Drop unused piece of schema json

Custom CA support

Small cleanup to remove unneeded log messages

If the clusterwide proxy object is configured, let's support it when
we clone the git repos for the imperative framework.

Support for cluster-wide proxy

Update ESO to 0.9.14

feat: Support for issue #459

Update CRD from operator v0.0.44

Expose main.experimentalCapabilities in operator-install

Release clustergroup v0.8.3

Co-authored-by: Alejandro Villegas <[email protected]>
Signed-off-by: Tomer Figenblat <[email protected]>

Co-authored-by: Alejandro Villegas <[email protected]>
Signed-off-by: Tomer Figenblat <[email protected]>

This allows us to have a remote repoURL + path kustomize combo and show
the resulting templates in `make preview`.

Tested with:

    web-terminal:
      name: web-terminal
      namespace: hello-world
      project: hub
      kustomize: true
      targetRevision: main
      repoURL: https://github.com/redhat-cop/gitops-catalog
      path: web-terminal/aggregate/overlays/default

Closes: validatedpatterns/multicloud-gitops#356

Support remote repoURL when previewing templates

Co-authored-by: Alejandro Villegas <[email protected]>
Signed-off-by: Tomer Figenblat <[email protected]>

- Fixed issue in common/clustergroup/templates/_helpers.tpl to render correct label

Namespace argocd.argoproj.io/managed-by label issue

This corrects Argo error:
Failed to load target state: failed to generate manifest for source 1 of 1: rpc error: code = Unknown desc = Manifest generation error (cached): `helm template . --name-template acm --namespace open-cluster-management --kube-version 1.25 --set global.privateRepo=false --set global.experimentalCapabilities=initcontainers --set global.repoURL=https://github.myrepo.com/EnterpriseKubernetes/multicloud-gitops.git --set global.clusterDomain=mydomain.azure.us --set global.clusterPlatform=Azure --set global.hubClusterDomain=mydomain.azure.us --set global.localClusterDomain=mydomain.azure.us --set global.targetRevision=prod --set global.namespace=open-cluster-management --set global.pattern=ekho --set global.clusterVersion=4.12 --values <path to cached source>/values-global.yaml --values <path to cached source>/values-hub.yaml <api versions removed> --include-crds` failed exit status 1: Error: YAML parse error on acm/templates/policies/application-policies.yaml: error converting YAML to JSON: yaml: line 50: did not find expected key Use --debug flag to render out invalid YAML

Also corrects mapping error warning on make preview-acm

This way it can be set straight from a values-*.yaml file

Tested on MCG.

Add main.experimentalCapabilities to values.schema.json

ClusterGroup v0.8.4

Moved CLUSTERGROUP declaration to restore make preview-% functionality

This way the code is a bit less confusing and it's more obvious
when/where CLUSTERGROUP is used.

make preview-% still keeps working as usual and you can override things
via `make CLUSTERGROUP=group-one preview-hello-world`

Gotta love Makefile's idiosyncrasies around per-target variables

Small makefile tweak

bug: Fixes indenting and duplicate entries in application-policies.yaml

…ion has labels

- Added condition to check if operatorGroup key exists  {{- if or $v.operatorGroup (not (hasKey $v "operatorGroup")) }}
- Default behavior is that we generate an OperatorGroup for a Namespace definition.

Small cleanups

bug: Fix to generate OperatorGroup definition when namespaces definition has labels

Try fallbacks for /etc/pki when it does not exist

- Fixed issue with rendering multiple OperatorGroup.  Added the beginning (---) to signal document start.
- Updated the applications.yaml to include beginning (---) to signal document start.

helper operatorgroup fix

Update ESO to 0.9.16

Updated vault-helm to v0.28.0

In case a git repo has some things split over submodules, let's clone
those too.

The version of git in the imperative image is currently:
sh-5.1# git version
git version 2.39.3

Tested with:
sh-5.1# git clone --recurse-submodules --single-branch --branch main --depth 1 -- "https://github.com/validatedpatterns/multicloud-gitops" /tmp/
Cloning into '/tmp'...
remote: Enumerating objects: 426, done.
remote: Counting objects: 100% (426/426), done.
remote: Compressing objects: 100% (343/343), done.
remote: Total 426 (delta 87), reused 221 (delta 40), pack-reused 0
Receiving objects: 100% (426/426), 545.98 KiB | 1.78 MiB/s, done.
Resolving deltas: 100% (87/87), done.

Co-Authored-By: Sergio Garcia Martinez <[email protected]>

Use --recurse-submodules when cloning

The last job we ran with that for IIB was more than 4 months ago.

Improve IIB

Check for prereqs for IIB

…for clusterdeployments

Signed-off-by: Tomer Figenblat <[email protected]>

Signed-off-by: Tomer Figenblat <[email protected]>

This adds multiple IIB support in order to cater for the ACM IIB case,
where the MCE operator might be in another IIB completely.

To load multiple IIB for different operators, one needs to set the env
variables as follows:

    export OPERATOR=advanced-cluster-management,multicluster-engine
    export INDEX_IMAGES=registry-proxy.engineering.redhat.com/rh-osbs/iib:713808,registry-proxy.engineering.redhat.com/rh-osbs/iib:718034

It is implied that the first IIB is for the first operator in the list,
and the second one for the latter.

Tested gitops-iib and it all worked with no changes.

Rework IIB loading support

We need to be able to explicitely override the Source and the Channel
used to install the MCE multicluster-engine operator. The reason for
this is that when we install ACM from an IIB, the default channel that
will be used for MCE won't be present in the IIB, so we need to be able
to be flexible in determining where the MCE gets installed from
(sourcecatalog and channel)

We default to redhat-operators because otherwise when installing gitops
via IIB the ACM operator finds a channel for MCE that does not exist, so
we force the source all the time.

acm iib overrides

Switch to gitops-1.12

Release clustergroup v0.8.5

- Added new section for to configure the ArgoCD server to support tls
  argocdServer:
    route:
      tls:
        insecureEdgeTerminationPolicy: Redirect
        termination: reencrypt
- Default for ArgoCD is to create route with the following:
      route: enabled
      tls:
        insecureEdgeTerminationPolicy: Redirect
        termination: passthrough

    For more information please refer to https://issues.redhat.com/browse/GITOPS-3918.

- Changed default value for termination

Improve readme for ACM IIB

New global scope argocdServer section for values-global.yaml

We drive this from the patterns-operator-config configmap these days, which
makes more sense (it is a clusterwide setting and not really a per
pattern one).

Tested with:

❯ helm template operator-install --show-only templates/subscription.yaml --set main.patternsOperator.installPlanApproval=Manual

    ---
    apiVersion: operators.coreos.com/v1alpha1
    kind: Subscription
    metadata:
      name: patterns-operator
      namespace: openshift-operators
      labels:
        operators.coreos.com/patterns-operator.openshift-operators: ""
    spec:
      channel: fast
      installPlanApproval: Manual
      name: patterns-operator
      source: community-operators
      sourceNamespace: openshift-marketplace

❯ helm template operator-install --show-only templates/subscription.yaml --set main.patternsOperator.installPlanApproval=Manual --set main.patternsOperator.startingCSV=1.2.3

    ---
    apiVersion: operators.coreos.com/v1alpha1
    kind: Subscription
    metadata:
      name: patterns-operator
      namespace: openshift-operators
      labels:
        operators.coreos.com/patterns-operator.openshift-operators: ""
    spec:
      channel: fast
      installPlanApproval: Manual
      name: patterns-operator
      source: community-operators
      sourceNamespace: openshift-marketplace
      startingCSV: 1.2.3

Drop gitopsspec from pattern's CR

Allow customizing the VP operator subscription

Add retries when checking oc version

Add an imperative-admin-sa service account

This makes the registry url more consistent with what we already use
(e.g. in the imperative templates)

Switch to registry.redhat.io for the initContainer image

- If statement was checking for .Values.global.extraValueFiles.
- We now checking at the .extraValueFiles in the managedClusterGroups section.

  managedClusterGroups:
    aro-prod:
      name: innovation
      acmlabels:
        - name: clusterGroup
          value: innovation
      extraValueFiles:
        - '/overrides/values-common-capabilities.yaml'
      helmOverrides:
        - name: clusterGroup.isHubCluster
          value: "false"

Update for ACM chart to application-policies.yaml

- Problem Statement
  The current **clustergroup** schema does not allow the definition of **extraParameters** under the **main** section of a values file.

- Caveat
  The user defined variables in the **extraParameters** section would only be applied if the user deploys the pattern via the command, using `./pattern.sh make install` or `./pattern.sh make operator-deploy` and not via the OpenShift Validated Patterns Operator UI.

- Fix Description
  Add the **extraParameters** to the definition of **Main.properties** in the values.schema.json:

        "extraParameters": {
          "type": "array",
          "description": "Pass in extra Helm parameters to all ArgoCD Applications and the framework."
        },

- This will allow users to define extra parameters that will be added by the framework to the ArgoCD applications it creates.

- For more information see validatedpatterns/common#510

Add extraParameters to values.schema.json

Update ESO to 0.9.18

…n of a values file.

- The operator adds these extraParameters to the extraParametersNested section as key/value pairs in the Cluster Wide ArgoCD Application created by the Validated Patterns operator.
- This update will add the user defined extra parameters on the ArgoCD Applications on the Spoke Clusters.

efinition of extraParameters under the main

We'd like to make the imperative namespace optional,
so let's use the golang-external-secrets one, which is probably
more correct anyways since the acm hub ca is tied to ESO anyways.

The acm hub ca is needed for ESO on spokes to connect to the vault on
the hub, there is no need for this when vault is not used, so let's
drop it in that case

Feat: Followup to definition of extraParameters under the main section of a values file.

Updates to acm-hub-ca

Update vault to 1.16.2

…er-namespace

Co-authored-by: Michele Baldessari <[email protected]>
Co-authored-by: Alejandro Villegas <[email protected]>
Signed-off-by: Tomer Figenblat <[email protected]>

This is important because in some situations (we've observed this on the
clusterwide argo instance on spokes) the permissions are not there yet
when argo tries to create service accounts for the imperative SAs.

This means that the very first sync works up to the service account
creation which then fails due to lacking RBACs. This triggers a gitops
issue where selfheal never retries because the previous run failed and
so the app is in a stuck loop forever

Co-Authored-By: Jonny Rickard <[email protected]>

Closes: GITOPS-4677

Force rolebindings as early as possible

Problem Statement:
When setting a namespace like this:
    - openshift-distributed-tracing:
        operatorGroup: true
        targetNamespaces: []

The chart generates the following yaml:
```yaml
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: openshift-distributed-tracing-operator-group
  namespace: openshift-distributed-tracing
spec:
  targetNamespaces:
```

Which k8s rejects the targetNamespaces key as invalid when it attempts to apply it and removes it since it doesn't have a value, which just so happens to have the desired result of not setting the targetNamespaces (or a selector) to enable it for All Namespaces.