reconcile parallel tests with gitops/operator-e2e

test/openshift/e2e/parallel/1-012_validate-managed-by-chain/02-label-namespace.yaml

@@ -3,4 +3,4 @@
 apiVersion: kuttl.dev/v1beta1
 kind: TestStep
 commands:
-- script: kubectl label ns test-1-12-custom argocd.argoproj.io/managed-by=$NAMESPACE --overwrite
+- script: kubectl label ns test-1-12-custom argocd.argoproj.io/managed-by=$NAMESPACE --overwrite

test/openshift/e2e/parallel/1-012_validate-managed-by-chain/07-label-namespace.yaml

@@ -3,4 +3,4 @@
 apiVersion: kuttl.dev/v1beta1
 kind: TestStep
 commands:
-- script: kubectl label ns test-1-12-custom2 argocd.argoproj.io/managed-by=$NAMESPACE
+- script: kubectl label ns test-1-12-custom argocd.argoproj.io/managed-by=$NAMESPACE --overwrite

test/openshift/e2e/parallel/1-012_validate-managed-by-chain/README.md

@@ -0,0 +1 @@
+This test actually contains step 1.12 to 1.15

test/openshift/e2e/parallel/1-025-validate-managed-by-change/02-wait.yaml

@@ -36,4 +36,4 @@ commands:
     }
 
     wait_until_pods_running "test-1-25-argo1"
-    wait_until_pods_running "test-1-25-argo2"
+    wait_until_pods_running "test-1-25-argo2"

test/openshift/e2e/parallel/1-038_validate_productized_images/02-check-images.yaml

@@ -13,4 +13,4 @@ commands:
           exit 0
         fi
       fi
-    done
+    done

test/openshift/e2e/parallel/1-043_validate_log_level_format/03-check-loglevel.yaml

@@ -19,4 +19,4 @@ commands:
         echo "CWD: $wlCommand"
         exit 1
       fi
-    done
+    done

test/openshift/e2e/parallel/1-045_validate_repo_exec_timeout/04-check-workload-env.yaml

@@ -8,4 +8,4 @@ commands:
     if test "$timeout" != "300s"; then
       echo "Assertion failed. Timeout should be 300s, is '$timeout'"
       exit 1
-    fi
+    fi

test/openshift/e2e/parallel/1-049_validate_parallelism_limit/02-check-deployment.yaml

@@ -10,4 +10,4 @@ commands:
       echo "Incorrect or missing --kubectl-parallelism-limit detected."
       echo "$wlCommand"
       exit 1
-    fi
+    fi

test/openshift/e2e/parallel/1-049_validate_parallelism_limit/04-check-deployment.yaml

@@ -11,4 +11,4 @@ commands:
       echo "Incorrect or missing --kubectl-parallelism-limit detected."
       echo "$wlCommand"
       exit 1
-    fi
+    fi

test/openshift/e2e/parallel/1-049_validate_parallelism_limit/06-check-deployment.yaml

@@ -14,4 +14,4 @@ commands:
       echo "Incorrect or missing --kubectl-parallelism-limit detected."
       echo "$wlCommand"
       exit 1
-    fi
+    fi

test/openshift/e2e/parallel/1-051-validate_csv_permissions/01-validate.yaml

@@ -7,4 +7,4 @@ commands:
     if test "$res" != "yes"; then
       echo "Can't delete resourcequotas"
       exit 1
-    fi
+    fi

test/openshift/e2e/parallel/1-057_validate_notifications/01-install.yaml

@@ -53,4 +53,4 @@ spec:
           image: quay.io/openshift-gitops-test/smtplistener:multiarch
           ports:
             - containerPort: 80
-            - containerPort: 2525
+            - containerPort: 2525

test/openshift/e2e/parallel/1-057_validate_notifications/03-create-app.yaml

@@ -22,4 +22,4 @@ commands:
         path: test/examples/nginx
         targetRevision: HEAD
     EOF
-- script: sleep 5
+- script: sleep 5

test/openshift/e2e/parallel/1-057_validate_notifications/04-delete-app.yaml

@@ -5,4 +5,4 @@ commands:
     set -e 
 
     kubectl delete -n $NAMESPACE application.argoproj.io my-app-3
-- script: sleep 5
+- script: sleep 5

test/openshift/e2e/parallel/1-057_validate_notifications/05-verify-email.yaml

@@ -16,4 +16,4 @@ commands:
         exit 0
     else
         exit 1
-    fi
+    fi

test/openshift/e2e/parallel/1-058_validate_prometheus_rule/03-create_application.yaml

@@ -21,4 +21,4 @@ commands:
         namespace: ${NAMESPACE}
       syncPolicy:
         automated: {}
-    EOF
+    EOF

test/openshift/e2e/parallel/1-064_validate_security_contexts/01-assert.yaml

@@ -94,4 +94,40 @@ spec:
               - ALL
             allowPrivilegeEscalation: false
             # readOnlyRootFilesystem: true
-            runAsNonRoot: true
+            runAsNonRoot: true
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kam
+  namespace: openshift-gitops
+spec:
+  template:
+    spec:
+      containers:
+        - securityContext:
+            capabilities:
+              drop:
+              - ALL
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            seccompProfile:
+              type: RuntimeDefault
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cluster
+  namespace: openshift-gitops
+spec:
+  template:
+    spec:
+      containers:
+        - securityContext:
+            capabilities:
+              drop:
+              - ALL
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            seccompProfile:
+              type: RuntimeDefault

test/openshift/e2e/parallel/1-064_validate_security_contexts/02-check-controller-manager.yaml

@@ -0,0 +1,23 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+- script: |
+    set -eo pipefail
+
+    ocp_major_version=$(oc version -o json | jq -r '.openshiftVersion' | cut -d'.' -f 1)
+    ocp_minor_version=$(oc version -o json | jq -r '.openshiftVersion' | cut -d'.' -f 2)
+
+    security_context=$(oc get deployment/openshift-gitops-operator-controller-manager -n openshift-operators -o jsonpath='{.spec.template.spec.containers[].securityContext}')
+    expected_security_context='{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}'
+
+    if [ "${ocp_major_version}" -eq 4 ]  && [ "${ocp_minor_version}" -ge 12 ]; then
+        if [ "${security_context}" = "${expected_security_context}" ]; then
+            exit 0
+        else
+            echo "Error: deployment/openshift-gitops-operator-controller-manager container's security context is wrong"
+            exit 1
+        fi
+    else
+        echo "Info: This test is only applicable to OCP version 4.12 and higher."
+        exit 0
+    fi

test/openshift/e2e/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha/02-generate_cert.yaml

@@ -3,12 +3,9 @@ kind: TestStep
 commands:
 - script: |
     set -e
-    if [[ $(uname -o) == "Darwin" ]]; then
-        echo "\n[SAN]\nsubjectAltName=DNS:argocd-redis.$NAMESPACE.svc.cluster.local\n[req]\ndistinguished_name=req" >${PWD}/openssl_test.cnf
-    else
-        echo -e "\n[SAN]\nsubjectAltName=DNS:argocd-redis.$NAMESPACE.svc.cluster.local\n[req]\ndistinguished_name=req" >${PWD}/openssl_test.cnf
-    fi
-
+
+    echo -e "\n[SAN]\nsubjectAltName=DNS:argocd-redis.$NAMESPACE.svc.cluster.local\n[req]\ndistinguished_name=req" > ${PWD}/openssl_test.cnf
+
     openssl req -new -x509 -sha256 \
      -subj "/C=XX/ST=XX/O=Testing/CN=redis" \
      -reqexts SAN -extensions SAN \
@@ -18,4 +15,4 @@ commands:
      -newkey rsa:4096 \
      -nodes \
      -sha256 \
-     -days 10
+     -days 10

test/openshift/e2e/parallel/1-067_validate_redis_secure_comm_no_autotls_ha/02-generate_cert.yaml

@@ -3,12 +3,9 @@ kind: TestStep
 commands:
 - script: |
     set -e
-    if [[ $(uname -o) == "Darwin" ]]; then
-      echo "\n[SAN]\nsubjectAltName=DNS:argocd-redis.$NAMESPACE.svc.cluster.local\n[req]\ndistinguished_name=req" > ${PWD}/openssl_test.cnf
-    else
-      echo -e "\n[SAN]\nsubjectAltName=DNS:argocd-redis.$NAMESPACE.svc.cluster.local\n[req]\ndistinguished_name=req" > ${PWD}/openssl_test.cnf
-    fi
-
+
+    echo -e "\n[SAN]\nsubjectAltName=DNS:argocd-redis.$NAMESPACE.svc.cluster.local\n[req]\ndistinguished_name=req" > ${PWD}/openssl_test.cnf
+
     openssl req -new -x509 -sha256 \
     -subj "/C=XX/ST=XX/O=Testing/CN=redis" \
     -reqexts SAN -extensions SAN \
@@ -18,4 +15,4 @@ commands:
     -newkey rsa:4096 \
     -nodes \
     -sha256 \
-    -days 10
+    -days 10

test/openshift/e2e/parallel/1-070_validate_config_management_plugin/02-create-app.yaml

@@ -17,4 +17,4 @@ spec:
     server: 'https://kubernetes.default.svc'
     namespace: argocd
   syncPolicy:
-    automated: {}
+    automated: {}

test/openshift/e2e/parallel/1-073_validate_rhsso/02-sleep.yaml

@@ -2,4 +2,4 @@
 apiVersion: kuttl.dev/v1beta1
 kind: TestStep
 commands:
-- script: sleep 60
+- script: sleep 60

test/openshift/e2e/parallel/1-074_validate_terminating_namespace_block/01-assert.yaml

@@ -27,4 +27,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: openshift-gitops-argocd-application-controller
-  namespace: openshift-gitops
+  namespace: openshift-gitops

test/openshift/e2e/parallel/1-074_validate_terminating_namespace_block/01-install.yaml

@@ -27,4 +27,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: openshift-gitops-argocd-application-controller
-  namespace: openshift-gitops
+  namespace: openshift-gitops

test/openshift/e2e/parallel/1-074_validate_terminating_namespace_block/02-assert.yaml

@@ -9,4 +9,4 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: my-config-map-2
-  namespace: gitops-2242-ns-first
+  namespace: gitops-2242-ns-first

test/openshift/e2e/parallel/1-074_validate_terminating_namespace_block/02-managed-ns-cm.yaml

@@ -13,4 +13,4 @@ metadata:
   finalizers:
   - some.random/finalizer
 data:
-  foo: bar
+  foo: bar

test/openshift/e2e/parallel/1-074_validate_terminating_namespace_block/03-delete-ns.yaml

@@ -6,4 +6,4 @@ commands:
 
       oc delete ns gitops-2242-ns-first --wait=false
 
-      exit 0
+      exit 0

test/openshift/e2e/parallel/1-074_validate_terminating_namespace_block/04-create-ns.yaml

@@ -3,4 +3,4 @@ kind: Namespace
 metadata:
   name: gitops-2242-ns-second
   labels:
-    argocd.argoproj.io/managed-by: gitops-2242-ns-main
+    argocd.argoproj.io/managed-by: gitops-2242-ns-main

test/openshift/e2e/parallel/1-074_validate_terminating_namespace_block/99-cleanup.yaml

@@ -12,4 +12,4 @@ commands:
       oc delete ns gitops-2242-ns-second --wait=false
       oc delete ns gitops-2242-ns-main --wait=false
 
-      exit 0
+      exit 0

test/openshift/e2e/parallel/1-075_validate_dex_anyuid/01-install.yaml

@@ -13,4 +13,4 @@ spec:
         requests:
           cpu: 250m
           memory: 128Mi
-    provider: dex
+    provider: dex

test/openshift/e2e/parallel/1-077_validate_disable_dex_removed/01-check_disable_dex_removed.yaml

@@ -4,16 +4,8 @@ commands:
 - script: |
     set -e
 
-    if [ -z $CI ]; then 
-        operator_name_version=$(oc get subscription/openshift-gitops-operator -n openshift-gitops-operator -o jsonpath='{.status.installedCSV}')
-        if [ "$(oc get csv/"${operator_name_version}" -n openshift-gitops-operator -o jsonpath='{.spec.install.spec.deployments[].spec.template.spec.containers[].env}' | grep DISABLE_DEX)" != '' ]; then
-          echo "DISABLE_DEX env var is still present in the operator CSV."
-          exit 1
-        fi 
-    else
-        operator_name_version=$(oc get subscription `subscription=gitops-operator- && oc get subscription --all-namespaces | grep $subscription | head -1 | awk '{print $2}'` -n openshift-gitops-operator -o jsonpath='{.status.installedCSV}')
-        if [ "$(oc get csv/"${operator_name_version}" -n openshift-gitops-operator -o jsonpath='{.spec.install.spec.deployments[].spec.template.spec.containers[].env}' | grep DISABLE_DEX)" != '' ]; then
-          echo "DISABLE_DEX env var is still present in the operator CSV."
-          exit 1
-        fi
-    fi
+    operator_name_version=$(oc get subscription/openshift-gitops-operator -n openshift-operators -o jsonpath='{.status.installedCSV}')
+    if [ "$(oc get csv/"${operator_name_version}" -n openshift-operators -o jsonpath='{.spec.install.spec.deployments[].spec.template.spec.containers[].env}' | grep DISABLE_DEX)" != '' ]; then
+      echo "DISABLE_DEX env var is still present in the operator CSV."
+      exit 1
+    fi

test/openshift/e2e/parallel/1-104_validate_applicationset_tls_scm_volume_mount/01-install.yaml

@@ -53,4 +53,4 @@ metadata:
   namespace: test-1-104-appsets-scm-tls-mount
 spec:
   applicationSet:
-    scmRootCAConfigMap: test-1-104-appsets-scm-tls-cm
+    scmRootCAConfigMap: test-1-104-appsets-scm-tls-cm

test/openshift/e2e/parallel/1-104_validate_applicationset_tls_scm_volume_mount/99-delete.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+delete:
+- apiVersion: v1
+  kind: Namespace
+  name: test-1-104-appsets-scm-tls-mount