Skip to content

Commit f4c1057

Browse files
mbaldessarimbaldessari
committed
Make clusterGroup.isHubCluster optional
We can figure out if a node is the hub or not by omparing global.localClusterDomain and global.hubClusterDomain. If those are the same we're on the hub, if they are not we're not on the hub. Keep supporting the clusterGroup.isHubCluster variable with precedence in order to not break any existing pattern. Tested on 4.19 and 4.20 with mcg hub/spoke
1 parent 46cf092 commit f4c1057

8 files changed

+644
-4
lines changed

‎templates/_helpers.tpl‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,3 +196,26 @@ health_status.status = "Progressing"
196196
health_status.message = "An install plan for a subscription is pending installation"
197197
return health_status
198198
{{- end }} {{- /*acm.subscription.healthcheck.lua */}}
199+
200+
{{/*
201+
Determines if the current cluster is a hub cluster.
202+
First checks if clusterGroup.isHubCluster is explicitly set and uses that value.
203+
If not set, falls back to comparing global.localClusterDomain and global.hubClusterDomain.
204+
If domains are equal or localClusterDomain is not set (defaults to hubClusterDomain), this is a hub cluster.
205+
Usage: {{ include "acm.ishubcluster" . }}
206+
Returns: "true" or "false" as a string
207+
*/}}
208+
{{- define "acm.ishubcluster" -}}
209+
{{- if and (hasKey .Values.clusterGroup "isHubCluster") (not (kindIs "invalid" .Values.clusterGroup.isHubCluster)) -}}
210+
{{- .Values.clusterGroup.isHubCluster | toString -}}
211+
{{- else if $.Values.global.hubClusterDomain -}}
212+
{{- $localDomain := coalesce $.Values.global.localClusterDomain $.Values.global.hubClusterDomain -}}
213+
{{- if eq $localDomain $.Values.global.hubClusterDomain -}}
214+
true
215+
{{- else -}}
216+
false
217+
{{- end -}}
218+
{{- else -}}
219+
false
220+
{{- end -}}
221+
{{- end }}

‎templates/policies/acm-hub-ca-policy.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# This pushes out the HUB's Certificate Authorities on to the imported clusters
2-
{{- if .Values.clusterGroup.isHubCluster }}
2+
{{- if eq (include "acm.ishubcluster" .) "true" }}
33
{{- range .Values.clusterGroup.managedClusterGroups }}
44
{{- $group := . }}
55
---
@@ -217,4 +217,4 @@ spec:
217217

218218
{{- end }}{{/* if (eq ((($.Values.global).secretStore).backend) "vault") */}}
219219
{{- end }}{{/* range .Values.clusterGroup.managedClusterGroups */}}
220-
{{- end }}{{/* isHubCluster */}}
220+
{{- end }}{{/* ishubcluster */}}

‎templates/policies/private-repo-policies.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ spec:
8484
"group" $group
8585
) | nindent 2 }}
8686
{{- end }}{{- /* range .Values.clusterGroup.managedClusterGroups */}}
87-
{{ if $.Values.clusterGroup.isHubCluster }}
87+
{{ if eq (include "acm.ishubcluster" $) "true" }}
8888
---
8989
apiVersion: policy.open-cluster-management.io/v1
9090
kind: Policy
@@ -153,5 +153,5 @@ spec:
153153
values:
154154
- 'true'
155155
---
156-
{{ end }}{{- /* if .Values.clusterGroup.isHubCluster */}}
156+
{{ end }}{{- /* if ishubcluster */}}
157157
{{- end }}{{- /* if $.Values.global.privateRepo */}}

‎tests/hub_cluster_additional_scenarios_test.yaml‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
suite: Test Hub Cluster Detection Additional Scenarios
2+
templates:
3+
- templates/policies/acm-hub-ca-policy.yaml
4+
release:
5+
name: release-test
6+
tests:
7+
# Test subdomain variations (domain-based detection)
8+
- it: should differentiate between similar domains
9+
set:
10+
global:
11+
repoURL: https://github.com/test/repo
12+
hubClusterDomain: "apps.hub.example.com"
13+
localClusterDomain: "apps.hub-spoke.example.com" # Similar but different
14+
secretStore:
15+
backend: "vault"
16+
pattern: "test-pattern"
17+
clusterGroup:
18+
isHubCluster: null # Explicitly unset to enable domain-based detection
19+
managedClusterGroups:
20+
test:
21+
name: test-cluster
22+
asserts:
23+
- hasDocuments:
24+
count: 0
25+
26+
# Test with special characters (domain-based detection)
27+
- it: should handle domains with special characters
28+
set:
29+
global:
30+
repoURL: https://github.com/test/repo
31+
hubClusterDomain: "apps.hub-cluster_1.example-domain.com"
32+
localClusterDomain: "apps.hub-cluster_1.example-domain.com"
33+
secretStore:
34+
backend: "vault"
35+
pattern: "test-pattern"
36+
clusterGroup:
37+
isHubCluster: null # Explicitly unset to enable domain-based detection
38+
managedClusterGroups:
39+
test:
40+
name: test-cluster
41+
asserts:
42+
- hasDocuments:
43+
count: 9
44+
45+
# Test with missing managedClusterGroups
46+
- it: should handle missing managedClusterGroups gracefully
47+
set:
48+
global:
49+
repoURL: https://github.com/test/repo
50+
hubClusterDomain: "apps.hub.example.com"
51+
localClusterDomain: "apps.hub.example.com"
52+
secretStore:
53+
backend: "vault"
54+
pattern: "test-pattern"
55+
clusterGroup:
56+
isHubCluster: null # Explicitly unset to enable domain-based detection
57+
managedClusterGroups: null # Explicitly unset
58+
asserts:
59+
- hasDocuments:
60+
count: 0 # No managed cluster groups means no policies
61+
62+
# Test with empty managedClusterGroups
63+
- it: should handle empty managedClusterGroups
64+
set:
65+
global:
66+
repoURL: https://github.com/test/repo
67+
hubClusterDomain: "apps.hub.example.com"
68+
localClusterDomain: "apps.hub.example.com"
69+
secretStore:
70+
backend: "vault"
71+
pattern: "test-pattern"
72+
clusterGroup:
73+
isHubCluster: null # Explicitly unset to enable domain-based detection
74+
managedClusterGroups: {} # Empty
75+
asserts:
76+
- hasDocuments:
77+
count: 0 # Empty managed cluster groups means no policies
78+
79+
# Test explicit isHubCluster takes precedence over domain-based detection
80+
- it: should respect explicit isHubCluster even when domains match
81+
set:
82+
global:
83+
repoURL: https://github.com/test/migration
84+
hubClusterDomain: "apps.migration-hub.example.com"
85+
localClusterDomain: "apps.migration-hub.example.com"
86+
secretStore:
87+
backend: "vault"
88+
pattern: "migration-test"
89+
clusterGroup:
90+
# Explicit isHubCluster takes precedence over domain-based detection
91+
isHubCluster: false # Explicitly set to false, should be respected
92+
managedClusterGroups:
93+
migrationTarget:
94+
name: migration-target
95+
labels:
96+
- name: migration
97+
value: in-progress
98+
asserts:
99+
# Explicit isHubCluster: false is respected even though domains match
100+
- hasDocuments:
101+
count: 0
102+
103+
# Test multiple cluster groups with domain-based logic (no explicit isHubCluster)
104+
- it: should handle multiple cluster groups with domain-based hub detection
105+
set:
106+
global:
107+
repoURL: https://github.com/test/multi-cluster
108+
hubClusterDomain: "apps.prod-hub.company.com"
109+
localClusterDomain: "apps.prod-hub.company.com"
110+
secretStore:
111+
backend: "vault"
112+
pattern: "multi-cluster-test"
113+
clusterGroup:
114+
isHubCluster: null # Explicitly unset to enable domain-based detection
115+
managedClusterGroups:
116+
prodEast:
117+
name: prod-east
118+
labels:
119+
- name: environment
120+
value: production
121+
stagingWest:
122+
name: staging-west
123+
labels:
124+
- name: environment
125+
value: staging
126+
asserts:
127+
# Should have CA policies for 2 cluster groups (9 docs each)
128+
- hasDocuments:
129+
count: 18
130+
# Verify specific policies exist
131+
- documentSelector:
132+
path: metadata.name
133+
value: hub-argo-ca-prod-east-policy
134+
isKind:
135+
of: Policy
136+
- documentSelector:
137+
path: metadata.name
138+
value: hub-argo-ca-staging-west-policy
139+
isKind:
140+
of: Policy

‎tests/hub_cluster_detection_private_repo_test.yaml‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
suite: Test Hub Cluster Detection Logic - Private Repo Policies
2+
templates:
3+
- templates/policies/private-repo-policies.yaml
4+
release:
5+
name: release-test
6+
tests:
7+
# Test 1: Hub cluster when localClusterDomain equals hubClusterDomain (includes private hub policy)
8+
- it: should render private hub policy when localClusterDomain equals hubClusterDomain
9+
set:
10+
global:
11+
repoURL: https://github.com/validatedpatterns/multicloud-gitops
12+
hubClusterDomain: "apps.hub.example.com"
13+
localClusterDomain: "apps.hub.example.com"
14+
privateRepo: true
15+
pattern: "test-pattern"
16+
clusterGroup:
17+
isHubCluster: null # Explicitly unset to enable domain-based detection
18+
managedClusterGroups:
19+
testRegion:
20+
name: region-one
21+
labels:
22+
- name: clusterGroup
23+
value: region-one
24+
asserts:
25+
- documentSelector:
26+
path: metadata.name
27+
value: vp-private-hub-policy
28+
isKind:
29+
of: Policy
30+
- hasDocuments:
31+
count: 6
32+
33+
# Test 2: Not hub cluster when localClusterDomain differs from hubClusterDomain (no private hub policy)
34+
- it: should not render private hub policy when localClusterDomain differs from hubClusterDomain
35+
set:
36+
global:
37+
repoURL: https://github.com/validatedpatterns/multicloud-gitops
38+
hubClusterDomain: "apps.hub.example.com"
39+
localClusterDomain: "apps.spoke.example.com"
40+
privateRepo: true
41+
pattern: "test-pattern"
42+
clusterGroup:
43+
isHubCluster: null # Explicitly unset to enable domain-based detection
44+
managedClusterGroups:
45+
testRegion:
46+
name: region-one
47+
labels:
48+
- name: clusterGroup
49+
value: region-one
50+
asserts:
51+
# Should have the managed cluster policies but not the hub policy
52+
- documentSelector:
53+
path: metadata.name
54+
value: private-region-one-policy
55+
isKind:
56+
of: Policy
57+
- hasDocuments:
58+
count: 3
59+
60+
# Test 3: Fallback to isHubCluster when domains are not set (true)
61+
- it: should render private hub policy when fallback to isHubCluster true
62+
set:
63+
global:
64+
repoURL: https://github.com/validatedpatterns/multicloud-gitops
65+
# No domain configuration provided
66+
privateRepo: true
67+
pattern: "test-pattern"
68+
clusterGroup:
69+
isHubCluster: true
70+
managedClusterGroups:
71+
testRegion:
72+
name: region-one
73+
labels:
74+
- name: clusterGroup
75+
value: region-one
76+
asserts:
77+
- documentSelector:
78+
path: metadata.name
79+
value: vp-private-hub-policy
80+
isKind:
81+
of: Policy
82+
- hasDocuments:
83+
count: 6
84+
85+
# Test 4: Fallback to isHubCluster false when no domain configuration is provided
86+
- it: should not render private hub policy when fallback to isHubCluster false
87+
set:
88+
global:
89+
repoURL: https://github.com/validatedpatterns/multicloud-gitops
90+
# No domain configuration provided
91+
privateRepo: true
92+
pattern: "test-pattern"
93+
clusterGroup:
94+
isHubCluster: false
95+
managedClusterGroups:
96+
testRegion:
97+
name: region-one
98+
labels:
99+
- name: clusterGroup
100+
value: region-one
101+
asserts:
102+
# Should have the managed cluster policies but not the hub policy
103+
- documentSelector:
104+
path: metadata.name
105+
value: private-region-one-policy
106+
isKind:
107+
of: Policy
108+
- hasDocuments:
109+
count: 3
110+
111+
# Test 5: No policies when privateRepo is false
112+
- it: should not render any private repo policies when privateRepo is false
113+
set:
114+
global:
115+
repoURL: https://github.com/validatedpatterns/multicloud-gitops
116+
hubClusterDomain: "apps.hub.example.com"
117+
localClusterDomain: "apps.hub.example.com"
118+
privateRepo: false
119+
pattern: "test-pattern"
120+
clusterGroup:
121+
isHubCluster: true
122+
managedClusterGroups:
123+
testRegion:
124+
name: region-one
125+
labels:
126+
- name: clusterGroup
127+
value: region-one
128+
asserts:
129+
- hasDocuments:
130+
count: 0

0 commit comments

Comments
 (0)