+
equal:
32+
path: subjects[1].name
33+
value: openshift-gitops-argocd-server
34+
- documentIndex: 0
35+
equal:
36+
path: subjects[1].namespace
37+
value: openshift-gitops
38+
39+
- it: should use custom vpArgoNamespace in first ClusterRoleBinding
40+
set:
41+
global:
42+
pattern: common
43+
vpArgoNamespace: my-custom-gitops
44+
clusterGroup:
45+
name: hub
46+
asserts:
47+
- documentIndex: 0
48+
equal:
49+
path: metadata.name
50+
value: my-custom-gitops-cluster-admin-rolebinding
51+
- documentIndex: 0
52+
equal:
53+
path: subjects[0].name
54+
value: my-custom-gitops-argocd-application-controller
55+
- documentIndex: 0
56+
equal:
57+
path: subjects[0].namespace
58+
value: my-custom-gitops
59+
- documentIndex: 0
60+
equal:
61+
path: subjects[1].name
62+
value: my-custom-gitops-argocd-server
63+
- documentIndex: 0
64+
equal:
65+
path: subjects[1].namespace
66+
value: my-custom-gitops
67+
68+
- it: should produce two ClusterRoleBinding documents
69+
set:
70+
global:
71+
pattern: common
72+
vpArgoNamespace: openshift-gitops
73+
clusterGroup:
74+
name: hub
75+
asserts:
76+
- hasDocuments:
77+
count: 2
78+
79+
- it: second ClusterRoleBinding should use pattern-clusterGroup namespace (not vpArgoNamespace)
80+
set:
81+
global:
82+
pattern: mypattern
83+
vpArgoNamespace: my-custom-gitops
84+
clusterGroup:
85+
name: edge
86+
asserts:
87+
- documentIndex: 1
88+
equal:
89+
path: metadata.name
90+
value: mypattern-edge-cluster-admin-rolebinding
91+
- documentIndex: 1
92+
equal:
93+
path: subjects[0].namespace
94+
value: mypattern-edge
95+
- documentIndex: 1
96+
equal:
97+
path: subjects[1].namespace
98+
value: mypattern-edge

‎tests/argoprojects_test.yaml‎

Lines changed: 63 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ tests:
105105
- hasDocuments:
106106
count: 2
107107
- documentSelector:
108-
path: metadata.name
108+
path: metadata.name
109109
value: foo
110110
isSubset:
111111
path: spec
@@ -123,7 +123,7 @@ tests:
123123
sourceRepos:
124124
- '*'
125125
- documentSelector:
126-
path: metadata.name
126+
path: metadata.name
127127
value: bar
128128
isSubset:
129129
path: spec
@@ -140,3 +140,64 @@ tests:
140140
kind: '*'
141141
sourceRepos:
142142
- '*'
143+
144+
- it: should use vpArgoNamespace for map projects when enabled is plumbing
145+
set:
146+
enabled: plumbing
147+
global:
148+
pattern: testpattern
149+
vpArgoNamespace: my-custom-gitops
150+
clusterGroup:
151+
name: hub
152+
argoProjects:
153+
proj-one:
154+
proj-two:
155+
asserts:
156+
- hasDocuments:
157+
count: 2
158+
- documentSelector:
159+
path: metadata.name
160+
value: proj-one
161+
equal:
162+
path: metadata.namespace
163+
value: my-custom-gitops
164+
- documentSelector:
165+
path: metadata.name
166+
value: proj-two
167+
equal:
168+
path: metadata.namespace
169+
value: my-custom-gitops
170+
171+
- it: should use default vpArgoNamespace for map projects when enabled is plumbing
172+
set:
173+
enabled: plumbing
174+
global:
175+
pattern: testpattern
176+
vpArgoNamespace: openshift-gitops
177+
clusterGroup:
178+
name: hub
179+
argoProjects:
180+
my-project:
181+
asserts:
182+
- hasDocuments:
183+
count: 1
184+
- equal:
185+
path: metadata.namespace
186+
value: openshift-gitops
187+
188+
- it: should use pattern namespace for map projects when enabled is not plumbing
189+
set:
190+
enabled: something-else
191+
global:
192+
pattern: testpattern
193+
vpArgoNamespace: my-custom-gitops
194+
clusterGroup:
195+
name: hub
196+
argoProjects:
197+
my-project:
198+
asserts:
199+
- hasDocuments:
200+
count: 1
201+
- equal:
202+
path: metadata.namespace
203+
value: testpattern-hub

‎values.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
global:
22
extraValueFiles: []
33
pattern: common
4+
# cluster-wide argo namespace
5+
vpArgoNamespace: openshift-gitops
46
secretLoader:
57
disabled: false
68
secretStore:

0 commit comments

Comments
 (0)