diff --git a/argocd-operator/controllers/argocd/deployment_test.go b/argocd-operator/controllers/argocd/deployment_test.go index 0433cacf4b2..7f166b32db0 100644 --- a/argocd-operator/controllers/argocd/deployment_test.go +++ b/argocd-operator/controllers/argocd/deployment_test.go @@ -2399,7 +2399,7 @@ func repoServerDefaultVolumes() []corev1.Volume { Name: "redis-initial-pass", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, {Key: "auth_username", Path: "auth_username"}, @@ -2506,7 +2506,7 @@ func serverDefaultVolumes() []corev1.Volume { Name: argoutil.RedisAuthVolumeName, VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, {Key: "auth_username", Path: "auth_username"}, diff --git a/argocd-operator/controllers/argocd/secret.go b/argocd-operator/controllers/argocd/secret.go index 05d40761407..4e0ed94a457 100644 --- a/argocd-operator/controllers/argocd/secret.go +++ b/argocd-operator/controllers/argocd/secret.go @@ -1143,7 +1143,13 @@ func (r *ReconcileArgoCD) getClusterSecrets(cr *argoproj.ArgoCD) (*corev1.Secret // reconcileRedisInitialPasswordSecret will ensure that the redis Secret is present for the cluster. func (r *ReconcileArgoCD) reconcileRedisInitialPasswordSecret(cr *argoproj.ArgoCD) error { - secret := argoutil.NewSecretWithSuffix(cr, "redis-initial-password") + // Fix for GITOPS-11058: + // 1. Create a new secret: argocd-redis to be compatible with argocd cli + // 2. Delete an old style secret: [id]-redis-initial-password in case it exists + + // Generate secret in new style: argocd-redis + secretName := "argocd-redis" + secret := argoutil.NewSecretWithName(cr, secretName) existed := true // Recreate if the secret or some of its keys are missing @@ -1166,7 +1172,7 @@ func (r *ReconcileArgoCD) reconcileRedisInitialPasswordSecret(cr *argoproj.ArgoC if existed { // Drop unsettable fields created by FetchObject - secret = argoutil.NewSecretWithSuffix(cr, "redis-initial-password") + secret = argoutil.NewSecretWithName(cr, secretName) } redisInitialPassword, err := generateRedisAdminPassword() @@ -1180,6 +1186,14 @@ func (r *ReconcileArgoCD) reconcileRedisInitialPasswordSecret(cr *argoproj.ArgoC return err } + // Generate secret in old style: [id]-redis-initial-password + oldSecretName := "redis-initial-password" + oldSecret := argoutil.NewSecretWithSuffix(cr, oldSecretName) + + // Silent deletion of old secret in case it exited before + argoutil.LogResourceDeletion(log, oldSecret) + _ = r.Delete(context.TODO(), oldSecret) + if existed { argoutil.LogResourceUpdate(log, secret) return r.Update(context.TODO(), secret) diff --git a/argocd-operator/controllers/argocd/secret_test.go b/argocd-operator/controllers/argocd/secret_test.go index 8d1e3724a5b..59233a8374c 100644 --- a/argocd-operator/controllers/argocd/secret_test.go +++ b/argocd-operator/controllers/argocd/secret_test.go @@ -134,6 +134,44 @@ func TestReconcileArgoCD_reconcileClusterCASecret(t *testing.T) { assert.True(t, apierrors.IsNotFound(err), "default-named CA secret must not be created when a custom name is set; got err: %v", err) }) + t.Run("deletes redis-initial-password secret and replaces it with argocd-redis", func(t *testing.T) { + argocd := &argoproj.ArgoCD{ + ObjectMeta: metav1.ObjectMeta{ + Name: "argocd", + Namespace: "argocd-operator", + }, + } + + oldRedisSecret := argoutil.NewSecretWithSuffix(argocd, "redis-initial-password") + oldRedisSecret.Data = map[string][]byte{common.ArgoCDKeyAdminPassword: []byte("something")} + tlsSecret := argoutil.NewSecretWithSuffix(argocd, "tls") + + resObjs := []client.Object{argocd} + subresObjs := []client.Object{argocd} + runtimeObjs := []runtime.Object{} + sch := makeTestReconcilerScheme(argoproj.AddToScheme, promoter.AddToScheme, apiregistrationv1.AddToScheme) + cl := makeTestReconcilerClient(sch, resObjs, subresObjs, runtimeObjs) + r := makeTestReconciler(cl, sch, testclient.NewSimpleClientset()) + + err := r.Create(context.TODO(), oldRedisSecret) + assert.NoError(t, err) + err = r.Create(context.TODO(), tlsSecret) + assert.NoError(t, err) + + err = r.reconcileRedisInitialPasswordSecret(argocd) + + assert.NoError(t, err) + + oldSecretErr := r.Get(context.TODO(), types.NamespacedName{Name: oldRedisSecret.Name, Namespace: "argocd-operator"}, oldRedisSecret) + assert.True(t, apierrors.IsNotFound(oldSecretErr)) + + newRedisSecret := argoutil.NewSecretWithName(argocd, "argocd-redis") + newRedisSecret.Data = map[string][]byte{common.ArgoCDKeyAdminPassword: []byte("something")} + + newSecretErr := r.Get(context.TODO(), types.NamespacedName{Name: newRedisSecret.Name, Namespace: "argocd-operator"}, newRedisSecret) + assert.NoError(t, newSecretErr) + }) + t.Run("skips creation when custom-named CA secret already exists", func(t *testing.T) { const customName = "my-custom-ca" a := makeTestArgoCD(func(a *argoproj.ArgoCD) { @@ -524,14 +562,13 @@ func Test_ReconcileArgoCD_ReconcileShouldNotChangeWhenUpdatedAdminPass(t *testin } func Test_ReconcileArgoCD_ReconcileRedisInitialPasswordSecret(t *testing.T) { - const suffix = "redis-initial-password" argocd := &argoproj.ArgoCD{ ObjectMeta: metav1.ObjectMeta{ Name: "argocd", Namespace: "argocd-operator", }, } - secretName := argoutil.NewSecretWithSuffix(argocd, suffix).Name + secretName := "argocd-redis" secretNN := types.NamespacedName{Name: secretName, Namespace: "argocd-operator"} resObjs := []client.Object{argocd} @@ -567,7 +604,7 @@ func Test_ReconcileArgoCD_ReconcileRedisInitialPasswordSecret(t *testing.T) { t.Run("Update keys and regenerate on operator upgrade", func(t *testing.T) { const oldPwd = "asdfghjkl" - secret := argoutil.NewSecretWithSuffix(argocd, suffix) + secret := argoutil.NewSecretWithName(argocd, "argocd-redis") secret.Data = map[string][]byte{ "immutable": []byte("true"), common.ArgoCDKeyAdminPassword: []byte(oldPwd), diff --git a/argocd-operator/controllers/argocd/statefulset_test.go b/argocd-operator/controllers/argocd/statefulset_test.go index 974f779a658..5cdab1ff587 100644 --- a/argocd-operator/controllers/argocd/statefulset_test.go +++ b/argocd-operator/controllers/argocd/statefulset_test.go @@ -95,7 +95,7 @@ func controllerDefaultVolumes() []corev1.Volume { Name: argoutil.RedisAuthVolumeName, VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, {Key: "auth_username", Path: "auth_username"}, diff --git a/argocd-operator/controllers/argocdagent/deployment_test.go b/argocd-operator/controllers/argocdagent/deployment_test.go index 7c3b56746cc..9d4d434bace 100644 --- a/argocd-operator/controllers/argocdagent/deployment_test.go +++ b/argocd-operator/controllers/argocdagent/deployment_test.go @@ -442,7 +442,7 @@ func TestReconcilePrincipalDeployment_VerifyDeploymentSpec(t *testing.T) { redisAuthVolume := deployment.Spec.Template.Spec.Volumes[2] assert.Equal(t, "redis-initial-pass", redisAuthVolume.Name) assert.NotNil(t, redisAuthVolume.Secret) - assert.Equal(t, "argocd-redis-initial-password", redisAuthVolume.Secret.SecretName) + assert.Equal(t, "argocd-redis", redisAuthVolume.Secret.SecretName) assert.NotEqual(t, new(true), redisAuthVolume.Secret.Optional) assert.Len(t, redisAuthVolume.Secret.Items, 2) } diff --git a/argocd-operator/controllers/argoutil/redis.go b/argocd-operator/controllers/argoutil/redis.go index e1fbdfade74..4a4ce8aec2d 100644 --- a/argocd-operator/controllers/argoutil/redis.go +++ b/argocd-operator/controllers/argoutil/redis.go @@ -26,7 +26,7 @@ func MountRedisAuthToRedis(cr *argoproj.ArgoCD) (volume corev1.Volume, mount cor Name: RedisAuthVolumeName, VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: GetSecretNameWithSuffix(cr, "redis-initial-password"), + SecretName: "argocd-redis", }, }, } diff --git a/argocd-operator/tests/ginkgo/parallel/1-019_validate_volume_mounts_test.go b/argocd-operator/tests/ginkgo/parallel/1-019_validate_volume_mounts_test.go index c3880e69b49..6d1b74bf6f4 100644 --- a/argocd-operator/tests/ginkgo/parallel/1-019_validate_volume_mounts_test.go +++ b/argocd-operator/tests/ginkgo/parallel/1-019_validate_volume_mounts_test.go @@ -135,7 +135,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { Name: "redis-initial-pass", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", DefaultMode: new(int32(420)), Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, @@ -222,7 +222,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { Name: "redis-initial-pass", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", DefaultMode: new(int32(420)), Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, @@ -297,7 +297,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { Name: "redis-initial-pass", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", DefaultMode: new(int32(420)), Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, diff --git a/argocd-operator/tests/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go b/argocd-operator/tests/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go index 5fa818756a9..412b031c7cc 100644 --- a/argocd-operator/tests/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go +++ b/argocd-operator/tests/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go @@ -221,7 +221,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { By("verifying redis password is correct") redisInitialSecret := &corev1.Secret{} redisPwdSecretKey := client.ObjectKey{ - Name: argoutil.GetSecretNameWithSuffix(argoCD, "redis-initial-password"), + Name: "argocd-redis", Namespace: ns.Name, } Expect(k8sClient.Get(ctx, redisPwdSecretKey, redisInitialSecret)).Should(Succeed()) diff --git a/argocd-operator/tests/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go b/argocd-operator/tests/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go index 67f98da0af2..0efcba4f89e 100644 --- a/argocd-operator/tests/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go +++ b/argocd-operator/tests/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go @@ -161,7 +161,7 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { PrincipalTLSSecretName: agentPrincipalTLSSecretName, RootCASecretName: agentRootCASecretName, ResourceProxyTLSSecretName: agentResourceProxyTLSSecretName, - RedisInitialPasswordSecretName: "example-redis-initial-password", + RedisInitialPasswordSecretName: "argocd-redis", } resourceProxyServiceName = fmt.Sprintf("%s-agent-principal-resource-proxy", argoCDName) diff --git a/argocd-operator/tests/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go b/argocd-operator/tests/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go index ba2f9d0b263..2213d3fe52c 100644 --- a/argocd-operator/tests/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go +++ b/argocd-operator/tests/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go @@ -149,7 +149,7 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { secretNames = []string{ agentClientTLSSecretName, agentRootCASecretName, - "example-redis-initial-password", + "argocd-redis", } serviceNames = []string{ diff --git a/argocd-operator/tests/ginkgo/sequential/1-067_validate_redis_secure_comm_no_autotls_ha_test.go b/argocd-operator/tests/ginkgo/sequential/1-067_validate_redis_secure_comm_no_autotls_ha_test.go index c3659c6b308..6823d6f8821 100644 --- a/argocd-operator/tests/ginkgo/sequential/1-067_validate_redis_secure_comm_no_autotls_ha_test.go +++ b/argocd-operator/tests/ginkgo/sequential/1-067_validate_redis_secure_comm_no_autotls_ha_test.go @@ -269,7 +269,7 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { By("verifying redis password is correct") redisInitialSecret := &corev1.Secret{} redisPwdSecretKey := client.ObjectKey{ - Name: argoutil.GetSecretNameWithSuffix(argoCD, "redis-initial-password"), + Name: "argocd-redis", Namespace: ns.Name, } Expect(k8sClient.Get(ctx, redisPwdSecretKey, redisInitialSecret)).Should(Succeed()) diff --git a/test/openshift/e2e/ginkgo/parallel/1-019_validate_volume_mounts_test.go b/test/openshift/e2e/ginkgo/parallel/1-019_validate_volume_mounts_test.go index 6a1a02171e7..93cc3b9e281 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-019_validate_volume_mounts_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-019_validate_volume_mounts_test.go @@ -134,7 +134,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { Name: "redis-initial-pass", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", DefaultMode: new(int32(420)), Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, @@ -221,7 +221,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { Name: "redis-initial-pass", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", DefaultMode: new(int32(420)), Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, @@ -296,7 +296,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { Name: "redis-initial-pass", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-redis-initial-password", + SecretName: "argocd-redis", DefaultMode: new(int32(420)), Items: []corev1.KeyToPath{ {Key: "auth", Path: "auth"}, diff --git a/test/openshift/e2e/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go b/test/openshift/e2e/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go index f64fc106849..e2687d95565 100644 --- a/test/openshift/e2e/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go +++ b/test/openshift/e2e/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go @@ -224,7 +224,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() { By("verifying redis password is correct") redisInitialSecret := &corev1.Secret{} redisPwdSecretKey := client.ObjectKey{ - Name: argoutil.GetSecretNameWithSuffix(argoCD, "redis-initial-password"), + Name: "argocd-redis", Namespace: ns.Name, } Expect(k8sClient.Get(ctx, redisPwdSecretKey, redisInitialSecret)).Should(Succeed()) diff --git a/test/openshift/e2e/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go b/test/openshift/e2e/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go index 06d97ad68e7..26efffce6e1 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go @@ -160,7 +160,7 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { PrincipalTLSSecretName: agentPrincipalTLSSecretName, RootCASecretName: agentRootCASecretName, ResourceProxyTLSSecretName: agentResourceProxyTLSSecretName, - RedisInitialPasswordSecretName: "example-redis-initial-password", + RedisInitialPasswordSecretName: "argocd-redis", } resourceProxyServiceName = fmt.Sprintf("%s-agent-principal-resource-proxy", argoCDName) diff --git a/test/openshift/e2e/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go b/test/openshift/e2e/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go index fa1a7245f49..9f01f76562e 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-052_validate_argocd_agent_agent_test.go @@ -150,7 +150,7 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { secretNames = []string{ agentClientTLSSecretName, agentRootCASecretName, - "example-redis-initial-password", + "argocd-redis", } serviceNames = []string{ diff --git a/test/openshift/e2e/ginkgo/sequential/1-067_validate_redis_secure_comm_no_autotls_ha_test.go b/test/openshift/e2e/ginkgo/sequential/1-067_validate_redis_secure_comm_no_autotls_ha_test.go index f8b461bd342..ec686fd78ea 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-067_validate_redis_secure_comm_no_autotls_ha_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-067_validate_redis_secure_comm_no_autotls_ha_test.go @@ -310,7 +310,7 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { By("verifying redis password is correct") redisInitialSecret := &corev1.Secret{} redisPwdSecretKey := client.ObjectKey{ - Name: argoutil.GetSecretNameWithSuffix(argoCD, "redis-initial-password"), + Name: "argocd-redis", Namespace: ns.Name, } Expect(k8sClient.Get(ctx, redisPwdSecretKey, redisInitialSecret)).Should(Succeed())