Skip to content

Commit dc9c12c

Browse files
Rizwana777svghadi
Rizwana777
and
svghadi
authored
Add default resourceExclusions in ArgoCD Instance (#978)
* Add default resourceExclusions in ArgoCD Instance Signed-off-by: Rizwana777 <[email protected]> * Add unit/e2e tests for resourceExclusions Signed-off-by: Rizwana777 <[email protected]> --------- Signed-off-by: Rizwana777 <[email protected]> Co-authored-by: Siddhesh Ghadi <[email protected]>
1 parent cf9315f commit dc9c12c

File tree

6 files changed

+729
-4
lines changed

6 files changed

+729
-4
lines changed

‎bundle/manifests/gitops-operator.clusterserviceversion.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ metadata:
134134
}
135135
}
136136
},
137-
"resourceExclusions": "- apiGroups:\n - tekton.dev\n clusters:\n - '*'\n kinds:\n - TaskRun\n - PipelineRun \n",
137+
"resourceExclusions": "- apiGroups:\n - \"\"\n - discovery.k8s.io\n kinds:\n - Endpoints\n - EndpointSlice\n- apiGroups:\n - apiregistration.k8s.io\n kinds:\n - APIService\n- apiGroups:\n - coordination.k8s.io\n kinds:\n - Lease\n- apiGroups:\n - authentication.k8s.io\n - authorization.k8s.io\n kinds:\n - SelfSubjectReview\n - TokenReview\n - LocalSubjectAccessReview\n - SelfSubjectAccessReview\n - SelfSubjectRulesReview\n - SubjectAccessReview\n- apiGroups:\n - certificates.k8s.io\n kinds:\n - CertificateSigningRequest\n- apiGroups:\n - cert-manager.io\n kinds:\n - CertificateRequest\n- apiGroups:\n - cilium.io\n kinds:\n - CiliumIdentity\n - CiliumEndpoint\n - CiliumEndpointSlice\n- apiGroups:\n - kyverno.io\n - reports.kyverno.io\n - wgpolicyk8s.io\n kinds:\n - PolicyReport\n - ClusterPolicyReport\n - EphemeralReport\n - ClusterEphemeralReport\n - AdmissionReport\n - ClusterAdmissionReport\n - BackgroundScanReport\n - ClusterBackgroundScanReport\n - UpdateRequest\n- apiGroups:\n - tekton.dev\n clusters:\n - '*'\n kinds:\n - TaskRun\n - PipelineRun\n",
138138
"server": {
139139
"resources": {
140140
"limits": {
@@ -180,7 +180,7 @@ metadata:
180180
capabilities: Deep Insights
181181
console.openshift.io/plugins: '["gitops-plugin"]'
182182
containerImage: quay.io/redhat-developer/gitops-operator
183-
createdAt: "2025-08-21T01:20:45Z"
183+
createdAt: "2025-09-30T08:46:55Z"
184184
description: Enables teams to adopt GitOps principles for managing cluster configurations
185185
and application delivery across hybrid multi-cluster Kubernetes environments.
186186
features.operators.openshift.io/disconnected: "true"

‎config/samples/argoproj.io_v1alpha1_argocd.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,58 @@ spec:
5555
cpu: 250m
5656
memory: 128Mi
5757
resourceExclusions: |
58+
- apiGroups:
59+
- ""
60+
- discovery.k8s.io
61+
kinds:
62+
- Endpoints
63+
- EndpointSlice
64+
- apiGroups:
65+
- apiregistration.k8s.io
66+
kinds:
67+
- APIService
68+
- apiGroups:
69+
- coordination.k8s.io
70+
kinds:
71+
- Lease
72+
- apiGroups:
73+
- authentication.k8s.io
74+
- authorization.k8s.io
75+
kinds:
76+
- SelfSubjectReview
77+
- TokenReview
78+
- LocalSubjectAccessReview
79+
- SelfSubjectAccessReview
80+
- SelfSubjectRulesReview
81+
- SubjectAccessReview
82+
- apiGroups:
83+
- certificates.k8s.io
84+
kinds:
85+
- CertificateSigningRequest
86+
- apiGroups:
87+
- cert-manager.io
88+
kinds:
89+
- CertificateRequest
90+
- apiGroups:
91+
- cilium.io
92+
kinds:
93+
- CiliumIdentity
94+
- CiliumEndpoint
95+
- CiliumEndpointSlice
96+
- apiGroups:
97+
- kyverno.io
98+
- reports.kyverno.io
99+
- wgpolicyk8s.io
100+
kinds:
101+
- PolicyReport
102+
- ClusterPolicyReport
103+
- EphemeralReport
104+
- ClusterEphemeralReport
105+
- AdmissionReport
106+
- ClusterAdmissionReport
107+
- BackgroundScanReport
108+
- ClusterBackgroundScanReport
109+
- UpdateRequest
58110
- apiGroups:
59111
- tekton.dev
60112
clusters:

‎config/samples/argoproj.io_v1beta1_argocd.yaml‎

Lines changed: 53 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,13 +55,65 @@ spec:
5555
cpu: 250m
5656
memory: 128Mi
5757
resourceExclusions: |
58+
- apiGroups:
59+
- ""
60+
- discovery.k8s.io
61+
kinds:
62+
- Endpoints
63+
- EndpointSlice
64+
- apiGroups:
65+
- apiregistration.k8s.io
66+
kinds:
67+
- APIService
68+
- apiGroups:
69+
- coordination.k8s.io
70+
kinds:
71+
- Lease
72+
- apiGroups:
73+
- authentication.k8s.io
74+
- authorization.k8s.io
75+
kinds:
76+
- SelfSubjectReview
77+
- TokenReview
78+
- LocalSubjectAccessReview
79+
- SelfSubjectAccessReview
80+
- SelfSubjectRulesReview
81+
- SubjectAccessReview
82+
- apiGroups:
83+
- certificates.k8s.io
84+
kinds:
85+
- CertificateSigningRequest
86+
- apiGroups:
87+
- cert-manager.io
88+
kinds:
89+
- CertificateRequest
90+
- apiGroups:
91+
- cilium.io
92+
kinds:
93+
- CiliumIdentity
94+
- CiliumEndpoint
95+
- CiliumEndpointSlice
96+
- apiGroups:
97+
- kyverno.io
98+
- reports.kyverno.io
99+
- wgpolicyk8s.io
100+
kinds:
101+
- PolicyReport
102+
- ClusterPolicyReport
103+
- EphemeralReport
104+
- ClusterEphemeralReport
105+
- AdmissionReport
106+
- ClusterAdmissionReport
107+
- BackgroundScanReport
108+
- ClusterBackgroundScanReport
109+
- UpdateRequest
58110
- apiGroups:
59111
- tekton.dev
60112
clusters:
61113
- '*'
62114
kinds:
63115
- TaskRun
64-
- PipelineRun
116+
- PipelineRun
65117
controller:
66118
resources:
67119
limits:

‎controllers/argocd/argocd.go‎

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -179,9 +179,49 @@ func getDefaultRBAC() argoapp.ArgoCDRBACSpec {
179179
}
180180

181181
// NewCR returns an ArgoCD reference optimized for use in OpenShift
182-
// with Tekton
182+
// with comprehensive default resource exclusions
183183
func NewCR(name, ns string) (*argoapp.ArgoCD, error) {
184184
b, err := yaml.Marshal([]resource{
185+
{
186+
APIGroups: []string{"", "discovery.k8s.io"},
187+
Kinds: []string{"Endpoints", "EndpointSlice"},
188+
Clusters: []string{"*"},
189+
},
190+
{
191+
APIGroups: []string{"apiregistration.k8s.io"},
192+
Kinds: []string{"APIService"},
193+
Clusters: []string{"*"},
194+
},
195+
{
196+
APIGroups: []string{"coordination.k8s.io"},
197+
Kinds: []string{"Lease"},
198+
Clusters: []string{"*"},
199+
},
200+
{
201+
APIGroups: []string{"authentication.k8s.io", "authorization.k8s.io"},
202+
Kinds: []string{"SelfSubjectReview", "TokenReview", "LocalSubjectAccessReview", "SelfSubjectAccessReview", "SelfSubjectRulesReview", "SubjectAccessReview"},
203+
Clusters: []string{"*"},
204+
},
205+
{
206+
APIGroups: []string{"certificates.k8s.io"},
207+
Kinds: []string{"CertificateSigningRequest"},
208+
Clusters: []string{"*"},
209+
},
210+
{
211+
APIGroups: []string{"cert-manager.io"},
212+
Kinds: []string{"CertificateRequest"},
213+
Clusters: []string{"*"},
214+
},
215+
{
216+
APIGroups: []string{"cilium.io"},
217+
Kinds: []string{"CiliumIdentity", "CiliumEndpoint", "CiliumEndpointSlice"},
218+
Clusters: []string{"*"},
219+
},
220+
{
221+
APIGroups: []string{"kyverno.io", "reports.kyverno.io", "wgpolicyk8s.io"},
222+
Kinds: []string{"PolicyReport", "ClusterPolicyReport", "EphemeralReport", "ClusterEphemeralReport", "AdmissionReport", "ClusterAdmissionReport", "BackgroundScanReport", "ClusterBackgroundScanReport", "UpdateRequest"},
223+
Clusters: []string{"*"},
224+
},
185225
{
186226
APIGroups: []string{"tekton.dev"},
187227
Kinds: []string{"TaskRun", "PipelineRun"},

‎controllers/argocd/argocd_test.go‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ limitations under the License.
1717
package argocd
1818

1919
import (
20+
"strings"
2021
"testing"
2122

2223
argoapp "github.com/argoproj-labs/argocd-operator/api/v1beta1"
@@ -126,6 +127,66 @@ func TestArgoCD(t *testing.T) {
126127
},
127128
}
128129
assert.DeepEqual(t, testArgoCD.Spec.Server.Resources, testServerResources)
130+
131+
// Test ResourceExclusions field
132+
resourceExclusions := testArgoCD.Spec.ResourceExclusions
133+
assert.Assert(t, len(resourceExclusions) > 0)
134+
135+
// Verify that the YAML contains expected resource types
136+
expectedResources := []string{
137+
"Endpoints",
138+
"EndpointSlice",
139+
"APIService",
140+
"Lease",
141+
"SelfSubjectReview",
142+
"TokenReview",
143+
"LocalSubjectAccessReview",
144+
"SelfSubjectAccessReview",
145+
"SelfSubjectRulesReview",
146+
"SubjectAccessReview",
147+
"CertificateSigningRequest",
148+
"CertificateRequest",
149+
"CiliumIdentity",
150+
"CiliumEndpoint",
151+
"CiliumEndpointSlice",
152+
"PolicyReport",
153+
"ClusterPolicyReport",
154+
"EphemeralReport",
155+
"ClusterEphemeralReport",
156+
"AdmissionReport",
157+
"ClusterAdmissionReport",
158+
"BackgroundScanReport",
159+
"ClusterBackgroundScanReport",
160+
"UpdateRequest",
161+
"TaskRun",
162+
"PipelineRun",
163+
}
164+
165+
for _, expectedResource := range expectedResources {
166+
assert.Assert(t, strings.Contains(resourceExclusions, expectedResource),
167+
"ResourceExclusions should contain %s", expectedResource)
168+
}
169+
170+
// Verify that the YAML contains expected API groups
171+
expectedAPIGroups := []string{
172+
"discovery.k8s.io",
173+
"apiregistration.k8s.io",
174+
"coordination.k8s.io",
175+
"authentication.k8s.io",
176+
"authorization.k8s.io",
177+
"certificates.k8s.io",
178+
"cert-manager.io",
179+
"cilium.io",
180+
"kyverno.io",
181+
"reports.kyverno.io",
182+
"wgpolicyk8s.io",
183+
"tekton.dev",
184+
}
185+
186+
for _, expectedAPIGroup := range expectedAPIGroups {
187+
assert.Assert(t, strings.Contains(resourceExclusions, expectedAPIGroup),
188+
"ResourceExclusions should contain API group %s", expectedAPIGroup)
189+
}
129190
}
130191

131192
func TestDexConfiguration(t *testing.T) {

0 commit comments

Comments
 (0)