From 2bfae4d22b32bf9d15958d04ef38496109010147 Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Thu, 1 Oct 2026 13:18:33 +0530 Subject: [PATCH 01/10] fix: throw an error if openshiftOAuth is used in xKS env Signed-off-by: Anand Kumar Singh --- argocd-operator/controllers/argocd/sso.go | 3 + .../controllers/argocd/sso_test.go | 33 ++++++++ .../1-007_validate_volume_mounts_test.go | 7 +- .../1-042_restricted_pss_compliant_test.go | 7 +- .../parallel/1-050_validate_sso_test.go | 9 +- .../1-095_validate_dex_clientsecret_test.go | 3 +- ...98_validate_dex_clientsecret_deprecated.go | 2 +- .../parallel/1-143_dex_OpenshiftOAuth_test.go | 84 +++++++++++++++++++ 8 files changed, 142 insertions(+), 6 deletions(-) create mode 100644 test/openshift/e2e/ginkgo/parallel/1-143_dex_OpenshiftOAuth_test.go diff --git a/argocd-operator/controllers/argocd/sso.go b/argocd-operator/controllers/argocd/sso.go index d7c601a8679..b64c59a1828 100644 --- a/argocd-operator/controllers/argocd/sso.go +++ b/argocd-operator/controllers/argocd/sso.go @@ -55,6 +55,9 @@ func (r *ReconcileArgoCD) reconcileSSO(cr *argoproj.ArgoCD, argocdStatus *argopr // https://github.com/argoproj-labs/argocd-operator/pull/615 ==> conflict errMsg = "must supply valid dex configuration when requested SSO provider is dex" isError = true + } else if cr.Spec.SSO.Dex != nil && cr.Spec.SSO.Dex.OpenShiftOAuth && !IsOpenShiftCluster() { + errMsg = "openShiftOAuth is only supported on OpenShift clusters. Please set the openShiftOAuth configuration." + isError = true } else if cr.Spec.SSO.Keycloak != nil { errMsg = "keycloak configuration is specified even though Dex is enabled. Keycloak support has been deprecated and is no longer available." isError = true diff --git a/argocd-operator/controllers/argocd/sso_test.go b/argocd-operator/controllers/argocd/sso_test.go index eee725c9564..e3001fdfc4f 100644 --- a/argocd-operator/controllers/argocd/sso_test.go +++ b/argocd-operator/controllers/argocd/sso_test.go @@ -39,6 +39,7 @@ func TestReconcile_illegalSSOConfiguration(t *testing.T) { tests := []struct { name string argoCD *argoproj.ArgoCD + openShiftCluster bool wantErr bool Err error wantSSOConfigLegalStatus string @@ -98,6 +99,34 @@ func TestReconcile_illegalSSOConfiguration(t *testing.T) { Err: errors.New("illegal SSO configuration: must supply valid dex configuration when requested SSO provider is dex"), wantSSOConfigLegalStatus: "Failed", }, + { + name: "openShiftOAuth true on non-OpenShift cluster", + argoCD: makeTestArgoCD(func(ac *argoproj.ArgoCD) { + ac.Spec.SSO = &argoproj.ArgoCDSSOSpec{ + Provider: argoproj.SSOProviderTypeDex, + Dex: &argoproj.ArgoCDDexSpec{ + OpenShiftOAuth: true, + }, + } + }), + wantErr: true, + Err: errors.New("illegal SSO configuration: openShiftOAuth is only supported on OpenShift clusters. Please set the openShiftOAuth configuration."), + wantSSOConfigLegalStatus: "Failed", + }, + { + name: "openShiftOAuth true on OpenShift cluster", + argoCD: makeTestArgoCD(func(ac *argoproj.ArgoCD) { + ac.Spec.SSO = &argoproj.ArgoCDSSOSpec{ + Provider: argoproj.SSOProviderTypeDex, + Dex: &argoproj.ArgoCDDexSpec{ + OpenShiftOAuth: true, + }, + } + }), + openShiftCluster: true, + wantErr: false, + wantSSOConfigLegalStatus: "", + }, { name: "sso provider missing but sso.dex/keycloak supplied", argoCD: makeTestArgoCD(func(ac *argoproj.ArgoCD) { @@ -134,6 +163,10 @@ func TestReconcile_illegalSSOConfiguration(t *testing.T) { for _, test := range tests { t.Run(test.name, func(t *testing.T) { + original := versionAPIFound + versionAPIFound = test.openShiftCluster + t.Cleanup(func() { versionAPIFound = original }) + resObjs := []client.Object{test.argoCD} subresObjs := []client.Object{test.argoCD} runtimeObjs := []runtime.Object{} diff --git a/test/openshift/e2e/ginkgo/parallel/1-007_validate_volume_mounts_test.go b/test/openshift/e2e/ginkgo/parallel/1-007_validate_volume_mounts_test.go index 8bca3ab943a..24d67949236 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-007_validate_volume_mounts_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-007_validate_volume_mounts_test.go @@ -153,7 +153,12 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { SSO: &argov1beta1api.ArgoCDSSOSpec{ Provider: argov1beta1api.SSOProviderTypeDex, Dex: &argov1beta1api.ArgoCDDexSpec{ - OpenShiftOAuth: true, + Config: `| + connectors: + # GitHub example + - type: github + id: github + name: GitHub`, Volumes: []corev1.Volume{ {Name: "custom-dex-volume", VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{}}}, }, diff --git a/test/openshift/e2e/ginkgo/parallel/1-042_restricted_pss_compliant_test.go b/test/openshift/e2e/ginkgo/parallel/1-042_restricted_pss_compliant_test.go index a42d0d23f2e..6fe5eb23e9c 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-042_restricted_pss_compliant_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-042_restricted_pss_compliant_test.go @@ -94,7 +94,12 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { SSO: &argov1beta1api.ArgoCDSSOSpec{ Provider: argov1beta1api.SSOProviderTypeDex, Dex: &argov1beta1api.ArgoCDDexSpec{ - OpenShiftOAuth: true, + Config: `| + connectors: + # GitHub example + - type: github + id: github + name: GitHub`, }, }, }, diff --git a/test/openshift/e2e/ginkgo/parallel/1-050_validate_sso_test.go b/test/openshift/e2e/ginkgo/parallel/1-050_validate_sso_test.go index 169e389e05c..1e46e318fc4 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-050_validate_sso_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-050_validate_sso_test.go @@ -122,7 +122,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { }) // openshiftOAuth is not supported in xKS - It("ensures Dex/Keycloak SSO can be enabled and disabled on a namespace-scoped Argo CD instance", func() { + It("ensures Dex/Keycloak SSO can be enabled and disabled on a namespace-scoped Argo CD instance", Label("openshift"), func() { ns, cleanupFunc = fixture.CreateRandomE2ETestNamespaceWithCleanupFunc() @@ -137,7 +137,12 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { SSO: &argov1beta1api.ArgoCDSSOSpec{ Provider: "dex", Dex: &argov1beta1api.ArgoCDDexSpec{ - OpenShiftOAuth: true, + Config: `| + connectors: + # GitHub example + - type: github + id: github + name: GitHub`, }, }, }, diff --git a/test/openshift/e2e/ginkgo/parallel/1-095_validate_dex_clientsecret_test.go b/test/openshift/e2e/ginkgo/parallel/1-095_validate_dex_clientsecret_test.go index b9fbfb370af..74d32935987 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-095_validate_dex_clientsecret_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-095_validate_dex_clientsecret_test.go @@ -173,7 +173,8 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { }, "2m", "5s").Should(BeTrue(), "Dex client secret in argocd-secret must match the token in the dedicated Dex token Secret") }) - It("verifies the operator deletes legacy non-expiring Dex kubernetes.io/service-account-token Secrets and drops them from the Dex SA", func() { + // Openshift OAuth is not supported in xKS + It("verifies the operator deletes legacy non-expiring Dex kubernetes.io/service-account-token Secrets and drops them from the Dex SA", Label("openshift"), func() { By("creating simple Argo CD instance with Dex and Openshift OAuth enabled") ns, cleanupFunc := fixture.CreateRandomE2ETestNamespaceWithCleanupFunc() diff --git a/test/openshift/e2e/ginkgo/parallel/1-098_validate_dex_clientsecret_deprecated.go b/test/openshift/e2e/ginkgo/parallel/1-098_validate_dex_clientsecret_deprecated.go index f38c9346647..2290df79483 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-098_validate_dex_clientsecret_deprecated.go +++ b/test/openshift/e2e/ginkgo/parallel/1-098_validate_dex_clientsecret_deprecated.go @@ -48,7 +48,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { ctx = context.Background() }) - It("validates that dex client secret is properly copied from service account token to argocd-secret", func() { + It("validates that dex client secret is properly copied from service account token to argocd-secret", Label("openshift"), func() { // Create namespace for this test and ensure cleanup namespace, cleanupFunc := fixture.CreateRandomE2ETestNamespaceWithCleanupFunc() diff --git a/test/openshift/e2e/ginkgo/parallel/1-143_dex_OpenshiftOAuth_test.go b/test/openshift/e2e/ginkgo/parallel/1-143_dex_OpenshiftOAuth_test.go new file mode 100644 index 00000000000..fc13030d753 --- /dev/null +++ b/test/openshift/e2e/ginkgo/parallel/1-143_dex_OpenshiftOAuth_test.go @@ -0,0 +1,84 @@ +/* +Copyright 2025. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package parallel + +import ( + "context" + + argov1beta1api "github.com/argoproj-labs/gitops-operator/argocd-operator/api/v1beta1" + argocdFixture "github.com/argoproj-labs/gitops-operator/argocd-operator/tests/ginkgo/fixture/argocd" + . "github.com/onsi/ginkgo/v2" + . "github.com/onsi/gomega" + "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture" + fixtureUtils "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture/utils" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "sigs.k8s.io/controller-runtime/pkg/client" +) + +var _ = Describe("GitOps Operator Parallel E2E Tests", func() { + + Context("1-143_dex_OpenshiftOAuth_on_xKS_OpenShift", func() { + + var ( + k8sClient client.Client + ctx context.Context + ) + + BeforeEach(func() { + fixture.EnsureParallelCleanSlate() + k8sClient, _ = fixtureUtils.GetE2ETestKubeClient() + ctx = context.Background() + }) + + It("should fail reconciliation when OpenShiftOAuth is enabled on a non-OpenShift cluster", func() { + if fixture.RunningOnOpenShift() { + Skip("This test validates behavior on non-OpenShift clusters only") + } + + By("creating namespace for test") + ns, cleanupFunc := fixture.CreateRandomE2ETestNamespaceWithCleanupFunc() + defer cleanupFunc() + + By("creating an ArgoCD instance with OpenShiftOAuth enabled") + argoCD := &argov1beta1api.ArgoCD{ + ObjectMeta: metav1.ObjectMeta{Name: "argocd", Namespace: ns.Name}, + Spec: argov1beta1api.ArgoCDSpec{ + SSO: &argov1beta1api.ArgoCDSSOSpec{ + Provider: argov1beta1api.SSOProviderTypeDex, + Dex: &argov1beta1api.ArgoCDDexSpec{ + OpenShiftOAuth: true, + }, + }, + }, + } + Expect(k8sClient.Create(ctx, argoCD)).To(Succeed()) + + By("verifying the ArgoCD instance fails due to illegal SSO configuration for OpenShiftOAuth") + Eventually(argoCD, "2m", "5s").Should( + And(argocdFixture.HavePhase("Failed"), + argocdFixture.HaveSSOStatus("Failed"), + )) + + Eventually(argoCD, "2m", "5s").Should(argocdFixture.HaveCondition(metav1.Condition{ + Message: "illegal SSO configuration: openShiftOAuth is only supported on OpenShift clusters. Please set the openShiftOAuth configuration.", + Reason: "ErrorOccurred", + Status: "False", + Type: "Reconciled", + })) + }) + }) +}) From d6ac4e5837f5ebadabe556f29314af3ca73de319 Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Mon, 5 Oct 2026 13:35:36 +0530 Subject: [PATCH 02/10] fix: dex connector and label test for xks Signed-off-by: Anand Kumar Singh --- .../parallel/1-007_validate_volume_mounts_test.go | 15 +++++++++------ .../1-042_restricted_pss_compliant_test.go | 15 +++++++++------ .../ginkgo/parallel/1-050_validate_sso_test.go | 15 +++++++++------ .../parallel/1-143_dex_OpenshiftOAuth_test.go | 5 +---- 4 files changed, 28 insertions(+), 22 deletions(-) diff --git a/test/openshift/e2e/ginkgo/parallel/1-007_validate_volume_mounts_test.go b/test/openshift/e2e/ginkgo/parallel/1-007_validate_volume_mounts_test.go index 24d67949236..e2f43100813 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-007_validate_volume_mounts_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-007_validate_volume_mounts_test.go @@ -153,12 +153,15 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { SSO: &argov1beta1api.ArgoCDSSOSpec{ Provider: argov1beta1api.SSOProviderTypeDex, Dex: &argov1beta1api.ArgoCDDexSpec{ - Config: `| - connectors: - # GitHub example - - type: github - id: github - name: GitHub`, + Config: `connectors: + - type: github + id: github + name: github-using-first-class + config: + clientID: first-class + clientSecret: $dex.github.clientSecret + orgs: + - name: first-class`, Volumes: []corev1.Volume{ {Name: "custom-dex-volume", VolumeSource: corev1.VolumeSource{EmptyDir: &corev1.EmptyDirVolumeSource{}}}, }, diff --git a/test/openshift/e2e/ginkgo/parallel/1-042_restricted_pss_compliant_test.go b/test/openshift/e2e/ginkgo/parallel/1-042_restricted_pss_compliant_test.go index 6fe5eb23e9c..da0b34bc469 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-042_restricted_pss_compliant_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-042_restricted_pss_compliant_test.go @@ -94,12 +94,15 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { SSO: &argov1beta1api.ArgoCDSSOSpec{ Provider: argov1beta1api.SSOProviderTypeDex, Dex: &argov1beta1api.ArgoCDDexSpec{ - Config: `| - connectors: - # GitHub example - - type: github - id: github - name: GitHub`, + Config: `connectors: + - type: github + id: github + name: github-using-first-class + config: + clientID: first-class + clientSecret: $dex.github.clientSecret + orgs: + - name: first-class`, }, }, }, diff --git a/test/openshift/e2e/ginkgo/parallel/1-050_validate_sso_test.go b/test/openshift/e2e/ginkgo/parallel/1-050_validate_sso_test.go index 1e46e318fc4..b5f5f0e9916 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-050_validate_sso_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-050_validate_sso_test.go @@ -137,12 +137,15 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { SSO: &argov1beta1api.ArgoCDSSOSpec{ Provider: "dex", Dex: &argov1beta1api.ArgoCDDexSpec{ - Config: `| - connectors: - # GitHub example - - type: github - id: github - name: GitHub`, + Config: `connectors: + - type: github + id: github + name: github-using-first-class + config: + clientID: first-class + clientSecret: $dex.github.clientSecret + orgs: + - name: first-class`, }, }, }, diff --git a/test/openshift/e2e/ginkgo/parallel/1-143_dex_OpenshiftOAuth_test.go b/test/openshift/e2e/ginkgo/parallel/1-143_dex_OpenshiftOAuth_test.go index fc13030d753..48641e7246d 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-143_dex_OpenshiftOAuth_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-143_dex_OpenshiftOAuth_test.go @@ -44,10 +44,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { ctx = context.Background() }) - It("should fail reconciliation when OpenShiftOAuth is enabled on a non-OpenShift cluster", func() { - if fixture.RunningOnOpenShift() { - Skip("This test validates behavior on non-OpenShift clusters only") - } + It("should fail reconciliation when OpenShiftOAuth is enabled on a non-OpenShift cluster", Label("xks"), func() { By("creating namespace for test") ns, cleanupFunc := fixture.CreateRandomE2ETestNamespaceWithCleanupFunc() From 9d1f7e022388bb3463e7a7670d4f24966c1dc8e1 Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Mon, 5 Oct 2026 14:40:18 +0530 Subject: [PATCH 03/10] fix: remove openshift label and update By test statement Signed-off-by: Anand Kumar Singh --- test/openshift/e2e/ginkgo/parallel/1-050_validate_sso_test.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test/openshift/e2e/ginkgo/parallel/1-050_validate_sso_test.go b/test/openshift/e2e/ginkgo/parallel/1-050_validate_sso_test.go index b5f5f0e9916..fd8fe6b9a0c 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-050_validate_sso_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-050_validate_sso_test.go @@ -122,11 +122,11 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { }) // openshiftOAuth is not supported in xKS - It("ensures Dex/Keycloak SSO can be enabled and disabled on a namespace-scoped Argo CD instance", Label("openshift"), func() { + It("ensures Dex/Keycloak SSO can be enabled and disabled on a namespace-scoped Argo CD instance", func() { ns, cleanupFunc = fixture.CreateRandomE2ETestNamespaceWithCleanupFunc() - By("creating a new Argo CD instance with dex and openshift oauth enabled") + By("creating a new Argo CD instance with dex") newArgoCD := &argov1beta1api.ArgoCD{ ObjectMeta: metav1.ObjectMeta{ From dc247b08335f7c95e4d8f1491274a4b96d8e1a1c Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Wed, 7 Oct 2026 13:12:47 +0530 Subject: [PATCH 04/10] fix: update err msg to be more clear to users Signed-off-by: Anand Kumar Singh --- argocd-operator/controllers/argocd/sso.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/argocd-operator/controllers/argocd/sso.go b/argocd-operator/controllers/argocd/sso.go index b64c59a1828..203669a2523 100644 --- a/argocd-operator/controllers/argocd/sso.go +++ b/argocd-operator/controllers/argocd/sso.go @@ -56,7 +56,7 @@ func (r *ReconcileArgoCD) reconcileSSO(cr *argoproj.ArgoCD, argocdStatus *argopr errMsg = "must supply valid dex configuration when requested SSO provider is dex" isError = true } else if cr.Spec.SSO.Dex != nil && cr.Spec.SSO.Dex.OpenShiftOAuth && !IsOpenShiftCluster() { - errMsg = "openShiftOAuth is only supported on OpenShift clusters. Please set the openShiftOAuth configuration." + errMsg = "openShiftOAuth is only supported on OpenShift clusters. Please disable the openShiftOAuth configuration." isError = true } else if cr.Spec.SSO.Keycloak != nil { errMsg = "keycloak configuration is specified even though Dex is enabled. Keycloak support has been deprecated and is no longer available." From 13ec871b660c325ae200e7d0ef6f2a8d2f1cf459 Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Wed, 7 Oct 2026 13:55:05 +0530 Subject: [PATCH 05/10] fix: update tests Signed-off-by: Anand Kumar Singh --- argocd-operator/controllers/argocd/sso_test.go | 2 +- .../e2e/ginkgo/parallel/1-143_dex_OpenshiftOAuth_test.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/argocd-operator/controllers/argocd/sso_test.go b/argocd-operator/controllers/argocd/sso_test.go index e3001fdfc4f..50fdfecdf0d 100644 --- a/argocd-operator/controllers/argocd/sso_test.go +++ b/argocd-operator/controllers/argocd/sso_test.go @@ -110,7 +110,7 @@ func TestReconcile_illegalSSOConfiguration(t *testing.T) { } }), wantErr: true, - Err: errors.New("illegal SSO configuration: openShiftOAuth is only supported on OpenShift clusters. Please set the openShiftOAuth configuration."), + Err: errors.New("illegal SSO configuration: openShiftOAuth is only supported on OpenShift clusters. Please disable the openShiftOAuth configuration."), wantSSOConfigLegalStatus: "Failed", }, { diff --git a/test/openshift/e2e/ginkgo/parallel/1-143_dex_OpenshiftOAuth_test.go b/test/openshift/e2e/ginkgo/parallel/1-143_dex_OpenshiftOAuth_test.go index 48641e7246d..d16a91bd7e5 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-143_dex_OpenshiftOAuth_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-143_dex_OpenshiftOAuth_test.go @@ -71,7 +71,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { )) Eventually(argoCD, "2m", "5s").Should(argocdFixture.HaveCondition(metav1.Condition{ - Message: "illegal SSO configuration: openShiftOAuth is only supported on OpenShift clusters. Please set the openShiftOAuth configuration.", + Message: "illegal SSO configuration: openShiftOAuth is only supported on OpenShift clusters. Please disable the openShiftOAuth configuration.", Reason: "ErrorOccurred", Status: "False", Type: "Reconciled", From 347def200b70841dd87071666e0ef57d136dd27c Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Wed, 7 Oct 2026 20:26:34 +0530 Subject: [PATCH 06/10] fix: failing test Signed-off-by: Anand Kumar Singh --- .../ginkgo/parallel/1-095_validate_dex_clientsecret_test.go | 2 +- .../ginkgo/sequential/1-064_validate_tcp_reset_error_test.go | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/test/openshift/e2e/ginkgo/parallel/1-095_validate_dex_clientsecret_test.go b/test/openshift/e2e/ginkgo/parallel/1-095_validate_dex_clientsecret_test.go index 74d32935987..8bf17eecfe3 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-095_validate_dex_clientsecret_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-095_validate_dex_clientsecret_test.go @@ -72,7 +72,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { ctx = context.Background() }) - It("verifies that the Dex client secret is sourced from a short-lived TokenRequest token and is correctly set in argocd-secret", func() { + It("verifies that the Dex client secret is sourced from a short-lived TokenRequest token and is correctly set in argocd-secret", Label("openshift"), func() { By("creating simple Argo CD instance with Dex and Openshift OAuth enabled") ns, cleanupFunc := fixture.CreateRandomE2ETestNamespaceWithCleanupFunc() diff --git a/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go b/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go index a56afed73a5..ba7acf06dff 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go @@ -101,13 +101,13 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { } Expect(k8sClient.Create(ctx, app)).To(Succeed()) - By("verifying test-1-27-custom NS is created and is managed by openshift-gitops, and Application deploys successfully") + By("verifying test-1-27-custom NS is created and is managed by argocd-027, and Application deploys successfully") test_1_27_customNS = &corev1.Namespace{ ObjectMeta: metav1.ObjectMeta{Name: "test-1-27-custom"}, } Eventually(test_1_27_customNS, "5m", "5s").Should(k8sFixture.ExistByName()) - Eventually(test_1_27_customNS).Should(namespaceFixture.HaveLabel("argocd.argoproj.io/managed-by", "openshift-gitops")) + Eventually(test_1_27_customNS).Should(namespaceFixture.HaveLabel("argocd.argoproj.io/managed-by", "argocd-027")) Eventually(app, "4m", "5s").Should(appFixture.HaveHealthStatusCode(health.HealthStatusHealthy)) Eventually(app, "4m", "5s").Should(appFixture.HaveSyncStatusCode(argocdv1alpha1.SyncStatusCodeSynced)) From 5095e9cc177431124ec43e96e85f71cf2f7138d2 Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Thu, 8 Oct 2026 12:12:43 +0530 Subject: [PATCH 07/10] fix: failing test Signed-off-by: Anand Kumar Singh --- .../1-064_validate_tcp_reset_error_test.go | 21 ++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go b/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go index ba7acf06dff..42a4aa650d0 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go @@ -67,19 +67,26 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { } }) - It("verifies that argocd cli app manifests command will successfully retrieve app manifests, and tcp reset error will not occur", Label("openshift"), func() { + It("verifies that argocd cli app manifests command will successfully retrieve app manifests, and tcp reset error will not occur", func() { // This test is VERY similar to 1-027. - openshiftgitopsArgoCD, err := argocdFixture.GetOpenShiftGitOpsNSArgoCD() - Expect(err).ToNot(HaveOccurred()) + By("getting creating Argo CD instance in new namespace") + _, cleanup := fixture.CreateNamespaceWithCleanupFunc("argocd-027") + defer cleanup() + ArgoCD := &v1beta1.ArgoCD{ + ObjectMeta: metav1.ObjectMeta{Name: "argocd-027", Namespace: "argocd-027"}, + } + Expect(k8sClient.Create(ctx, ArgoCD)).To(Succeed()) + + fixture.SetEnvInOperatorSubscriptionOrDeployment("ARGOCD_CLUSTER_CONFIG_NAMESPACES", "argocd-027") - By("verifying openshift-gitops Argo CD instance is available") - Eventually(openshiftgitopsArgoCD, "5m", "5s").Should(argocdFixture.BeAvailable()) + By("verifying argocd-027 Argo CD instance is available") + Eventually(ArgoCD, "5m", "5s").Should(argocdFixture.BeAvailable()) By("creating Argo CD Application in openshift-gitops namespace") app = &argocdv1alpha1.Application{ - ObjectMeta: metav1.ObjectMeta{Name: "1-27-argocd", Namespace: openshiftgitopsArgoCD.Namespace}, + ObjectMeta: metav1.ObjectMeta{Name: "1-27-argocd", Namespace: ArgoCD.Namespace}, Spec: argocdv1alpha1.ApplicationSpec{ Source: &argocdv1alpha1.ApplicationSource{ Path: "./test/examples/1-027_operand-from-git", @@ -87,7 +94,7 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { TargetRevision: "HEAD", }, Destination: argocdv1alpha1.ApplicationDestination{ - Namespace: openshiftgitopsArgoCD.Namespace, + Namespace: ArgoCD.Namespace, Server: "https://kubernetes.default.svc", }, Project: "default", From 8560e64f12cfda0ece400e5421e7c5b39ac9ea1d Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Thu, 8 Oct 2026 15:24:26 +0530 Subject: [PATCH 08/10] fix: 1064 dependent on route Signed-off-by: Anand Kumar Singh --- .../ginkgo/sequential/1-064_validate_tcp_reset_error_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go b/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go index 42a4aa650d0..e88e2d230d7 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go @@ -67,7 +67,7 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { } }) - It("verifies that argocd cli app manifests command will successfully retrieve app manifests, and tcp reset error will not occur", func() { + It("verifies that argocd cli app manifests command will successfully retrieve app manifests, and tcp reset error will not occur", Label("openshift"), func() { // This test is VERY similar to 1-027. From 1cd25aaaf60efcc43ba93589e8b36151ba97d404 Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Fri, 9 Oct 2026 12:45:33 +0530 Subject: [PATCH 09/10] fix: cleanup afterEach Signed-off-by: Anand Kumar Singh --- .../ginkgo/sequential/1-064_validate_tcp_reset_error_test.go | 3 --- 1 file changed, 3 deletions(-) diff --git a/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go b/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go index e88e2d230d7..dd4925d3e3f 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go @@ -59,9 +59,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { fixture.OutputDebugOnFail("openshift-gitops", "test-1-27-custom") - if app != nil { - Expect(k8sClient.Delete(ctx, app)).To(Succeed()) - } if test_1_27_customNS != nil { Expect(k8sClient.Delete(ctx, test_1_27_customNS)).To(Succeed()) } From 1a745fc9cd43e47ab1a05419f0f6a7a6dd417271 Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Fri, 9 Oct 2026 20:34:25 +0530 Subject: [PATCH 10/10] fix: update 1-064 test and fixture to login using argocd instance assisted-by: cursor Signed-off-by: Anand Kumar Singh --- test/openshift/e2e/ginkgo/fixture/argocd/fixture.go | 11 ++++++----- .../sequential/1-064_validate_tcp_reset_error_test.go | 10 +++++++++- 2 files changed, 15 insertions(+), 6 deletions(-) diff --git a/test/openshift/e2e/ginkgo/fixture/argocd/fixture.go b/test/openshift/e2e/ginkgo/fixture/argocd/fixture.go index 7edfe805317..1be466c2a75 100644 --- a/test/openshift/e2e/ginkgo/fixture/argocd/fixture.go +++ b/test/openshift/e2e/ginkgo/fixture/argocd/fixture.go @@ -324,16 +324,16 @@ func LogInToDefaultArgoCDInstance() error { // NOTE: this should only be called from sequential tests. If you call it from a parallel test, there is a risk that another test will login to a different Argo CD instance. // -// Unlike LogInToDefaultArgoCDInstance, this logs in via the 'openshift-gitops-server' Route rather than a +// Unlike LogInToDefaultArgoCDInstance, this logs in via the Argo CD server Route rather than a // port-forward. Only use this if the test specifically needs to exercise the OpenShift Router code path (for // example, a regression test for a bug that only reproduces when traffic passes through the Route). -func LogInToDefaultArgoCDInstanceViaRoute() error { +func LogInToArgoCDInstanceViaRoute(argoCD *argov1beta1api.ArgoCD) error { k8sClient, _, err := utils.GetE2ETestKubeClientWithError() if err != nil { return err } - route := &routev1.Route{ObjectMeta: metav1.ObjectMeta{Name: "openshift-gitops-server", Namespace: "openshift-gitops"}} + route := &routev1.Route{ObjectMeta: metav1.ObjectMeta{Name: argoCD.Name + "-server", Namespace: argoCD.Namespace}} Eventually(func() error { return k8sClient.Get(context.Background(), client.ObjectKeyFromObject(route), route) @@ -341,9 +341,10 @@ func LogInToDefaultArgoCDInstanceViaRoute() error { Eventually(route, "3m", "2s").Should(routeFixture.HaveAdmittedIngress()) - secret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "openshift-gitops-cluster", Namespace: "openshift-gitops"}} + secretName := argoCD.Name + "-cluster" + secret := &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: secretName, Namespace: argoCD.Namespace}} if err := k8sClient.Get(context.Background(), client.ObjectKeyFromObject(secret), secret); err != nil { - return fmt.Errorf("unable to locate 'openshift-gitops-cluster' Secret") + return fmt.Errorf("unable to locate %q Secret", secretName) } // Note: '--skip-test-tls' parameter was added in Feb 2025, to work around OpenShift Routes not supporting HTTP2 by default, along with Argo CD upstream bugs https://github.com/argoproj/argo-cd/issues/21764, and https://github.com/argoproj/argo-cd/issues/20121 diff --git a/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go b/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go index dd4925d3e3f..2e12e48c531 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-064_validate_tcp_reset_error_test.go @@ -71,8 +71,16 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { By("getting creating Argo CD instance in new namespace") _, cleanup := fixture.CreateNamespaceWithCleanupFunc("argocd-027") defer cleanup() + ArgoCD := &v1beta1.ArgoCD{ ObjectMeta: metav1.ObjectMeta{Name: "argocd-027", Namespace: "argocd-027"}, + Spec: v1beta1.ArgoCDSpec{ + Server: v1beta1.ArgoCDServerSpec{ + Route: v1beta1.ArgoCDRouteSpec{ + Enabled: true, + }, + }, + }, } Expect(k8sClient.Create(ctx, ArgoCD)).To(Succeed()) @@ -153,7 +161,7 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { Eventually(guestbookApp, "4m", "5s").Should(appFixture.HaveSyncStatusCode(argocdv1alpha1.SyncStatusCodeSynced)) By("verifying we can log in to Argo CD via CLI, via the Route (this test specifically validates behavior of Argo CD CLI when going through the OpenShift Router)") - Expect(argocdFixture.LogInToDefaultArgoCDInstanceViaRoute()).To(Succeed()) + Expect(argocdFixture.LogInToArgoCDInstanceViaRoute(ArgoCD)).To(Succeed()) By("retrieving the Argo CD app manifests via CLI, and verifying the command succeeds and that there is no 'TCP reset error' error")