Feat: disable GitOps Service and default instance on xKS clusters#1172
Feat: disable GitOps Service and default instance on xKS clusters#1172anandrkskd wants to merge 4 commits into
Conversation
📝 WalkthroughWalkthroughAdds an exported OpenShift detection helper and uses it to: (1) skip registering the ReconcileGitopsService controller on non-OpenShift clusters, and (2) skip ArgoCD SSO/Dex configuration when the cluster is not OpenShift or external auth is enabled. Tests updated to assert both paths. ChangesOpenShift gating and controller/SSO behavior
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
/retest |
Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com>
…shift.io API doesn't exist. Gate on config.openshift.io presence before configuring SSO. assisted-by: claude-code Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com>
anandrkskd
force-pushed
the
disable-default-instance-on-xks
branch
from
9aafd89 to
2b77b2b
Compare
Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com>
assisted-by: Cursor for code-review Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com>
anandrkskd
changed the title
anandrkskd
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
controllers/argocd/argocd.go (1)
101-103: 💤 Low valueConsider passing context through instead of using context.TODO().
Using
context.TODO()is not ideal for production code. Consider adding acontext.Contextparameter togetArgoSSOSpecand passing it through from the caller.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@controllers/argocd/argocd.go` around lines 101 - 103, The code uses context.TODO() when calling argoappController.IsExternalAuthenticationEnabledOnCluster; update getArgoSSOSpec to accept a context.Context parameter, replace context.TODO() with that ctx when calling IsExternalAuthenticationEnabledOnCluster, and propagate the new ctx through any callers of getArgoSSOSpec (update signatures and call sites accordingly); ensure any helper functions called within getArgoSSOSpec that currently use context.TODO() also accept/receive the propagated ctx.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@controllers/argocd/argocd_test.go`:
- Around line 234-249: The test TestSSOSkippedOnNonOpenShift sets
util.SetConfigAPIFound(false) but defers util.SetConfigAPIFound(true), which
mismatches the actual default (false) in util.go and other tests (TestArgoCD,
TestDexConfiguration); change the deferred call in TestSSOSkippedOnNonOpenShift
to util.SetConfigAPIFound(false) so the test restores the real default and
avoids cross-test pollution.
---
Nitpick comments:
In `@controllers/argocd/argocd.go`:
- Around line 101-103: The code uses context.TODO() when calling
argoappController.IsExternalAuthenticationEnabledOnCluster; update
getArgoSSOSpec to accept a context.Context parameter, replace context.TODO()
with that ctx when calling IsExternalAuthenticationEnabledOnCluster, and
propagate the new ctx through any callers of getArgoSSOSpec (update signatures
and call sites accordingly); ensure any helper functions called within
getArgoSSOSpec that currently use context.TODO() also accept/receive the
propagated ctx.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 77aecd47-2f3f-4e6b-8c85-f460ea8fbb30
📒 Files selected for processing (4)
cmd/main.gocontrollers/argocd/argocd.gocontrollers/argocd/argocd_test.gocontrollers/util/util.go
| func TestSSOSkippedOnNonOpenShift(t *testing.T) { | ||
| util.SetConfigAPIFound(false) | ||
| defer util.SetConfigAPIFound(true) | ||
|
|
||
| scheme := runtime.NewScheme() | ||
| _ = argoapp.AddToScheme(scheme) | ||
| _ = configv1.AddToScheme(scheme) | ||
|
|
||
| fakeClient := fake.NewClientBuilder(). | ||
| WithScheme(scheme). | ||
| Build() | ||
|
|
||
| testArgoCD, _ := NewCR("openshift-gitops", "openshift-gitops", fakeClient) | ||
|
|
||
| assert.Assert(t, testArgoCD.Spec.SSO == nil, "SSO should be nil on non-OpenShift clusters") | ||
| } |
There was a problem hiding this comment.
Inconsistent test cleanup: defer should reset to default value.
The defer on line 236 sets configAPIFound to true, but the default value in util.go is false. This is inconsistent with the other tests (TestArgoCD and TestDexConfiguration) which defer to false. For consistency and to avoid potential test pollution, the defer should reset to the actual default value.
🧪 Proposed fix
func TestSSOSkippedOnNonOpenShift(t *testing.T) {
util.SetConfigAPIFound(false)
- defer util.SetConfigAPIFound(true)
+ defer util.SetConfigAPIFound(false)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| func TestSSOSkippedOnNonOpenShift(t *testing.T) { | |
| util.SetConfigAPIFound(false) | |
| defer util.SetConfigAPIFound(true) | |
| scheme := runtime.NewScheme() | |
| _ = argoapp.AddToScheme(scheme) | |
| _ = configv1.AddToScheme(scheme) | |
| fakeClient := fake.NewClientBuilder(). | |
| WithScheme(scheme). | |
| Build() | |
| testArgoCD, _ := NewCR("openshift-gitops", "openshift-gitops", fakeClient) | |
| assert.Assert(t, testArgoCD.Spec.SSO == nil, "SSO should be nil on non-OpenShift clusters") | |
| } | |
| func TestSSOSkippedOnNonOpenShift(t *testing.T) { | |
| util.SetConfigAPIFound(false) | |
| defer util.SetConfigAPIFound(false) | |
| scheme := runtime.NewScheme() | |
| _ = argoapp.AddToScheme(scheme) | |
| _ = configv1.AddToScheme(scheme) | |
| fakeClient := fake.NewClientBuilder(). | |
| WithScheme(scheme). | |
| Build() | |
| testArgoCD, _ := NewCR("openshift-gitops", "openshift-gitops", fakeClient) | |
| assert.Assert(t, testArgoCD.Spec.SSO == nil, "SSO should be nil on non-OpenShift clusters") | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@controllers/argocd/argocd_test.go` around lines 234 - 249, The test
TestSSOSkippedOnNonOpenShift sets util.SetConfigAPIFound(false) but defers
util.SetConfigAPIFound(true), which mismatches the actual default (false) in
util.go and other tests (TestArgoCD, TestDexConfiguration); change the deferred
call in TestSSOSkippedOnNonOpenShift to util.SetConfigAPIFound(false) so the
test restores the real default and avoids cross-test pollution.
|
@anandrkskd: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
What type of PR is this?
/kind enhancement
What does this PR do / why we need it:
The OpenShift GitOps Operator assumes an OpenShift cluster today: it registers the
GitopsServicecontroller, auto-creates a default Argo CD instance inopenshift-gitops, and configures Dex/SSO against OpenShift authentication.On xKS (non-OpenShift Kubernetes) clusters, those behaviors are not required and can cause failures.
This PR detects non-OpenShift clusters at startup by checking whether the
config.openshift.ioAPI is present (via existingInspectCluster()discovery). When it is not found, the operator:ReconcileGitopsServicecontroller registration — this controller manages OpenShift-specific resources (default Argo CD instance, console plugin backend, RBAC, namespace setup, and related reconciliation) that do not apply on xKS.openshift-gitopsArgo CD CR is created on xKS.getArgoSSOSpec()returnsnilon non-OpenShift clusters, so Dex is not configured whenNewCR()is used.On OpenShift clusters, behavior is unchanged. The existing
DISABLE_DEFAULT_ARGOCD_INSTANCEenvironment variable continues to work as before.Have you updated the necessary documentation?
Which issue(s) this PR fixes:
Fixes https://redhat.atlassian.net/browse/GITOPS-9943
Test acceptance criteria:
How to test changes / Special notes to the reviewer:
On xKS (vanilla Kubernetes or cluster without config.openshift.io):
On OpenShift: