From 1e8a7c064e2368a5239de58d2cfc36342595c472 Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Tue, 9 Jun 2026 16:15:22 +0530 Subject: [PATCH 1/5] disable default instance on xKS clusters Signed-off-by: Anand Kumar Singh --- cmd/main.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/cmd/main.go b/cmd/main.go index acbe0809fad..f1242a427bf 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -223,8 +223,13 @@ func main() { registerComponentOrExit(mgr, argov1beta1api.AddToScheme) // Setup Scheme for OpenShift Config if available + var disableDefault bool + disableDefault = strings.ToLower(os.Getenv(common.DisableDefaultInstallEnvVar)) == "true" if util.IsConfigAPIFound() { registerComponentOrExit(mgr, configv1.AddToScheme) + } else { + setupLog.Info("Non-OpenShift cluster detected, disabling default Argo CD instance") + disableDefault = true } registerComponentOrExit(mgr, rolloutManagerApi.AddToScheme) @@ -257,7 +262,7 @@ func main() { if err = (&controllers.ReconcileGitopsService{ Client: client, Scheme: mgr.GetScheme(), - DisableDefaultInstall: strings.ToLower(os.Getenv(common.DisableDefaultInstallEnvVar)) == "true", + DisableDefaultInstall: disableDefault, }).SetupWithManager(mgr); err != nil { setupLog.Error(err, "unable to create controller", "controller", "GitopsService") os.Exit(1) From 2b77b2b44fccc9d63d25304fef96cbf281e9a010 Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Wed, 10 Jun 2026 14:40:30 +0530 Subject: [PATCH 2/5] Dex with OpenShiftOAuth: true fails on vanilla K8s because oauth.openshift.io API doesn't exist. Gate on config.openshift.io presence before configuring SSO. assisted-by: claude-code Signed-off-by: Anand Kumar Singh --- controllers/argocd/argocd.go | 11 ++++++++++- controllers/argocd/argocd_test.go | 23 +++++++++++++++++++++++ 2 files changed, 33 insertions(+), 1 deletion(-) diff --git a/controllers/argocd/argocd.go b/controllers/argocd/argocd.go index ba7b1b41e54..084c889f667 100644 --- a/controllers/argocd/argocd.go +++ b/controllers/argocd/argocd.go @@ -21,13 +21,17 @@ import ( argoapp "github.com/argoproj-labs/argocd-operator/api/v1beta1" argoappController "github.com/argoproj-labs/argocd-operator/controllers/argocd" + "github.com/redhat-developer/gitops-operator/controllers/util" v1 "k8s.io/api/core/v1" resourcev1 "k8s.io/apimachinery/pkg/api/resource" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "sigs.k8s.io/controller-runtime/pkg/client" + logf "sigs.k8s.io/controller-runtime/pkg/log" "sigs.k8s.io/yaml" ) +var log = logf.Log.WithName("controller_argocd") + var ( defaultAdminPolicy = "g, system:cluster-admins, role:admin\ng, cluster-admins, role:admin\n" defaultScope = "[groups]" @@ -90,7 +94,12 @@ func getArgoDexSpec() *argoapp.ArgoCDDexSpec { } func getArgoSSOSpec(client client.Client) *argoapp.ArgoCDSSOSpec { - if argoappController.IsOpenShiftCluster() && argoappController.IsExternalAuthenticationEnabledOnCluster(context.TODO(), client) { + if !util.IsConfigAPIFound() { + log.Info("non-OpenShift cluster detected, skipping SSO/Dex configuration") + return nil + } + if argoappController.IsExternalAuthenticationEnabledOnCluster(context.TODO(), client) { + log.Info("external authentication enabled on cluster, skipping SSO/Dex configuration") return nil } return &argoapp.ArgoCDSSOSpec{ diff --git a/controllers/argocd/argocd_test.go b/controllers/argocd/argocd_test.go index 0132c53f647..8b22ad83785 100644 --- a/controllers/argocd/argocd_test.go +++ b/controllers/argocd/argocd_test.go @@ -22,6 +22,7 @@ import ( argoapp "github.com/argoproj-labs/argocd-operator/api/v1beta1" configv1 "github.com/openshift/api/config/v1" + "github.com/redhat-developer/gitops-operator/controllers/util" "gotest.tools/assert" v1 "k8s.io/api/core/v1" resourcev1 "k8s.io/apimachinery/pkg/api/resource" @@ -30,6 +31,9 @@ import ( ) func TestArgoCD(t *testing.T) { + util.SetConfigAPIFound(true) + defer util.SetConfigAPIFound(false) + scheme := runtime.NewScheme() _ = argoapp.AddToScheme(scheme) _ = configv1.AddToScheme(scheme) @@ -199,6 +203,9 @@ func TestArgoCD(t *testing.T) { } func TestDexConfiguration(t *testing.T) { + util.SetConfigAPIFound(true) + defer util.SetConfigAPIFound(false) + scheme := runtime.NewScheme() _ = argoapp.AddToScheme(scheme) _ = configv1.AddToScheme(scheme) @@ -223,3 +230,19 @@ func TestDexConfiguration(t *testing.T) { } assert.DeepEqual(t, testArgoCD.Spec.RBAC, testRBAC) } + +func TestSSOSkippedOnNonOpenShift(t *testing.T) { + util.SetConfigAPIFound(false) + + scheme := runtime.NewScheme() + _ = argoapp.AddToScheme(scheme) + _ = configv1.AddToScheme(scheme) + + fakeClient := fake.NewClientBuilder(). + WithScheme(scheme). + Build() + + testArgoCD, _ := NewCR("openshift-gitops", "openshift-gitops", fakeClient) + + assert.Assert(t, testArgoCD.Spec.SSO == nil, "SSO should be nil on non-OpenShift clusters") +} From 495b3fbb952e50a51c6e8110172e7a6852c59a6e Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Fri, 12 Jun 2026 15:48:50 +0530 Subject: [PATCH 3/5] use IsOpenshitCluster to gate openshift specific capabilities Signed-off-by: Anand Kumar Singh --- cmd/main.go | 19 ++++++++++++------- controllers/argocd/argocd.go | 2 +- controllers/util/util.go | 5 +++++ 3 files changed, 18 insertions(+), 8 deletions(-) diff --git a/cmd/main.go b/cmd/main.go index f1242a427bf..21c310053e9 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -223,6 +223,7 @@ func main() { registerComponentOrExit(mgr, argov1beta1api.AddToScheme) // Setup Scheme for OpenShift Config if available + // Disables default Argo CD instance if the cluster doesn't contain OpenShift config API var disableDefault bool disableDefault = strings.ToLower(os.Getenv(common.DisableDefaultInstallEnvVar)) == "true" if util.IsConfigAPIFound() { @@ -259,13 +260,17 @@ func main() { } } - if err = (&controllers.ReconcileGitopsService{ - Client: client, - Scheme: mgr.GetScheme(), - DisableDefaultInstall: disableDefault, - }).SetupWithManager(mgr); err != nil { - setupLog.Error(err, "unable to create controller", "controller", "GitopsService") - os.Exit(1) + if util.IsOpenShiftCluster() { + if err = (&controllers.ReconcileGitopsService{ + Client: client, + Scheme: mgr.GetScheme(), + DisableDefaultInstall: disableDefault, + }).SetupWithManager(mgr); err != nil { + setupLog.Error(err, "unable to create controller", "controller", "GitopsService") + os.Exit(1) + } + } else { + setupLog.Info("Non-OpenShift cluster detected, skipping GitopsService controller setup") } if util.IsRouteAPIFound() { diff --git a/controllers/argocd/argocd.go b/controllers/argocd/argocd.go index 084c889f667..467c38afaa2 100644 --- a/controllers/argocd/argocd.go +++ b/controllers/argocd/argocd.go @@ -94,7 +94,7 @@ func getArgoDexSpec() *argoapp.ArgoCDDexSpec { } func getArgoSSOSpec(client client.Client) *argoapp.ArgoCDSSOSpec { - if !util.IsConfigAPIFound() { + if !util.IsOpenShiftCluster() { log.Info("non-OpenShift cluster detected, skipping SSO/Dex configuration") return nil } diff --git a/controllers/util/util.go b/controllers/util/util.go index 282ad211baf..1f275911e84 100644 --- a/controllers/util/util.go +++ b/controllers/util/util.go @@ -121,6 +121,11 @@ func IsConfigAPIFound() bool { return configAPIFound } +// used as a shortcut to check if the cluster is an OpenShift cluster +func IsOpenShiftCluster() bool { + return configAPIFound +} + // verify if the Config.Openshift.io API is found func verifyConfigAPI() error { found, err := argoutil.VerifyAPI(configv1.GroupName, configv1.GroupVersion.Version) From 00b53d8c497fdf06e05aa3f0ab18d0bd5bec90b5 Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Fri, 12 Jun 2026 17:11:31 +0530 Subject: [PATCH 4/5] add proper logs, remove deadcode, fix test assisted-by: Cursor for code-review Signed-off-by: Anand Kumar Singh --- cmd/main.go | 11 ++++------- controllers/argocd/argocd_test.go | 1 + controllers/util/util.go | 4 ++-- 3 files changed, 7 insertions(+), 9 deletions(-) diff --git a/cmd/main.go b/cmd/main.go index 21c310053e9..2d6ce31d292 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -224,13 +224,9 @@ func main() { // Setup Scheme for OpenShift Config if available // Disables default Argo CD instance if the cluster doesn't contain OpenShift config API - var disableDefault bool - disableDefault = strings.ToLower(os.Getenv(common.DisableDefaultInstallEnvVar)) == "true" + if util.IsConfigAPIFound() { registerComponentOrExit(mgr, configv1.AddToScheme) - } else { - setupLog.Info("Non-OpenShift cluster detected, disabling default Argo CD instance") - disableDefault = true } registerComponentOrExit(mgr, rolloutManagerApi.AddToScheme) @@ -264,13 +260,14 @@ func main() { if err = (&controllers.ReconcileGitopsService{ Client: client, Scheme: mgr.GetScheme(), - DisableDefaultInstall: disableDefault, + DisableDefaultInstall: strings.ToLower(os.Getenv(common.DisableDefaultInstallEnvVar)) == "true", }).SetupWithManager(mgr); err != nil { setupLog.Error(err, "unable to create controller", "controller", "GitopsService") os.Exit(1) } } else { - setupLog.Info("Non-OpenShift cluster detected, skipping GitopsService controller setup") + setupLog.Info("skipping GitopsService controller setup", "reason", "OpenShift Config API not available") + } if util.IsRouteAPIFound() { diff --git a/controllers/argocd/argocd_test.go b/controllers/argocd/argocd_test.go index 8b22ad83785..684ebcc5771 100644 --- a/controllers/argocd/argocd_test.go +++ b/controllers/argocd/argocd_test.go @@ -233,6 +233,7 @@ func TestDexConfiguration(t *testing.T) { func TestSSOSkippedOnNonOpenShift(t *testing.T) { util.SetConfigAPIFound(false) + defer util.SetConfigAPIFound(true) scheme := runtime.NewScheme() _ = argoapp.AddToScheme(scheme) diff --git a/controllers/util/util.go b/controllers/util/util.go index 1f275911e84..a8c7c287d20 100644 --- a/controllers/util/util.go +++ b/controllers/util/util.go @@ -116,14 +116,14 @@ func InspectCluster() error { return stderrors.Join(errs...) } -// used as a shortcut to check if the cluster is an OpenShift cluster +// used as a shortcut to check if the Config.Openshift.io API is found func IsConfigAPIFound() bool { return configAPIFound } // used as a shortcut to check if the cluster is an OpenShift cluster func IsOpenShiftCluster() bool { - return configAPIFound + return IsConfigAPIFound() } // verify if the Config.Openshift.io API is found From aecf34c4b5a140bfb84850df609c3c1cedcd34dd Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Mon, 15 Jun 2026 09:23:30 +0530 Subject: [PATCH 5/5] fix unit test Signed-off-by: Anand Kumar Singh --- controllers/argocd/argocd_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/controllers/argocd/argocd_test.go b/controllers/argocd/argocd_test.go index 684ebcc5771..4aaf1b63761 100644 --- a/controllers/argocd/argocd_test.go +++ b/controllers/argocd/argocd_test.go @@ -231,9 +231,9 @@ func TestDexConfiguration(t *testing.T) { assert.DeepEqual(t, testArgoCD.Spec.RBAC, testRBAC) } +// kubernetes environment test, no defer required as the Config API is false by default func TestSSOSkippedOnNonOpenShift(t *testing.T) { util.SetConfigAPIFound(false) - defer util.SetConfigAPIFound(true) scheme := runtime.NewScheme() _ = argoapp.AddToScheme(scheme)