diff --git a/argocd-operator/controllers/argocd/deployment_test.go b/argocd-operator/controllers/argocd/deployment_test.go index 74589cc9b5c..ad0f15a8da0 100644 --- a/argocd-operator/controllers/argocd/deployment_test.go +++ b/argocd-operator/controllers/argocd/deployment_test.go @@ -2399,7 +2399,7 @@ func repoServerDefaultVolumes() []corev1.Volume { Name: "redis-initial-pass", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, {Key: "auth_username", Path: "auth_username"}, @@ -2506,7 +2506,7 @@ func serverDefaultVolumes() []corev1.Volume { Name: argoutil.RedisAuthVolumeName, VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, {Key: "auth_username", Path: "auth_username"}, diff --git a/argocd-operator/controllers/argocd/secret.go b/argocd-operator/controllers/argocd/secret.go index ba3c0f902c2..19a38723325 100644 --- a/argocd-operator/controllers/argocd/secret.go +++ b/argocd-operator/controllers/argocd/secret.go @@ -35,6 +35,7 @@ import ( "github.com/redhat-developer/gitops-operator/argocd-operator/common" "github.com/redhat-developer/gitops-operator/argocd-operator/controllers/argoutil" + appsv1 "k8s.io/api/apps/v1" corev1 "k8s.io/api/core/v1" apierrors "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -331,7 +332,7 @@ func (r *ReconcileArgoCD) reconcileClusterSecrets(cr *argoproj.ArgoCD) error { return err } - if err := r.reconcileRedisInitialPasswordSecret(cr); err != nil { + if err := r.reconcileRedisSecret(cr); err != nil { return err } @@ -1141,49 +1142,199 @@ func (r *ReconcileArgoCD) getClusterSecrets(cr *argoproj.ArgoCD) (*corev1.Secret return clusterSecrets, nil } -// reconcileRedisInitialPasswordSecret will ensure that the redis Secret is present for the cluster. -func (r *ReconcileArgoCD) reconcileRedisInitialPasswordSecret(cr *argoproj.ArgoCD) error { - secret := argoutil.NewSecretWithSuffix(cr, "redis-initial-password") +const REDIS_INITIAL_PASSWORD = "redis-initial-password" +const ARGOCD_REDIS = "argocd-redis" +func (r *ReconcileArgoCD) reconcileRedisSecret(cr *argoproj.ArgoCD) error { + // Fix for GITOPS-11058 to be compatible with upstream Argo CD naming conventions and Argo CD CLI in core mode. + // Old secret name [instance]-redis-initial-password + // New secret name argocd-redis - upstream + + new := argoutil.NewSecretWithName(cr, ARGOCD_REDIS) + newExists, err := r.checkSecretExistence(cr, new) + if err != nil { + return err + } + + if newExists && secretIsHealthy(new) { + // Healthy - keep it + return r.deleteLegacyRedisSecret(cr) + } else if newExists && !secretIsHealthy(new) { + // secret not healthy, update + new = argoutil.NewSecretWithName(cr, ARGOCD_REDIS) + err := prepareSecretForUpdateCreate(r, cr, new) + if err != nil { + return err + } + if err := r.deleteLegacyRedisSecret(cr); err != nil { + return err + } + argoutil.LogResourceUpdate(log, new) + return r.Update(context.TODO(), new) + } + + // argocd-redis secret does not exist + old := argoutil.NewSecretWithSuffix(cr, REDIS_INITIAL_PASSWORD) + oldExists, err := r.checkSecretExistence(cr, old) + if err != nil { + return err + } + if oldExists && secretIsHealthy(old) { + // Carry the password over from the legacy secret + new.Data = argoutil.GetRedisSecretData(old.Data[common.ArgoCDKeyAdminPassword]) + + if err := controllerutil.SetControllerReference(cr, new, r.Scheme); err != nil { + return err + } + } else { + if err := prepareSecretForUpdateCreate(r, cr, new); err != nil { + return err + } + } + + if err := r.deleteLegacyRedisSecret(cr); err != nil { + return err + } + argoutil.LogResourceCreation(log, new) + return r.Create(context.TODO(), new) +} + +func (r *ReconcileArgoCD) checkSecretExistence(cr *argoproj.ArgoCD, s *corev1.Secret) (bool, error) { existed := true - // Recreate if the secret or some of its keys are missing - err := argoutil.FetchObject(r.Client, cr.Namespace, secret.Name, secret) + err := argoutil.FetchObject(r.Client, cr.Namespace, s.Name, s) if err != nil { if !apierrors.IsNotFound(err) { - return err + return false, err } existed = false } - if secret.Data != nil { - _, hasPwd := secret.Data[common.ArgoCDKeyAdminPassword] - _, hasAuth := secret.Data["auth"] - _, hasUsername := secret.Data["auth_username"] - _, hasAcl := secret.Data["users.acl"] - if hasPwd && hasAuth && hasUsername && hasAcl { - return nil // Healthy - keep it + return existed, nil +} + +// Checks secret usage in: Pod, Deployment or StatefulSet in the namespace +func (r *ReconcileArgoCD) secretInUse(namespace string, secretName string) (bool, error) { + pods := &corev1.PodList{} + if err := r.List(context.TODO(), pods, client.InNamespace(namespace)); err != nil { + return false, err + } + for i := range pods.Items { + if secretReferencedByPodSpec(&pods.Items[i].Spec, secretName) { + return true, nil } } - if existed { - // Drop unsettable fields created by FetchObject - secret = argoutil.NewSecretWithSuffix(cr, "redis-initial-password") + deployments := &appsv1.DeploymentList{} + if err := r.List(context.TODO(), deployments, client.InNamespace(namespace)); err != nil { + return false, err + } + for i := range deployments.Items { + if secretReferencedByPodSpec(&deployments.Items[i].Spec.Template.Spec, secretName) { + return true, nil + } } - redisInitialPassword, err := generateRedisAdminPassword() + statefulSets := &appsv1.StatefulSetList{} + if err := r.List(context.TODO(), statefulSets, client.InNamespace(namespace)); err != nil { + return false, err + } + for i := range statefulSets.Items { + if secretReferencedByPodSpec(&statefulSets.Items[i].Spec.Template.Spec, secretName) { + return true, nil + } + } + + return false, nil +} + +func secretReferencedByPodSpec(spec *corev1.PodSpec, secretName string) bool { + for _, volume := range spec.Volumes { + if volume.Secret != nil && volume.Secret.SecretName == secretName { + return true + } + if volume.Projected == nil { + continue + } + for _, source := range volume.Projected.Sources { + if source.Secret != nil && source.Secret.Name == secretName { + return true + } + } + } + + containers := append(append([]corev1.Container{}, spec.InitContainers...), spec.Containers...) + for _, container := range containers { + for _, env := range container.Env { + if env.ValueFrom != nil && env.ValueFrom.SecretKeyRef != nil && env.ValueFrom.SecretKeyRef.Name == secretName { + return true + } + } + for _, envFrom := range container.EnvFrom { + if envFrom.SecretRef != nil && envFrom.SecretRef.Name == secretName { + return true + } + } + } + + return false +} + +func (r *ReconcileArgoCD) deleteLegacyRedisSecret(cr *argoproj.ArgoCD) error { + // Delete [instance]-redis-initial-password + legacy := argoutil.NewSecretWithSuffix(cr, REDIS_INITIAL_PASSWORD) + + exists, err := r.checkSecretExistence(cr, legacy) if err != nil { return err } + if !exists { + return nil + } - secret.Data = argoutil.GetRedisSecretData(redisInitialPassword) + inUse, err := r.secretInUse(cr.Namespace, legacy.Name) + if err != nil { + return err + } + if inUse { + return nil + } - if err := controllerutil.SetControllerReference(cr, secret, r.Scheme); err != nil { + argoutil.LogResourceDeletion(log, legacy) + err = r.Delete(context.TODO(), legacy) + if err != nil { + if !apierrors.IsNotFound(err) { + return err + } + } + return nil +} + +func secretIsHealthy(s *corev1.Secret) bool { + healthy := false + if s.Data != nil { + _, hasPwd := s.Data[common.ArgoCDKeyAdminPassword] + _, hasAuth := s.Data["auth"] + _, hasUsername := s.Data["auth_username"] + _, hasAcl := s.Data["users.acl"] + + if hasPwd && hasAuth && hasUsername && hasAcl { + healthy = true + } + } + return healthy +} + +func prepareSecretForUpdateCreate(r *ReconcileArgoCD, cr *argoproj.ArgoCD, s *corev1.Secret) error { + redisInitialPassword, err := generateRedisAdminPassword() + if err != nil { return err } - if existed { - argoutil.LogResourceUpdate(log, secret) - return r.Update(context.TODO(), secret) + s.Data = argoutil.GetRedisSecretData(redisInitialPassword) + + err = controllerutil.SetControllerReference(cr, s, r.Scheme) + if err != nil { + return err } - argoutil.LogResourceCreation(log, secret) - return r.Create(context.TODO(), secret) + + return nil } diff --git a/argocd-operator/controllers/argocd/secret_test.go b/argocd-operator/controllers/argocd/secret_test.go index db1f0a0b6d1..5cc4f39b03b 100644 --- a/argocd-operator/controllers/argocd/secret_test.go +++ b/argocd-operator/controllers/argocd/secret_test.go @@ -16,6 +16,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" + appsv1 "k8s.io/api/apps/v1" corev1 "k8s.io/api/core/v1" apierrors "k8s.io/apimachinery/pkg/api/errors" testclient "k8s.io/client-go/kubernetes/fake" @@ -134,6 +135,46 @@ func TestReconcileArgoCD_reconcileClusterCASecret(t *testing.T) { assert.True(t, apierrors.IsNotFound(err), "default-named CA secret must not be created when a custom name is set; got err: %v", err) }) + t.Run("replaces an incomplete redis-initial-password secret with a regenerated argocd-redis", func(t *testing.T) { + argocd := &argoproj.ArgoCD{ + ObjectMeta: metav1.ObjectMeta{ + Name: "argocd", + Namespace: "argocd-operator", + }, + } + + oldRedisSecret := argoutil.NewSecretWithSuffix(argocd, "redis-initial-password") + oldRedisSecret.Data = map[string][]byte{common.ArgoCDKeyAdminPassword: []byte("something")} + tlsSecret := argoutil.NewSecretWithSuffix(argocd, "tls") + + resObjs := []client.Object{argocd} + subresObjs := []client.Object{argocd} + runtimeObjs := []runtime.Object{} + sch := makeTestReconcilerScheme(argoproj.AddToScheme, promoter.AddToScheme, apiregistrationv1.AddToScheme) + cl := makeTestReconcilerClient(sch, resObjs, subresObjs, runtimeObjs) + r := makeTestReconciler(cl, sch, testclient.NewSimpleClientset()) + + err := r.Create(context.TODO(), oldRedisSecret) + assert.NoError(t, err) + err = r.Create(context.TODO(), tlsSecret) + assert.NoError(t, err) + + err = r.reconcileRedisSecret(argocd) + + assert.NoError(t, err) + + oldSecretErr := r.Get(context.TODO(), types.NamespacedName{Name: oldRedisSecret.Name, Namespace: "argocd-operator"}, oldRedisSecret) + assert.True(t, apierrors.IsNotFound(oldSecretErr)) + + newRedisSecret := argoutil.NewSecretWithName(argocd, "argocd-redis") + + newSecretErr := r.Get(context.TODO(), types.NamespacedName{Name: newRedisSecret.Name, Namespace: "argocd-operator"}, newRedisSecret) + assert.NoError(t, newSecretErr) + assert.NotEmpty(t, newRedisSecret.Data[common.ArgoCDKeyAdminPassword], "argocd-redis should contain admin redis password") + assert.NotEqual(t, []byte("something"), newRedisSecret.Data[common.ArgoCDKeyAdminPassword], + "the legacy secret was incomplete, so its password should not be carried over") + }) + t.Run("skips creation when custom-named CA secret already exists", func(t *testing.T) { const customName = "my-custom-ca" a := makeTestArgoCD(func(a *argoproj.ArgoCD) { @@ -523,15 +564,14 @@ func Test_ReconcileArgoCD_ReconcileShouldNotChangeWhenUpdatedAdminPass(t *testin assert.True(t, argoutil.IsTrackedByOperator(testSecret.Labels)) } -func Test_ReconcileArgoCD_ReconcileRedisInitialPasswordSecret(t *testing.T) { - const suffix = "redis-initial-password" +func Test_ReconcileArgoCD_ReconcileRedisSecret(t *testing.T) { argocd := &argoproj.ArgoCD{ ObjectMeta: metav1.ObjectMeta{ Name: "argocd", Namespace: "argocd-operator", }, } - secretName := argoutil.NewSecretWithSuffix(argocd, suffix).Name + secretName := "argocd-redis" secretNN := types.NamespacedName{Name: secretName, Namespace: "argocd-operator"} resObjs := []client.Object{argocd} @@ -559,7 +599,7 @@ func Test_ReconcileArgoCD_ReconcileRedisInitialPasswordSecret(t *testing.T) { t.Run("Create when does not exist", func(t *testing.T) { require.ErrorContains(t, fetchSecret(), fmt.Sprintf(`secrets "%s" not found`, secretName)) - require.NoError(t, r.reconcileRedisInitialPasswordSecret(argocd)) + require.NoError(t, r.reconcileRedisSecret(argocd)) require.NoError(t, fetchSecret()) assertSecretValid() @@ -567,14 +607,14 @@ func Test_ReconcileArgoCD_ReconcileRedisInitialPasswordSecret(t *testing.T) { t.Run("Update keys and regenerate on operator upgrade", func(t *testing.T) { const oldPwd = "asdfghjkl" - secret := argoutil.NewSecretWithSuffix(argocd, suffix) + secret := argoutil.NewSecretWithName(argocd, "argocd-redis") secret.Data = map[string][]byte{ "immutable": []byte("true"), common.ArgoCDKeyAdminPassword: []byte(oldPwd), } require.NoError(t, r.Update(t.Context(), secret)) - require.NoError(t, r.reconcileRedisInitialPasswordSecret(argocd)) + require.NoError(t, r.reconcileRedisSecret(argocd)) require.NoError(t, fetchSecret()) actualPwd := assertSecretValid() @@ -586,7 +626,7 @@ func Test_ReconcileArgoCD_ReconcileRedisInitialPasswordSecret(t *testing.T) { assertSecretValid() oldVersion := actual.ResourceVersion - require.NoError(t, r.reconcileRedisInitialPasswordSecret(argocd)) + require.NoError(t, r.reconcileRedisSecret(argocd)) require.NoError(t, fetchSecret()) assertSecretValid() @@ -594,6 +634,227 @@ func Test_ReconcileArgoCD_ReconcileRedisInitialPasswordSecret(t *testing.T) { }) } +func Test_secretReferencedByPodSpec(t *testing.T) { + const secretName = "argocd-redis-initial-password" + + secretVolume := func(name string) corev1.Volume { + return corev1.Volume{ + Name: "redis-auth", + VolumeSource: corev1.VolumeSource{Secret: &corev1.SecretVolumeSource{SecretName: name}}, + } + } + + tests := []struct { + name string + spec corev1.PodSpec + expected bool + }{ + { + name: "no reference at all", + spec: corev1.PodSpec{ + Volumes: []corev1.Volume{secretVolume("argocd-redis")}, + Containers: []corev1.Container{{Name: "redis"}}, + }, + expected: false, + }, + { + name: "mounted as a secret volume", + spec: corev1.PodSpec{Volumes: []corev1.Volume{secretVolume(secretName)}}, + expected: true, + }, + { + name: "mounted through a projected volume", + spec: corev1.PodSpec{Volumes: []corev1.Volume{{ + Name: "redis-auth", + VolumeSource: corev1.VolumeSource{Projected: &corev1.ProjectedVolumeSource{ + Sources: []corev1.VolumeProjection{ + {ConfigMap: &corev1.ConfigMapProjection{}}, + {Secret: &corev1.SecretProjection{ + LocalObjectReference: corev1.LocalObjectReference{Name: secretName}, + }}, + }, + }}, + }}}, + expected: true, + }, + { + name: "injected through a secretKeyRef", + spec: corev1.PodSpec{Containers: []corev1.Container{{ + Name: "redis", + Env: []corev1.EnvVar{{ + Name: "REDIS_PASSWORD", + ValueFrom: &corev1.EnvVarSource{SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{Name: secretName}, + Key: "auth", + }}, + }}, + }}}, + expected: true, + }, + { + name: "injected through envFrom", + spec: corev1.PodSpec{Containers: []corev1.Container{{ + Name: "redis", + EnvFrom: []corev1.EnvFromSource{{ + SecretRef: &corev1.SecretEnvSource{ + LocalObjectReference: corev1.LocalObjectReference{Name: secretName}, + }, + }}, + }}}, + expected: true, + }, + { + name: "referenced only by an init container", + spec: corev1.PodSpec{ + InitContainers: []corev1.Container{{ + Name: "wait-for-redis", + EnvFrom: []corev1.EnvFromSource{{ + SecretRef: &corev1.SecretEnvSource{ + LocalObjectReference: corev1.LocalObjectReference{Name: secretName}, + }, + }}, + }}, + Containers: []corev1.Container{{Name: "redis"}}, + }, + expected: true, + }, + { + name: "volume of another kind with no secret set", + spec: corev1.PodSpec{Volumes: []corev1.Volume{{ + Name: "tmp", + VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{}}, + }}}, + expected: false, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert.Equal(t, tt.expected, secretReferencedByPodSpec(&tt.spec, secretName)) + }) + } +} + +func Test_ReconcileArgoCD_ReconcileRedisSecret_LegacyMigration(t *testing.T) { + const legacyPwd = "legacy-password" + const namespace = "argocd-operator" + + newArgoCD := func() *argoproj.ArgoCD { + return &argoproj.ArgoCD{ + ObjectMeta: metav1.ObjectMeta{Name: "argocd", Namespace: namespace}, + } + } + + newReconciler := func(cr *argoproj.ArgoCD, objs ...client.Object) *ReconcileArgoCD { + sch := makeTestReconcilerScheme(argoproj.AddToScheme, promoter.AddToScheme, apiregistrationv1.AddToScheme) + cl := makeTestReconcilerClient(sch, append([]client.Object{cr}, objs...), []client.Object{cr}, []runtime.Object{}) + return makeTestReconciler(cl, sch, testclient.NewSimpleClientset()) + } + + // A legacy secret holding every key the redis components expect. + newLegacySecret := func(cr *argoproj.ArgoCD) *corev1.Secret { + legacy := argoutil.NewSecretWithSuffix(cr, REDIS_INITIAL_PASSWORD) + legacy.Data = argoutil.GetRedisSecretData([]byte(legacyPwd)) + return legacy + } + + getSecret := func(t *testing.T, r *ReconcileArgoCD, name string) (*corev1.Secret, error) { + t.Helper() + secret := &corev1.Secret{} + err := r.Get(t.Context(), types.NamespacedName{Name: name, Namespace: namespace}, secret) + return secret, err + } + + t.Run("carries the password over from a healthy legacy secret", func(t *testing.T) { + argocd := newArgoCD() + legacy := newLegacySecret(argocd) + r := newReconciler(argocd, legacy) + + require.NoError(t, r.reconcileRedisSecret(argocd)) + + actual, err := getSecret(t, r, ARGOCD_REDIS) + require.NoError(t, err) + assert.Equal(t, legacyPwd, string(actual.Data[common.ArgoCDKeyAdminPassword]), "password should be carried over, not regenerated") + assert.Equal(t, legacyPwd, string(actual.Data["auth"])) + assert.Equal(t, "default", string(actual.Data["auth_username"])) + assert.Equal(t, "true", string(actual.Data["immutable"]), "keys derived by GetRedisSecretData must be present") + assert.Contains(t, string(actual.Data["users.acl"]), legacyPwd, "the ACL file must match the carried-over password") + + _, err = getSecret(t, r, legacy.Name) + assert.True(t, apierrors.IsNotFound(err), "legacy secret should be deleted once nothing references it") + }) + + t.Run("deletes the legacy secret when argocd-redis is already healthy", func(t *testing.T) { + argocd := newArgoCD() + existing := argoutil.NewSecretWithName(argocd, ARGOCD_REDIS) + existing.Data = argoutil.GetRedisSecretData([]byte("current-password")) + legacy := newLegacySecret(argocd) + r := newReconciler(argocd, existing, legacy) + + require.NoError(t, r.reconcileRedisSecret(argocd)) + + actual, err := getSecret(t, r, ARGOCD_REDIS) + require.NoError(t, err) + assert.Equal(t, "current-password", string(actual.Data[common.ArgoCDKeyAdminPassword]), "a healthy argocd-redis must be left alone") + + _, err = getSecret(t, r, legacy.Name) + assert.True(t, apierrors.IsNotFound(err), "legacy secret should still be cleaned up on the healthy path") + }) + + t.Run("keeps the legacy secret while a pod still mounts it", func(t *testing.T) { + argocd := newArgoCD() + legacy := newLegacySecret(argocd) + pod := &corev1.Pod{ + ObjectMeta: metav1.ObjectMeta{Name: "argocd-redis-0", Namespace: namespace}, + Spec: corev1.PodSpec{ + Volumes: []corev1.Volume{{ + Name: argoutil.RedisAuthVolumeName, + VolumeSource: corev1.VolumeSource{Secret: &corev1.SecretVolumeSource{SecretName: legacy.Name}}, + }}, + Containers: []corev1.Container{{Name: "redis", Image: "redis"}}, + }, + } + r := newReconciler(argocd, legacy, pod) + + require.NoError(t, r.reconcileRedisSecret(argocd)) + + _, err := getSecret(t, r, legacy.Name) + assert.NoError(t, err, "legacy secret must survive while a running pod still mounts it") + + // The new secret is still created, so the rollout has something to switch onto. + actual, err := getSecret(t, r, ARGOCD_REDIS) + require.NoError(t, err) + assert.Equal(t, legacyPwd, string(actual.Data[common.ArgoCDKeyAdminPassword])) + }) + + t.Run("keeps the legacy secret while a scaled-to-zero deployment references it", func(t *testing.T) { + argocd := newArgoCD() + legacy := newLegacySecret(argocd) + replicas := int32(0) + deployment := &appsv1.Deployment{ + ObjectMeta: metav1.ObjectMeta{Name: "argocd-redis", Namespace: namespace}, + Spec: appsv1.DeploymentSpec{ + Replicas: &replicas, + Template: corev1.PodTemplateSpec{ + Spec: corev1.PodSpec{ + Volumes: []corev1.Volume{{ + Name: argoutil.RedisAuthVolumeName, + VolumeSource: corev1.VolumeSource{Secret: &corev1.SecretVolumeSource{SecretName: legacy.Name}}, + }}, + Containers: []corev1.Container{{Name: "redis", Image: "redis"}}, + }, + }, + }, + } + r := newReconciler(argocd, legacy, deployment) + + require.NoError(t, r.reconcileRedisSecret(argocd)) + + _, err := getSecret(t, r, legacy.Name) + assert.NoError(t, err, "a workload with no pods would still fail on scale-up, so the secret must survive") + }) +} + func Test_ReconcileArgoCD_ReconcileRedisTLSSecret(t *testing.T) { argocd := &argoproj.ArgoCD{ ObjectMeta: metav1.ObjectMeta{ diff --git a/argocd-operator/controllers/argocd/statefulset_test.go b/argocd-operator/controllers/argocd/statefulset_test.go index 142d9bccba8..a8f760bcc2f 100644 --- a/argocd-operator/controllers/argocd/statefulset_test.go +++ b/argocd-operator/controllers/argocd/statefulset_test.go @@ -95,7 +95,7 @@ func controllerDefaultVolumes() []corev1.Volume { Name: argoutil.RedisAuthVolumeName, VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, {Key: "auth_username", Path: "auth_username"}, diff --git a/argocd-operator/controllers/argocdagent/deployment_test.go b/argocd-operator/controllers/argocdagent/deployment_test.go index f120fd342cb..c38881bf3f8 100644 --- a/argocd-operator/controllers/argocdagent/deployment_test.go +++ b/argocd-operator/controllers/argocdagent/deployment_test.go @@ -442,7 +442,7 @@ func TestReconcilePrincipalDeployment_VerifyDeploymentSpec(t *testing.T) { redisAuthVolume := deployment.Spec.Template.Spec.Volumes[2] assert.Equal(t, "redis-initial-pass", redisAuthVolume.Name) assert.NotNil(t, redisAuthVolume.Secret) - assert.Equal(t, "argocd-redis-initial-password", redisAuthVolume.Secret.SecretName) + assert.Equal(t, "argocd-redis", redisAuthVolume.Secret.SecretName) assert.NotEqual(t, new(true), redisAuthVolume.Secret.Optional) assert.Len(t, redisAuthVolume.Secret.Items, 2) } diff --git a/argocd-operator/controllers/argoutil/redis.go b/argocd-operator/controllers/argoutil/redis.go index 2dc5b2f7d95..26935450aed 100644 --- a/argocd-operator/controllers/argoutil/redis.go +++ b/argocd-operator/controllers/argoutil/redis.go @@ -26,7 +26,7 @@ func MountRedisAuthToRedis(cr *argoproj.ArgoCD) (volume corev1.Volume, mount cor Name: RedisAuthVolumeName, VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: GetSecretNameWithSuffix(cr, "redis-initial-password"), + SecretName: "argocd-redis", }, }, } diff --git a/argocd-operator/tests/ginkgo/parallel/1-019_validate_volume_mounts_test.go b/argocd-operator/tests/ginkgo/parallel/1-019_validate_volume_mounts_test.go index f1eb50431d8..e05aa289a89 100644 --- a/argocd-operator/tests/ginkgo/parallel/1-019_validate_volume_mounts_test.go +++ b/argocd-operator/tests/ginkgo/parallel/1-019_validate_volume_mounts_test.go @@ -135,7 +135,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { Name: "redis-initial-pass", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", DefaultMode: new(int32(420)), Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, @@ -222,7 +222,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { Name: "redis-initial-pass", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", DefaultMode: new(int32(420)), Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, @@ -297,7 +297,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { Name: "redis-initial-pass", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", DefaultMode: new(int32(420)), Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, diff --git a/argocd-operator/tests/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go b/argocd-operator/tests/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go index 859416683f6..53bce6e56bd 100644 --- a/argocd-operator/tests/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go +++ b/argocd-operator/tests/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go @@ -221,7 +221,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { By("verifying redis password is correct") redisInitialSecret := &corev1.Secret{} redisPwdSecretKey := client.ObjectKey{ - Name: argoutil.GetSecretNameWithSuffix(argoCD, "redis-initial-password"), + Name: "argocd-redis", Namespace: ns.Name, } Expect(k8sClient.Get(ctx, redisPwdSecretKey, redisInitialSecret)).Should(Succeed()) diff --git a/argocd-operator/tests/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go b/argocd-operator/tests/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go index 1abccf296a3..d3a43ec1444 100644 --- a/argocd-operator/tests/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go +++ b/argocd-operator/tests/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go @@ -167,7 +167,7 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { PrincipalTLSSecretName: agentPrincipalTLSSecretName, RootCASecretName: agentRootCASecretName, ResourceProxyTLSSecretName: agentResourceProxyTLSSecretName, - RedisInitialPasswordSecretName: "example-redis-initial-password", + RedisInitialPasswordSecretName: "argocd-redis", } resourceProxyServiceName = fmt.Sprintf("%s-agent-principal-resource-proxy", argoCDName) diff --git a/argocd-operator/tests/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go b/argocd-operator/tests/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go index 667c71a8ac9..fcf8c11c704 100644 --- a/argocd-operator/tests/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go +++ b/argocd-operator/tests/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go @@ -153,7 +153,7 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { secretNames = []string{ agentClientTLSSecretName, agentRootCASecretName, - "example-redis-initial-password", + "argocd-redis", } serviceNames = []string{ diff --git a/test/openshift/e2e/ginkgo/parallel/1-019_validate_volume_mounts_test.go b/test/openshift/e2e/ginkgo/parallel/1-019_validate_volume_mounts_test.go index 0334b8af66f..926bae65083 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-019_validate_volume_mounts_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-019_validate_volume_mounts_test.go @@ -134,7 +134,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { Name: "redis-initial-pass", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", DefaultMode: new(int32(420)), Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, @@ -221,7 +221,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { Name: "redis-initial-pass", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", DefaultMode: new(int32(420)), Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, @@ -296,7 +296,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { Name: "redis-initial-pass", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", DefaultMode: new(int32(420)), Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, diff --git a/test/openshift/e2e/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go b/test/openshift/e2e/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go index ea0296fe2a7..0122c976333 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go @@ -224,7 +224,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { By("verifying redis password is correct") redisInitialSecret := &corev1.Secret{} redisPwdSecretKey := client.ObjectKey{ - Name: argoutil.GetSecretNameWithSuffix(argoCD, "redis-initial-password"), + Name: "argocd-redis", Namespace: ns.Name, } Expect(k8sClient.Get(ctx, redisPwdSecretKey, redisInitialSecret)).Should(Succeed()) diff --git a/test/openshift/e2e/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go b/test/openshift/e2e/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go index d7eacd6794d..bd1292f1762 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go @@ -160,7 +160,7 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { PrincipalTLSSecretName: agentPrincipalTLSSecretName, RootCASecretName: agentRootCASecretName, ResourceProxyTLSSecretName: agentResourceProxyTLSSecretName, - RedisInitialPasswordSecretName: "example-redis-initial-password", + RedisInitialPasswordSecretName: "argocd-redis", } resourceProxyServiceName = fmt.Sprintf("%s-agent-principal-resource-proxy", argoCDName) diff --git a/test/openshift/e2e/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go b/test/openshift/e2e/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go index 5dc59fd121c..5581fe235ee 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go @@ -150,7 +150,7 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { secretNames = []string{ agentClientTLSSecretName, agentRootCASecretName, - "example-redis-initial-password", + "argocd-redis", } serviceNames = []string{ diff --git a/test/openshift/e2e/ginkgo/sequential/1-067_validate_redis_secure_comm_no_autotls_ha_test.go b/test/openshift/e2e/ginkgo/sequential/1-067_validate_redis_secure_comm_no_autotls_ha_test.go index e49735e7a1a..b7dd9cb0a37 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-067_validate_redis_secure_comm_no_autotls_ha_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-067_validate_redis_secure_comm_no_autotls_ha_test.go @@ -353,7 +353,7 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { By("verifying redis password is correct") redisInitialSecret := &corev1.Secret{} redisPwdSecretKey := client.ObjectKey{ - Name: argoutil.GetSecretNameWithSuffix(argoCD, "redis-initial-password"), + Name: "argocd-redis", Namespace: ns.Name, } Expect(k8sClient.Get(ctx, redisPwdSecretKey, redisInitialSecret)).Should(Succeed())