diff --git a/go.mod b/go.mod index f160a21519a..80433c3d641 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,7 @@ go 1.26.2 require ( github.com/argoproj-labs/argo-rollouts-manager v0.0.9-0.20260505092152-3e07addcb2cb github.com/argoproj-labs/argocd-image-updater v1.2.1 - github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260716120206-de224a6ab38e + github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260720145510-44e236a96f0e github.com/argoproj/argo-cd/gitops-engine v0.7.1-0.20250908182407-97ad5b59a627 github.com/argoproj/argo-cd/v3 v3.4.2 github.com/go-logr/logr v1.4.3 diff --git a/go.sum b/go.sum index ab22269d657..2aac0c19ac5 100644 --- a/go.sum +++ b/go.sum @@ -43,8 +43,8 @@ github.com/argoproj-labs/argo-rollouts-manager v0.0.9-0.20260505092152-3e07addcb github.com/argoproj-labs/argo-rollouts-manager v0.0.9-0.20260505092152-3e07addcb2cb/go.mod h1:Ouqjtkj48SPJhW6r00CYqJ4uM7QDy3D4tinKIK9Y69Q= github.com/argoproj-labs/argocd-image-updater v1.2.1 h1:yaJdmpFOOKTkC9688/a7jjOBLpCREj7Wdnmn4A3v1nU= github.com/argoproj-labs/argocd-image-updater v1.2.1/go.mod h1:sBS1JqoM9R0QhIDVD4bdWS/GejDQaFwdFUV+yE9TzjA= -github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260716120206-de224a6ab38e h1:ZhAGLdcI5+/48qvzTPeSReusNmr0+Joo+4OE3Zmi00U= -github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260716120206-de224a6ab38e/go.mod h1:vVd7s8gzmMfA3pueuG5ylvvdIk3aFlk+M3uf0xrIvDE= +github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260720145510-44e236a96f0e h1:LCdi1EWXRz6PtKchTtakEhon1X1zSp3hvFx2oCzSg48= +github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260720145510-44e236a96f0e/go.mod h1:vVd7s8gzmMfA3pueuG5ylvvdIk3aFlk+M3uf0xrIvDE= github.com/argoproj/argo-cd/gitops-engine v0.0.0-20260512203152-0dc6b1b57dd5 h1:IMzPK0gt1lZRDHtiKGzU0VAez0FmT2veytxlmE2AwyU= github.com/argoproj/argo-cd/gitops-engine v0.0.0-20260512203152-0dc6b1b57dd5/go.mod h1:6Q1KZzkeKlnCpzzZ1Fu72+WPMAt+ZeMD9KOO6aMjW68= github.com/argoproj/argo-cd/v3 v3.4.2 h1:S3j0K34uGW4geWiM88+0cHcCEtInn2Sa9U7/Sa18L7Y= diff --git a/test/openshift/e2e/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go b/test/openshift/e2e/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go index aa867da528f..21c342bdb79 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go @@ -21,10 +21,13 @@ import ( "os" "time" - argov1beta1api "github.com/argoproj-labs/argocd-operator/api/v1beta1" - "github.com/argoproj-labs/argocd-operator/controllers/argoutil" . "github.com/onsi/ginkgo/v2" . "github.com/onsi/gomega" + + "github.com/argoproj-labs/argocd-operator/controllers/argoutil" + + argov1beta1api "github.com/argoproj-labs/argocd-operator/api/v1beta1" + "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture" argocdFixture "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture/argocd" deplFixture "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture/deployment" @@ -32,6 +35,7 @@ import ( osFixture "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture/os" statefulsetFixture "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture/statefulset" fixtureUtils "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture/utils" + appsv1 "k8s.io/api/apps/v1" corev1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -39,9 +43,7 @@ import ( ) var _ = Describe("GitOps Operator Parallel E2E Tests", func() { - Context("1-066_validate_redis_secure_comm_no_autotls_no_ha", func() { - var ( k8sClient client.Client ctx context.Context @@ -61,12 +63,10 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { }) It("validates that Argo CD components correctly inherit 'argocd-operator-redis-tls' Secret once it is created", func() { - By("creating simple namespace-scoped Argo CD instance") ns, cleanupFunc = fixture.CreateRandomE2ETestNamespaceWithCleanupFunc() expectComponentsAreRunning := func() { - time.Sleep(15 * time.Second) // I don't see an easier way to detect when deployment/statefulset controller have reconciled the changes we have made. So instead we just use a long delay. deploymentsShouldExist := []string{"argocd-redis", "argocd-server", "argocd-repo-server"} @@ -81,7 +81,6 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { Eventually(statefulSet, "60s", "5s").Should(k8sFixture.ExistByName()) Eventually(statefulSet, "60s", "5s").Should(statefulsetFixture.HaveReplicas(1)) Eventually(statefulSet, "60s", "5s").Should(statefulsetFixture.HaveReadyReplicas(1)) - } argoCD := &argov1beta1api.ArgoCD{ @@ -108,7 +107,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { opensslTestCNFContents := "\n[SAN]\nsubjectAltName=DNS:argocd-redis." + ns.Name + ".svc.cluster.local\n[req]\ndistinguished_name=req" - err = os.WriteFile(openssl_test_File.Name(), ([]byte)(opensslTestCNFContents), 0666) + err = os.WriteFile(openssl_test_File.Name(), ([]byte)(opensslTestCNFContents), 0o666) Expect(err).ToNot(HaveOccurred()) _, err = osFixture.ExecCommandWithOutputParam(false, true, "openssl", "req", "-new", "-x509", "-sha256", @@ -143,7 +142,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { By("expecting redis-server to have desired container process command/arguments") - expectedString := "--save \"\" --appendonly no --aclfile /app/config/redis-auth/users.acl --tls-protocols TLSv1.2 --tls-ciphers TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 --tls-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 --tls-port 6379 --port 0 --tls-cert-file /app/config/redis/tls/tls.crt --tls-key-file /app/config/redis/tls/tls.key --tls-auth-clients no" + expectedString := "--save \"\" --appendonly no --aclfile /app/config/redis-auth/users.acl --tls-port 6379 --port 0 --tls-cert-file /app/config/redis/tls/tls.crt --tls-key-file /app/config/redis/tls/tls.key --tls-auth-clients no" if !fixture.IsUpstreamOperatorTests() { // Downstream operator adds these arguments @@ -157,27 +156,25 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { Eventually(repoServerDepl).Should(k8sFixture.ExistByName()) By("expecting repo-server to have desired container process command/arguments") - Expect(repoServerDepl).To(deplFixture.HaveContainerCommandSubstring("uid_entrypoint.sh argocd-repo-server --redis argocd-redis."+ns.Name+".svc.cluster.local:6379 --redis-use-tls --redis-ca-certificate /app/config/reposerver/tls/redis/tls.crt --loglevel info --logformat text", 0), + Expect(repoServerDepl).To(deplFixture.HaveContainerCommandSubstring("uid_entrypoint.sh argocd-repo-server --redis argocd-redis."+ns.Name+".svc.cluster.local.:6379 --redis-use-tls --redis-ca-certificate /app/config/reposerver/tls/redis/tls.crt --loglevel info --logformat text", 0), "TLS .spec.template.spec.containers.command for argocd-repo-server deployment is wrong") argocdServerDepl := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: "argocd-server", Namespace: ns.Name}} Eventually(argocdServerDepl).Should(k8sFixture.ExistByName()) By("expecting argocd-server to have desired container process command/arguments") - Expect(argocdServerDepl).To(deplFixture.HaveContainerCommandSubstring("argocd-server --staticassets /shared/app --dex-server https://argocd-dex-server."+ns.Name+".svc.cluster.local:5556 --repo-server argocd-repo-server."+ns.Name+".svc.cluster.local:8081 --redis argocd-redis."+ns.Name+".svc.cluster.local:6379 --redis-use-tls --redis-ca-certificate /app/config/server/tls/redis/tls.crt --loglevel info --logformat text", 0), + Expect(argocdServerDepl).To(deplFixture.HaveContainerCommandSubstring("argocd-server --staticassets /shared/app --dex-server https://argocd-dex-server."+ns.Name+".svc.cluster.local.:5556 --repo-server argocd-repo-server."+ns.Name+".svc.cluster.local.:8081 --redis argocd-redis."+ns.Name+".svc.cluster.local.:6379 --redis-use-tls --redis-ca-certificate /app/config/server/tls/redis/tls.crt --loglevel info --logformat text", 0), "TLS .spec.template.spec.containers.command for argocd-server deployment is wrong") By("expecting application-controller to have desired container process command/arguments") applicationControllerSS := &appsv1.StatefulSet{ObjectMeta: metav1.ObjectMeta{Name: "argocd-application-controller", Namespace: ns.Name}} Eventually(applicationControllerSS).Should(k8sFixture.ExistByName()) - Expect(applicationControllerSS).To(statefulsetFixture.HaveContainerCommandSubstring("argocd-application-controller --operation-processors 10 --redis argocd-redis."+ns.Name+".svc.cluster.local:6379 --redis-use-tls --redis-ca-certificate /app/config/controller/tls/redis/tls.crt --repo-server argocd-repo-server."+ns.Name+".svc.cluster.local:8081 --status-processors 20 --kubectl-parallelism-limit 10 --loglevel info --logformat text", 0), + Expect(applicationControllerSS).To(statefulsetFixture.HaveContainerCommandSubstring("argocd-application-controller --operation-processors 10 --redis argocd-redis."+ns.Name+".svc.cluster.local.:6379 --redis-use-tls --redis-ca-certificate /app/config/controller/tls/redis/tls.crt --repo-server argocd-repo-server."+ns.Name+".svc.cluster.local.:8081 --status-processors 20 --kubectl-parallelism-limit 10 --loglevel info --logformat text", 0), "TLS .spec.template.spec.containers.command for argocd-application-controller statefulsets is wrong") - }) It("verify redis credential distribution", func() { - By("creating simple Argo CD instance") ns, cleanupFunc = fixture.CreateRandomE2ETestNamespaceWithCleanupFunc() diff --git a/test/openshift/e2e/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go b/test/openshift/e2e/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go index 6af261cbe11..0675060605b 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go @@ -44,7 +44,6 @@ import ( ) var _ = Describe("GitOps Operator Sequential E2E Tests", func() { - const ( argoCDName = "example" argoCDAgentPrincipalName = "example-agent-principal" // argoCDName + "-agent-principal" @@ -54,7 +53,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { ) Context("1-051_validate_argocd_agent_principal", func() { - var ( k8sClient client.Client ctx context.Context @@ -71,17 +69,17 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { principalDeployment *appsv1.Deployment expectedEnvVariables map[string]string secretNames agentFixture.AgentSecretNames - principalNetworkPolicy *networkingv1.NetworkPolicy principalRoute *routev1.Route + principalNetworkPolicy *networkingv1.NetworkPolicy resourceProxyServiceName string principalResources agentFixture.PrincipalResources ) BeforeEach(func() { fixture.EnsureSequentialCleanSlate() + k8sClient, _ = fixtureUtils.GetE2ETestKubeClient() fixture.SetEnvInOperatorSubscriptionOrDeployment("ARGOCD_CLUSTER_CONFIG_NAMESPACES", "openshift-gitops, argocd-agent-principal-1-051") - k8sClient, _ = fixtureUtils.GetE2ETestKubeClient() ctx = context.Background() ns, cleanupFunc = fixture.CreateNamespaceWithCleanupFunc("argocd-agent-principal-1-051") @@ -192,12 +190,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { Namespace: ns.Name, }, } - principalNetworkPolicy = &networkingv1.NetworkPolicy{ - ObjectMeta: metav1.ObjectMeta{ - Name: fmt.Sprintf("%s-agent-principal-network-policy", argoCDName), - Namespace: ns.Name, - }, - } principalNetworkPolicy = &networkingv1.NetworkPolicy{ ObjectMeta: metav1.ObjectMeta{ @@ -293,9 +285,9 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { ClusterRoleBinding: clusterRoleBinding, PrincipalDeployment: principalDeployment, PrincipalRoute: principalRoute, - PrincipalNetworkPolicy: principalNetworkPolicy, SecretNames: secretNames, ServiceNames: serviceNames, + PrincipalNetworkPolicy: principalNetworkPolicy, DeploymentNames: deploymentNames, ExpectRoute: expectRoutePtr, }) @@ -347,7 +339,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { }) It("should create argocd agent principal resources, and pod should start successfully with default image", func() { - // Add a custom environment variable to the principal server argoCD.Spec.ArgoCDAgent.Principal.Env = []corev1.EnvVar{{Name: "TEST_ENV", Value: "test_value"}} @@ -409,7 +400,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { }) It("Should reflect configuration changes from ArgoCD CR to the principal deployment", func() { - By("Create ArgoCD instance") argoCD.Spec.ArgoCDAgent.Principal.Image = common.ArgoCDAgentPrincipalDefaultImageName @@ -437,7 +427,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { Expect(k8sClient.Get(ctx, client.ObjectKey{Name: argoCDName, Namespace: ns.Name}, argoCD)).To(Succeed()) argocdFixture.Update(argoCD, func(ac *argov1beta1api.ArgoCD) { - ac.Spec.ArgoCDAgent.Principal.LogLevel = "trace" ac.Spec.ArgoCDAgent.Principal.LogFormat = "json" ac.Spec.ArgoCDAgent.Principal.Server.KeepAliveMinInterval = "60s" @@ -460,7 +449,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { SecretName: "argocd-agent-resource-proxy-tls-v2", CASecretName: "argocd-agent-ca-v2", } - }) By("Create required secrets and certificates for principal pod to start properly") @@ -520,7 +508,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { }) It("should handle route disabled configuration correctly", func() { - By("Create ArgoCD instance with route disabled") argoCD.Spec.ArgoCDAgent.Principal.Server.Route = argov1beta1api.ArgoCDAgentPrincipalRouteSpec{ @@ -540,7 +527,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { }) It("should handle route enabled configuration correctly", func() { - By("Create ArgoCD instance with route enabled") argoCD.Spec.ArgoCDAgent.Principal.Server.Route = argov1beta1api.ArgoCDAgentPrincipalRouteSpec{ @@ -560,7 +546,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { }) It("should handle route toggle from enabled to disabled correctly", func() { - By("Create ArgoCD instance with route enabled") argoCD.Spec.ArgoCDAgent.Principal.Server.Route = argov1beta1api.ArgoCDAgentPrincipalRouteSpec{ @@ -626,7 +611,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { }) It("should handle service type ClusterIP configuration correctly", func() { - By("Create ArgoCD instance with service type ClusterIP") argoCD.Spec.ArgoCDAgent.Principal.Server.Service = argov1beta1api.ArgoCDAgentPrincipalServiceSpec{ @@ -651,7 +635,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { }) It("should handle service type LoadBalancer configuration correctly", func() { - By("Create ArgoCD instance with service type LoadBalancer") argoCD.Spec.ArgoCDAgent.Principal.Server.Service = argov1beta1api.ArgoCDAgentPrincipalServiceSpec{ @@ -676,7 +659,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { }) It("should handle service type updates correctly", func() { - By("Create ArgoCD instance with service type ClusterIP") argoCD.Spec.ArgoCDAgent.Principal.Server.Service = argov1beta1api.ArgoCDAgentPrincipalServiceSpec{ @@ -718,7 +700,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { }) It("should deploy principal via namespace-scoped ArgoCD instance and verify cluster role and cluster role binding are not created", func() { - By("Create namespace-scoped ArgoCD instance") // Create namespace for hosting namespace-scoped ArgoCD instance with principal @@ -772,7 +753,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { }) It("should delete existing cluster role and cluster role binding if ArgoCD instance is namespace-scoped", func() { - By("Create namespace-scoped ArgoCD instance namespace") // Create namespace for hosting namespace-scoped ArgoCD instance with principal @@ -916,7 +896,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { }) It("should create and delete principal ServiceMonitor based on prometheus enabled flag", func() { - By("Create ArgoCD instance with principal enabled and prometheus enabled") argoCD.Spec.Prometheus.Enabled = true @@ -963,5 +942,41 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { Eventually(principalServiceMonitor, "2m", "2s").Should(k8sFixture.NotExistByName()) }) + + It("shouldn't create ClusterRole and ClusterRoleBinding for principal if spec.DefaultClusterScopedRoleDisabled is set", func() { + By("Create ArgoCD instance with principal enabled and DefaultClusterScopedRoleDisabled is true") + argoCD.Spec.DefaultClusterScopedRoleDisabled = true + Expect(k8sClient.Create(ctx, argoCD)).To(Succeed()) + + By("Verify Argo CD CR is reconciled") + Eventually(principalDeployment).Should(k8sFixture.ExistByName()) + + By("Verify ClusterRole and ClusterRoleBinding do not exist") + Eventually(clusterRole, "60s", "2s").Should(k8sFixture.NotExistByName()) + Eventually(clusterRoleBinding, "60s", "2s").Should(k8sFixture.NotExistByName()) + + Consistently(clusterRole, "15s", "2s").Should(k8sFixture.NotExistByName()) + Consistently(clusterRoleBinding, "15s", "2s").Should(k8sFixture.NotExistByName()) + + By("Namespaced RBAC objects should still exist") + Eventually(role, "60s", "2s").Should(k8sFixture.ExistByName()) + Eventually(roleBinding, "60s", "2s").Should(k8sFixture.ExistByName()) + + By("Unset DefaultClusterScopedRoleDisabled and make sure cluster scoped RBAC objects are created") + argocdFixture.Update(argoCD, func(ac *argov1beta1api.ArgoCD) { + ac.Spec.DefaultClusterScopedRoleDisabled = false + }) + Eventually(clusterRole, "60s", "2s").Should(k8sFixture.ExistByName()) + Eventually(clusterRoleBinding, "60s", "2s").Should(k8sFixture.ExistByName()) + + By("Setting DefaultClusterScopedRoleDisabled again deletes clusterRole and clusterRoleBinding") + argocdFixture.Update(argoCD, func(ac *argov1beta1api.ArgoCD) { + ac.Spec.DefaultClusterScopedRoleDisabled = true + }) + Eventually(clusterRole, "60s", "2s").Should(k8sFixture.NotExistByName()) + Eventually(clusterRoleBinding, "60s", "2s").Should(k8sFixture.NotExistByName()) + Consistently(clusterRole, "10s", "2s").Should(k8sFixture.NotExistByName()) + Consistently(clusterRoleBinding, "10s", "2s").Should(k8sFixture.NotExistByName()) + }) }) }) diff --git a/test/openshift/e2e/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go b/test/openshift/e2e/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go index 4f09dd428ee..1e04388f85d 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go @@ -41,14 +41,12 @@ import ( ) var _ = Describe("GitOps Operator Sequential E2E Tests", func() { - const ( argoCDName = "example" argoCDAgentAgentName = "example-agent-agent" // argoCDName + "-agent-agent" ) Context("1-052_validate_argocd_agent_agent", func() { - var ( k8sClient client.Client ctx context.Context @@ -203,12 +201,12 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { // verifyExpectedResourcesExist will verify that the resources that are created for agent and ArgoCD are created. verifyExpectedResourcesExist := func(ns *corev1.Namespace) { - By("verifying expected resources exist") Eventually(&corev1.Secret{ ObjectMeta: metav1.ObjectMeta{ Name: secretNames[2], Namespace: ns.Name, - }}, "60s", "2s").Should(k8sFixture.ExistByName()) + }, + }, "60s", "2s").Should(k8sFixture.ExistByName()) Eventually(serviceAccount).Should(k8sFixture.ExistByName()) Eventually(role).Should(k8sFixture.ExistByName()) Eventually(roleBinding).Should(k8sFixture.ExistByName()) @@ -260,7 +258,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { // verifyResourcesDeleted will verify that the various resources that are created for agent are deleted. verifyResourcesDeleted := func() { - By("verifying resources are deleted for agent pod") Eventually(serviceAccount).Should(k8sFixture.NotExistByName()) @@ -323,7 +320,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { }) It("should create argocd agent agent resources with default image, but pod will not start without principal", func() { - // Add a custom environment variable to the agent client argoCD.Spec.ArgoCDAgent.Agent.Env = []corev1.EnvVar{{Name: "TEST_ENV", Value: "test_value"}} @@ -369,7 +365,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { }) It("Should reflect configuration changes from ArgoCD CR to the agent deployment", func() { - By("Create ArgoCD instance") argoCD.Spec.ArgoCDAgent.Agent.Image = common.ArgoCDAgentAgentDefaultImageName @@ -397,7 +392,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { Expect(k8sClient.Get(ctx, client.ObjectKey{Name: argoCDName, Namespace: ns.Name}, argoCD)).To(Succeed()) argocdFixture.Update(argoCD, func(ac *argov1beta1api.ArgoCD) { - ac.Spec.ArgoCDAgent.Agent.LogLevel = "trace" ac.Spec.ArgoCDAgent.Agent.LogFormat = "json" ac.Spec.ArgoCDAgent.Agent.Image = "quay.io/argoprojlabs/argocd-agent:v0.8.1" @@ -412,7 +406,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { ac.Spec.ArgoCDAgent.Agent.TLS.Insecure = ptr.To(true) ac.Spec.ArgoCDAgent.Agent.TLS.SecretName = "argocd-agent-client-tls-v2" ac.Spec.ArgoCDAgent.Agent.TLS.RootCASecretName = "argocd-agent-ca-v2" - }) By("Verify agent has the updated image we specified in ArgoCD CR") @@ -453,7 +446,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { }) It("should deploy agent via namespace-scoped ArgoCD instance and verify cluster role and cluster role binding are not created", func() { - By("Create namespace-scoped ArgoCD instance") // Create namespace for hosting namespace-scoped ArgoCD instance with agent @@ -507,7 +499,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { }) It("should delete existing cluster role and cluster role binding if ArgoCD instance is namespace-scoped", func() { - By("Create namespace-scoped ArgoCD instance namespace") // Create namespace for hosting namespace-scoped ArgoCD instance with agent @@ -587,7 +578,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { }) It("should create and delete agent ServiceMonitor based on prometheus enabled flag", func() { - By("Create ArgoCD instance with agent enabled and prometheus enabled") argoCD.Spec.Prometheus.Enabled = true @@ -634,5 +624,40 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { Eventually(agentServiceMonitor, "2m", "2s").Should(k8sFixture.NotExistByName()) }) + + It("shouldn't create ClusterRole and ClusterRoleBinding for agent if spec.DefaultClusterScopedRoleDisabled is set", func() { + By("Create ArgoCD instance with agent enabled and DefaultClusterScopedRoleDisabled is true") + argoCD.Spec.DefaultClusterScopedRoleDisabled = true + Expect(k8sClient.Create(ctx, argoCD)).To(Succeed()) + + By("Verify Argo CD becomes available") + Eventually(argoCD, "5m", "5s").Should(argocdFixture.BeAvailable()) + + By("Verify ClusterRole and ClusterRoleBinding do not exist") + Eventually(clusterRole, "60s", "2s").Should(k8sFixture.NotExistByName()) + Eventually(clusterRoleBinding, "60s", "2s").Should(k8sFixture.NotExistByName()) + Consistently(clusterRole, "15s", "2s").Should(k8sFixture.NotExistByName()) + Consistently(clusterRoleBinding, "15s", "2s").Should(k8sFixture.NotExistByName()) + + By("Namespaced RBAC objects should still exist") + Eventually(role, "60s", "2s").Should(k8sFixture.ExistByName()) + Eventually(roleBinding, "60s", "2s").Should(k8sFixture.ExistByName()) + + By("Unset DefaultClusterScopedRoleDisabled and make sure cluster scoped RBAC objects are created") + argocdFixture.Update(argoCD, func(ac *argov1beta1api.ArgoCD) { + ac.Spec.DefaultClusterScopedRoleDisabled = false + }) + Eventually(clusterRole, "60s", "2s").Should(k8sFixture.ExistByName()) + Eventually(clusterRoleBinding, "60s", "2s").Should(k8sFixture.ExistByName()) + + By("Setting DefaultClusterScopedRoleDisabled again deletes clusterRole and clusterRoleBinding") + argocdFixture.Update(argoCD, func(ac *argov1beta1api.ArgoCD) { + ac.Spec.DefaultClusterScopedRoleDisabled = true + }) + Eventually(clusterRole, "60s", "2s").Should(k8sFixture.NotExistByName()) + Eventually(clusterRoleBinding, "60s", "2s").Should(k8sFixture.NotExistByName()) + Consistently(clusterRole, "10s", "2s").Should(k8sFixture.NotExistByName()) + Consistently(clusterRoleBinding, "10s", "2s").Should(k8sFixture.NotExistByName()) + }) }) }) diff --git a/test/openshift/e2e/ginkgo/parallel/1-067_validate_redis_secure_comm_no_autotls_ha_test.go b/test/openshift/e2e/ginkgo/sequential/1-067_validate_redis_secure_comm_no_autotls_ha_test.go similarity index 99% rename from test/openshift/e2e/ginkgo/parallel/1-067_validate_redis_secure_comm_no_autotls_ha_test.go rename to test/openshift/e2e/ginkgo/sequential/1-067_validate_redis_secure_comm_no_autotls_ha_test.go index cf840f168d9..77149b68c61 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-067_validate_redis_secure_comm_no_autotls_ha_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-067_validate_redis_secure_comm_no_autotls_ha_test.go @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package parallel +package sequential import ( "context" @@ -39,9 +39,7 @@ import ( ) var _ = Describe("GitOps Operator Parallel E2E Tests", func() { - Context("1-067_validate_redis_secure_comm_no_autotls_ha", func() { - var ( k8sClient client.Client ctx context.Context @@ -81,7 +79,6 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { Expect(k8sClient.Create(ctx, argoCD)).To(Succeed()) expectComponentsAreRunning := func() { - // In BeAvailable() we wait 15 seconds for ArgoCD CR to be reconciled, this SHOULD be enough time. By("waiting for ArgoCD CR to be reconciled and the instance to be ready") @@ -112,7 +109,6 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { Eventually(statefulSet, "3m", "5s").Should(statefulsetFixture.HaveReplicas(replicas), "StatefulSet "+ss+" did not have correct replicas within timeout") Eventually(statefulSet, "6m", "10s").Should(statefulsetFixture.HaveReadyReplicas(replicas), "StatefulSet "+ss+" did not have ready replicas within timeout") } - } expectComponentsAreRunning() @@ -130,7 +126,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { opensslTestCNFContents := "\n[SAN]\nsubjectAltName=DNS:argocd-redis." + ns.Name + ".svc.cluster.local\n[req]\ndistinguished_name=req" - err = os.WriteFile(openssl_test_File.Name(), ([]byte)(opensslTestCNFContents), 0666) + err = os.WriteFile(openssl_test_File.Name(), ([]byte)(opensslTestCNFContents), 0o666) Expect(err).ToNot(HaveOccurred()) _, err = osFixture.ExecCommandWithOutputParam(false, true, "openssl", "req", "-new", "-x509", "-sha256",