From 02ffc00829a65191f55ea234ff6a0eb3aa1b4e7d Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Tue, 11 Aug 2026 12:34:02 +0530 Subject: [PATCH 1/9] E2E test for TLS Parameters Signed-off-by: akhil nittala --- ...resource_constraints_gitopsservice_test.go | 31 +++ ...ent_Env_Args_For_Tls_Configuration_test.go | 259 ++++++++++++++++++ 2 files changed, 290 insertions(+) create mode 100644 test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go diff --git a/test/openshift/e2e/ginkgo/sequential/1-121-valiate_resource_constraints_gitopsservice_test.go b/test/openshift/e2e/ginkgo/sequential/1-121-valiate_resource_constraints_gitopsservice_test.go index 6abcfaeca94..52f622f520a 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-121-valiate_resource_constraints_gitopsservice_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-121-valiate_resource_constraints_gitopsservice_test.go @@ -2,6 +2,7 @@ package sequential import ( "context" + "fmt" "strings" . "github.com/onsi/ginkgo/v2" @@ -152,6 +153,36 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { } verifyResourceConstraints(k8sClient, "gitops-plugin", expectedReq, expectedLim) verifyResourceConstraints(k8sClient, "cluster", expectedReq, expectedLim) + //below code needs to be verified only on and above 4.22 cluster, because apiserver CR will not having tls parameters below 4.22 OCP version + var major, minor int + _, err := fmt.Sscanf(ocVersion, "%d.%d", &major, &minor) + Expect(err).NotTo(HaveOccurred()) + + if major > 4 || (major == 4 && minor >= 22) { + depl = &appsv1.Deployment{ + ObjectMeta: metav1.ObjectMeta{ + Name: "cluster", + Namespace: "openshift-gitops", + }, + } + + Expect(depl).To(k8sFixture.ExistByName()) + Expect(depl.Spec.Template.Spec.Containers).NotTo(BeEmpty()) + + container := depl.Spec.Template.Spec.Containers[0] + env := container.Env + + Expect(env).To(ContainElement(corev1.EnvVar{ + Name: "TLS_MIN_VERSION", + Value: "1.2", + })) + + Expect(env).To(ContainElement(corev1.EnvVar{ + Name: "TLS_CIPHER_SUITES", + Value: "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305", + })) + } + }) It("validates that GitOpsService can update resource constraints", Label("openshift"), func() { diff --git a/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go b/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go new file mode 100644 index 00000000000..b2c2fcf551c --- /dev/null +++ b/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go @@ -0,0 +1,259 @@ +/* +Copyright 2025. + +Licensed under the Apache License, Version 2.0 (the "License"); +*/ + +package sequential + +import ( + "context" + "fmt" + "os" + "time" + + appsv1 "k8s.io/api/apps/v1" + corev1 "k8s.io/api/core/v1" + + argov1beta1api "github.com/argoproj-labs/argocd-operator/api/v1beta1" + + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/types" + + "sigs.k8s.io/controller-runtime/pkg/client" + + . "github.com/onsi/ginkgo/v2" + . "github.com/onsi/gomega" + + "github.com/argoproj-labs/argocd-operator/tests/ginkgo/fixture" + osFixture "github.com/argoproj-labs/argocd-operator/tests/ginkgo/fixture/os" + "github.com/argoproj-labs/argocd-operator/tests/ginkgo/fixture/utils" +) + +var _ = Describe("Validate Deployment Env Args For TLS Configuration", func() { + const ( + argocdNamespace = "test-tls-argocd" + argocdInstanceName = "example-argocd" + ) + var ( + c client.Client + ctx context.Context + ) + BeforeEach(func() { + fixture.EnsureSequentialCleanSlate() + c, _ = utils.GetE2ETestKubeClient() + ctx = context.Background() + }) + BeforeEach(func() { + if fixture.EnvLocalRun() { + Skip("This test is known not to work when running gitops operator locally") + } + }) + // --- Helper: Extract TLS values from args --- + getTLSValues := func(args []string) (min string, hasMin bool, hasCiphers bool, ciphers string) { + for i := 0; i < len(args); i++ { + arg := args[i] + // handle --tlsminversion + if arg == "--tlsminversion" { + hasMin = true + if i+1 < len(args) { + min = args[i+1] + } + } + if arg == "--tlsciphers" { + hasCiphers = true + if i+1 < len(args) { + ciphers = args[i+1] + } + } + // handle --tlsminversion=value + if len(arg) > len("--tlsminversion=") && arg[:len("--tlsminversion=")] == "--tlsminversion=" { + hasMin = true + min = arg[len("--tlsminversion="):] + } + if len(arg) > len("--tlsciphers=") && arg[:len("--tlsciphers=")] == "--tlsciphers=" { + hasCiphers = true + ciphers = arg[len("--tlsciphers="):] + } + } + return + } + + Context("When the ArgoCD instance is created with default TLS settings", func() { + It("should validate default TLS values and updates on RepoServer, Server and Redis Deployments", func() { + ocVersion := getOCPVersion() + Expect(ocVersion).ToNot(BeEmpty()) + + var major, minor int + _, err := fmt.Sscanf(ocVersion, "%d.%d", &major, &minor) + Expect(err).NotTo(HaveOccurred()) + + if major < 4 || (major == 4 && minor < 22) { + Skip(fmt.Sprintf("skipping this test as OCP version is %s, requires OCP >= 4.22", ocVersion)) + return + } + By("creating namespace") + ns := &corev1.Namespace{ + ObjectMeta: metav1.ObjectMeta{ + Name: argocdNamespace, + }, + } + Expect(c.Create(ctx, ns)).To(Succeed()) + + By("generating a test certificate to use with redis, using openssl") + redis_crt_File, err := os.CreateTemp("", "redis.crt") + Expect(err).ToNot(HaveOccurred()) + + redis_key_File, err := os.CreateTemp("", "redis.key") + Expect(err).ToNot(HaveOccurred()) + + openssl_test_File, err := os.CreateTemp("", "openssl_test.cnf") + Expect(err).ToNot(HaveOccurred()) + + opensslTestCNFContents := "\n[SAN]\nsubjectAltName=DNS:argocd-redis." + argocdNamespace + ".svc.cluster.local\n[req]\ndistinguished_name=req" + + err = os.WriteFile(openssl_test_File.Name(), ([]byte)(opensslTestCNFContents), 0666) + Expect(err).ToNot(HaveOccurred()) + + _, err = osFixture.ExecCommandWithOutputParam(false, true, "openssl", "req", "-new", "-x509", "-sha256", + "-subj", "/C=XX/ST=XX/O=Testing/CN=redis", + "-reqexts", "SAN", + "-extensions", "SAN", + "-config", openssl_test_File.Name(), + "-keyout", redis_key_File.Name(), + "-out", redis_crt_File.Name(), + "-newkey", "rsa:4096", + "-nodes", + "-days", "10", + ) + Expect(err).ToNot(HaveOccurred()) + + By("creating argocd-operator-redis-tls secret from that cert") + _, err = osFixture.ExecCommand("kubectl", "create", "secret", "tls", "argocd-operator-redis-tls", "--key="+redis_key_File.Name(), "--cert="+redis_crt_File.Name(), "-n", argocdNamespace) + Expect(err).ToNot(HaveOccurred()) + + By("adding argo cd label to argocd-operator-redis-tls secret") + _, err = osFixture.ExecCommand("kubectl", "annotate", "secret", "argocd-operator-redis-tls", "argocds.argoproj.io/name=argocd", "-n", argocdNamespace) + Expect(err).ToNot(HaveOccurred()) + + By("creating ArgoCD instance") + argo := &argov1beta1api.ArgoCD{ + ObjectMeta: metav1.ObjectMeta{ + Name: argocdInstanceName, + Namespace: argocdNamespace, + }, + Spec: argov1beta1api.ArgoCDSpec{}, + } + argo.Spec.ImageUpdater.Enabled = true + Expect(c.Create(ctx, argo)).To(Succeed()) + By("waiting for ArgoCD to be available") + Eventually(func() error { + return c.Get(ctx, types.NamespacedName{Name: argocdInstanceName, Namespace: argocdNamespace}, &argov1beta1api.ArgoCD{}) + }, 2*time.Minute, 5*time.Second).Should(Succeed()) + defer func() { + By("cleaning up resources") + _ = c.Delete(ctx, argo) + _ = c.Delete(ctx, ns) + os.Remove(redis_crt_File.Name()) + os.Remove(redis_key_File.Name()) + os.Remove(openssl_test_File.Name()) + }() + coreDeployments := []string{ + "example-argocd-server", + "example-argocd-repo-server", + "example-argocd-argocd-image-updater-controller", + } + time.Sleep(5 * time.Second) + // --- Validate updated TLS values --- + By("validating updated TLS args For RepoServer and Server") + Eventually(func() bool { + for _, deploymentName := range coreDeployments { + deployment := &appsv1.Deployment{} + if err := c.Get(ctx, types.NamespacedName{Name: deploymentName, Namespace: argocdNamespace}, deployment); err != nil { + return false + } + valid := false + for _, container := range deployment.Spec.Template.Spec.Containers { + min, hasMin, hasCiphers, ciphers := getTLSValues(container.Args) + if !hasMin { + continue + } + if min != "1.2" { + GinkgoWriter.Printf("%s: expected tlsminversion=1.2, got %s\n", deploymentName, min) + return false + } + if !hasCiphers || ciphers == "" { + GinkgoWriter.Printf("%s: expected --tlsciphers to be present and non-empty, got %q\n", deploymentName, ciphers) + return false + } + GinkgoWriter.Printf("%s updated TLS OK: min=%s\n", deploymentName, min) + valid = true + } + if !valid { + return false + } + } + return true + }, 60*time.Second, 2*time.Second).Should(BeTrue(), "all deployments should have updated TLS configuration") + By("Validating Updated TLS args in Redis deployment") + Eventually(func() bool { + deployment := &appsv1.Deployment{} + if err := c.Get(ctx, types.NamespacedName{Name: "example-argocd-redis", Namespace: argocdNamespace}, deployment); err != nil { + return false + } + if len(deployment.Spec.Template.Spec.Containers) == 0 { + return false + } + args := deployment.Spec.Template.Spec.Containers[0].Args + var tlsProtocols string + var tlsCiphersTLS12 string + var tlsCiphersTLS13 string + hasProtocols := false + hasCiphersTLS12 := false + hasCiphersTLS13 := false + for i := 0; i < len(args); i++ { + arg := args[i] + // --- Handle "--tls-protocols " + if arg == "--tls-protocols" { + hasProtocols = true + if i+1 < len(args) { + tlsProtocols = args[i+1] + } + } + if arg == "--tls-ciphersuites" { + hasCiphersTLS13 = true + if i+1 < len(args) { + tlsCiphersTLS13 = args[i+1] + } + } + + if arg == "--tls-ciphers" { + hasCiphersTLS12 = true + if i+1 < len(args) { + tlsCiphersTLS12 = args[i+1] + } + } + } + + // --- Print results (always helpful in debugging) + if !hasCiphersTLS13 || tlsCiphersTLS13 == "" { + GinkgoWriter.Printf(" --tls-ciphersuites should not be empty, got %q\n", tlsCiphersTLS13) + return false + } + if !hasCiphersTLS12 || tlsCiphersTLS12 == "" { + GinkgoWriter.Printf(" --tls-ciphers should not be empty, got %q\n", tlsCiphersTLS12) + return false + } + + if !hasProtocols || tlsProtocols != "TLSv1.2" { + GinkgoWriter.Printf("%s: expected --tls-protocols=TLSv1.2, got %s\n", deployment.Name, tlsProtocols) + return false + } + GinkgoWriter.Printf("%s TLS args protocol value: %s\n", deployment.Name, tlsProtocols) + GinkgoWriter.Printf("%s TLS args ciphersuites value: %s\n", deployment.Name, tlsCiphersTLS13) + GinkgoWriter.Printf("%s TLS args ciphers value: %s\n", deployment.Name, tlsCiphersTLS12) + return true + }, 60*time.Second, 2*time.Second).Should(BeTrue()) + }) + }) +}) From 18b696478ce27c794d1216fbc385f72074e2d3a5 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Fri, 14 Aug 2026 15:42:55 +0530 Subject: [PATCH 2/9] E2E test for TLS Parameters Signed-off-by: akhil nittala --- bundle/manifests/gitops-operator.clusterserviceversion.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bundle/manifests/gitops-operator.clusterserviceversion.yaml b/bundle/manifests/gitops-operator.clusterserviceversion.yaml index e23fba14211..e1af390e286 100644 --- a/bundle/manifests/gitops-operator.clusterserviceversion.yaml +++ b/bundle/manifests/gitops-operator.clusterserviceversion.yaml @@ -190,7 +190,7 @@ metadata: capabilities: Deep Insights console.openshift.io/plugins: '["gitops-plugin"]' containerImage: quay.io/redhat-developer/gitops-operator - createdAt: "2026-08-13T17:59:24Z" + createdAt: "2026-08-14T10:12:23Z" description: Enables teams to adopt GitOps principles for managing cluster configurations and application delivery across hybrid multi-cluster Kubernetes environments. features.operators.openshift.io/disconnected: "true" From baca4a9380138f7269ffe1c9274b082fe38a5cd9 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Tue, 25 Aug 2026 11:11:10 +0530 Subject: [PATCH 3/9] changes Signed-off-by: akhil nittala --- test/openshift/e2e/ginkgo/fixture/fixture.go | 52 +++++++++++++++ ...resource_constraints_gitopsservice_test.go | 66 +++++++------------ 2 files changed, 74 insertions(+), 44 deletions(-) diff --git a/test/openshift/e2e/ginkgo/fixture/fixture.go b/test/openshift/e2e/ginkgo/fixture/fixture.go index 8b3f8c85447..27c28ce865f 100644 --- a/test/openshift/e2e/ginkgo/fixture/fixture.go +++ b/test/openshift/e2e/ginkgo/fixture/fixture.go @@ -4,6 +4,7 @@ import ( "context" "fmt" "os" + "strconv" "strings" "sync" "time" @@ -1106,3 +1107,54 @@ func outputAppControllerAndRepoLogsInNamespace(namespace string) { func IsUpstreamOperatorTests() bool { return false // This function should return true if running from argocd-operator repo, false if running from gitops-operator repo. This is to distinguish between tests in upstream argocd-operator and downstream gitops-operator repos. } + +type OCPVersion struct { + Major int + Minor int +} + +var OCP4_22 = OCPVersion{ + Major: 4, + Minor: 22, +} + +func Parse(version string) (OCPVersion, error) { + version = strings.TrimSpace(version) + + parts := strings.Split(version, ".") + if len(parts) < 2 { + return OCPVersion{}, fmt.Errorf("invalid OCP version %q", version) + } + + major, err := strconv.Atoi(parts[0]) + if err != nil { + return OCPVersion{}, fmt.Errorf("invalid OCP major version %q: %w", version, err) + } + + minor, err := strconv.Atoi(parts[1]) + if err != nil { + return OCPVersion{}, fmt.Errorf("invalid OCP minor version %q: %w", version, err) + } + + return OCPVersion{ + Major: major, + Minor: minor, + }, nil +} + +func SkipIfMinOCPVersion(currentVersion string, minimumVersion OCPVersion) { + current, err := Parse(currentVersion) + Expect(err).NotTo(HaveOccurred()) + + if current.Major > minimumVersion.Major || + (current.Major == minimumVersion.Major && current.Minor >= minimumVersion.Minor) { + return + } + + Skip(fmt.Sprintf( + "skipping test: OCP version %s is below minimum required version %d.%d", + currentVersion, + minimumVersion.Major, + minimumVersion.Minor, + )) +} diff --git a/test/openshift/e2e/ginkgo/sequential/1-121-valiate_resource_constraints_gitopsservice_test.go b/test/openshift/e2e/ginkgo/sequential/1-121-valiate_resource_constraints_gitopsservice_test.go index 52f622f520a..882301338fc 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-121-valiate_resource_constraints_gitopsservice_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-121-valiate_resource_constraints_gitopsservice_test.go @@ -2,7 +2,6 @@ package sequential import ( "context" - "fmt" "strings" . "github.com/onsi/ginkgo/v2" @@ -67,11 +66,15 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { var ( ctx context.Context k8sClient client.Client + ocVersion string ) BeforeEach(func() { fixture.EnsureSequentialCleanSlate() k8sClient, _ = utils.GetE2ETestKubeClient() ctx = context.Background() + ocVersion = getOCPVersion() + Expect(ocVersion).ToNot(BeEmpty()) + fixture.SkipIfMinOCPVersion(ocVersion, fixture.OCP4_22) }) It("validates that GitOpsService can take in custom resource constraints", Label("openshift"), func() { @@ -79,12 +82,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { Expect(csv).ToNot(BeNil()) defer func() { Expect(fixture.RemoveDynamicPluginFromCSV(ctx, k8sClient)).To(Succeed()) }() - ocVersion := getOCPVersion() - Expect(ocVersion).ToNot(BeEmpty()) - if strings.Contains(ocVersion, "4.15.") { - Skip("skipping this test as OCP version is 4.15") - return - } addDynamicPluginEnv(csv, ocVersion) depl := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: "gitops-plugin", Namespace: "openshift-gitops"}} @@ -153,36 +150,29 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { } verifyResourceConstraints(k8sClient, "gitops-plugin", expectedReq, expectedLim) verifyResourceConstraints(k8sClient, "cluster", expectedReq, expectedLim) - //below code needs to be verified only on and above 4.22 cluster, because apiserver CR will not having tls parameters below 4.22 OCP version - var major, minor int - _, err := fmt.Sscanf(ocVersion, "%d.%d", &major, &minor) - Expect(err).NotTo(HaveOccurred()) - - if major > 4 || (major == 4 && minor >= 22) { - depl = &appsv1.Deployment{ - ObjectMeta: metav1.ObjectMeta{ - Name: "cluster", - Namespace: "openshift-gitops", - }, - } - Expect(depl).To(k8sFixture.ExistByName()) - Expect(depl.Spec.Template.Spec.Containers).NotTo(BeEmpty()) + depl = &appsv1.Deployment{ + ObjectMeta: metav1.ObjectMeta{ + Name: "cluster", + Namespace: "openshift-gitops", + }, + } - container := depl.Spec.Template.Spec.Containers[0] - env := container.Env + Expect(depl).To(k8sFixture.ExistByName()) + Expect(depl.Spec.Template.Spec.Containers).NotTo(BeEmpty()) - Expect(env).To(ContainElement(corev1.EnvVar{ - Name: "TLS_MIN_VERSION", - Value: "1.2", - })) + container := depl.Spec.Template.Spec.Containers[0] + env := container.Env - Expect(env).To(ContainElement(corev1.EnvVar{ - Name: "TLS_CIPHER_SUITES", - Value: "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305", - })) - } + Expect(env).To(ContainElement(corev1.EnvVar{ + Name: "TLS_MIN_VERSION", + Value: "1.2", + })) + Expect(env).To(ContainElement(corev1.EnvVar{ + Name: "TLS_CIPHER_SUITES", + Value: "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305", + })) }) It("validates that GitOpsService can update resource constraints", Label("openshift"), func() { @@ -190,12 +180,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { Expect(csv).ToNot(BeNil()) defer func() { Expect(fixture.RemoveDynamicPluginFromCSV(ctx, k8sClient)).To(Succeed()) }() - ocVersion := getOCPVersion() - Expect(ocVersion).ToNot(BeEmpty()) - if strings.Contains(ocVersion, "4.15.") { - Skip("skipping this test as OCP version is 4.15") - return - } addDynamicPluginEnv(csv, ocVersion) depl := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: "gitops-plugin", Namespace: "openshift-gitops"}} @@ -261,12 +245,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { Expect(csv).ToNot(BeNil()) defer func() { Expect(fixture.RemoveDynamicPluginFromCSV(ctx, k8sClient)).To(Succeed()) }() - ocVersion := getOCPVersion() - Expect(ocVersion).ToNot(BeEmpty()) - if strings.Contains(ocVersion, "4.15.") { - Skip("skipping this test as OCP version is 4.15") - return - } addDynamicPluginEnv(csv, ocVersion) depl := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: "gitops-plugin", Namespace: "openshift-gitops"}} From 7e29d5a0ad5640dec3453f0002eaf7b44061e1d9 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Tue, 25 Aug 2026 11:52:33 +0530 Subject: [PATCH 4/9] changes Signed-off-by: akhil nittala --- ...resource_constraints_gitopsservice_test.go | 22 +++++++++++++--- ...ent_Env_Args_For_Tls_Configuration_test.go | 25 +++++++++++++++++++ 2 files changed, 43 insertions(+), 4 deletions(-) diff --git a/test/openshift/e2e/ginkgo/sequential/1-121-valiate_resource_constraints_gitopsservice_test.go b/test/openshift/e2e/ginkgo/sequential/1-121-valiate_resource_constraints_gitopsservice_test.go index 882301338fc..4317a3d6138 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-121-valiate_resource_constraints_gitopsservice_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-121-valiate_resource_constraints_gitopsservice_test.go @@ -66,15 +66,11 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { var ( ctx context.Context k8sClient client.Client - ocVersion string ) BeforeEach(func() { fixture.EnsureSequentialCleanSlate() k8sClient, _ = utils.GetE2ETestKubeClient() ctx = context.Background() - ocVersion = getOCPVersion() - Expect(ocVersion).ToNot(BeEmpty()) - fixture.SkipIfMinOCPVersion(ocVersion, fixture.OCP4_22) }) It("validates that GitOpsService can take in custom resource constraints", Label("openshift"), func() { @@ -82,6 +78,12 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { Expect(csv).ToNot(BeNil()) defer func() { Expect(fixture.RemoveDynamicPluginFromCSV(ctx, k8sClient)).To(Succeed()) }() + ocVersion := getOCPVersion() + Expect(ocVersion).ToNot(BeEmpty()) + if strings.Contains(ocVersion, "4.15.") { + Skip("skipping this test as OCP version is 4.15") + return + } addDynamicPluginEnv(csv, ocVersion) depl := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: "gitops-plugin", Namespace: "openshift-gitops"}} @@ -180,6 +182,12 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { Expect(csv).ToNot(BeNil()) defer func() { Expect(fixture.RemoveDynamicPluginFromCSV(ctx, k8sClient)).To(Succeed()) }() + ocVersion := getOCPVersion() + Expect(ocVersion).ToNot(BeEmpty()) + if strings.Contains(ocVersion, "4.15.") { + Skip("skipping this test as OCP version is 4.15") + return + } addDynamicPluginEnv(csv, ocVersion) depl := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: "gitops-plugin", Namespace: "openshift-gitops"}} @@ -245,6 +253,12 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { Expect(csv).ToNot(BeNil()) defer func() { Expect(fixture.RemoveDynamicPluginFromCSV(ctx, k8sClient)).To(Succeed()) }() + ocVersion := getOCPVersion() + Expect(ocVersion).ToNot(BeEmpty()) + if strings.Contains(ocVersion, "4.15.") { + Skip("skipping this test as OCP version is 4.15") + return + } addDynamicPluginEnv(csv, ocVersion) depl := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: "gitops-plugin", Namespace: "openshift-gitops"}} diff --git a/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go b/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go index b2c2fcf551c..54bb2088eaa 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go @@ -254,6 +254,31 @@ var _ = Describe("Validate Deployment Env Args For TLS Configuration", func() { GinkgoWriter.Printf("%s TLS args ciphers value: %s\n", deployment.Name, tlsCiphersTLS12) return true }, 60*time.Second, 2*time.Second).Should(BeTrue()) + By("Validating TLS environment variables in cluster deployment") + Eventually(func() error { + depl := &appsv1.Deployment{} + if err := c.Get(ctx, types.NamespacedName{ + Name: "cluster", + Namespace: "openshift-gitops", + }, depl); err != nil { + return err + } + Expect(depl.Spec.Template.Spec.Containers).NotTo(BeEmpty()) + env := depl.Spec.Template.Spec.Containers[0].Env + Expect(env).To(ContainElement(corev1.EnvVar{ + Name: "TLS_MIN_VERSION", + Value: "1.2", + })) + Expect(env).To(ContainElement(corev1.EnvVar{ + Name: "TLS_CIPHER_SUITES", + Value: "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:" + + "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:" + + "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:" + + "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305", + })) + + return nil + }, 60*time.Second, 2*time.Second).Should(Succeed()) }) }) }) From ca84fa6e19cc8179bfcb583386ddb72489008e5f Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Tue, 25 Aug 2026 11:54:05 +0530 Subject: [PATCH 5/9] changes Signed-off-by: akhil nittala --- ...resource_constraints_gitopsservice_test.go | 23 ------------------- 1 file changed, 23 deletions(-) diff --git a/test/openshift/e2e/ginkgo/sequential/1-121-valiate_resource_constraints_gitopsservice_test.go b/test/openshift/e2e/ginkgo/sequential/1-121-valiate_resource_constraints_gitopsservice_test.go index 4317a3d6138..6abcfaeca94 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-121-valiate_resource_constraints_gitopsservice_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-121-valiate_resource_constraints_gitopsservice_test.go @@ -152,29 +152,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() { } verifyResourceConstraints(k8sClient, "gitops-plugin", expectedReq, expectedLim) verifyResourceConstraints(k8sClient, "cluster", expectedReq, expectedLim) - - depl = &appsv1.Deployment{ - ObjectMeta: metav1.ObjectMeta{ - Name: "cluster", - Namespace: "openshift-gitops", - }, - } - - Expect(depl).To(k8sFixture.ExistByName()) - Expect(depl.Spec.Template.Spec.Containers).NotTo(BeEmpty()) - - container := depl.Spec.Template.Spec.Containers[0] - env := container.Env - - Expect(env).To(ContainElement(corev1.EnvVar{ - Name: "TLS_MIN_VERSION", - Value: "1.2", - })) - - Expect(env).To(ContainElement(corev1.EnvVar{ - Name: "TLS_CIPHER_SUITES", - Value: "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305", - })) }) It("validates that GitOpsService can update resource constraints", Label("openshift"), func() { From 9647584e5ea68578455483334c8df6398bed5995 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Tue, 25 Aug 2026 12:10:44 +0530 Subject: [PATCH 6/9] changes Signed-off-by: akhil nittala --- ...ent_Env_Args_For_Tls_Configuration_test.go | 21 +++++++------------ 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go b/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go index 54bb2088eaa..0c4ffd22d9b 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go @@ -8,7 +8,6 @@ package sequential import ( "context" - "fmt" "os" "time" @@ -28,6 +27,7 @@ import ( "github.com/argoproj-labs/argocd-operator/tests/ginkgo/fixture" osFixture "github.com/argoproj-labs/argocd-operator/tests/ginkgo/fixture/os" "github.com/argoproj-labs/argocd-operator/tests/ginkgo/fixture/utils" + gitopsFixture "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture" ) var _ = Describe("Validate Deployment Env Args For TLS Configuration", func() { @@ -36,13 +36,17 @@ var _ = Describe("Validate Deployment Env Args For TLS Configuration", func() { argocdInstanceName = "example-argocd" ) var ( - c client.Client - ctx context.Context + c client.Client + ctx context.Context + ocVersion string ) BeforeEach(func() { fixture.EnsureSequentialCleanSlate() c, _ = utils.GetE2ETestKubeClient() ctx = context.Background() + ocVersion = getOCPVersion() + Expect(ocVersion).ToNot(BeEmpty()) + gitopsFixture.SkipIfMinOCPVersion(ocVersion, gitopsFixture.OCP4_22) }) BeforeEach(func() { if fixture.EnvLocalRun() { @@ -81,17 +85,6 @@ var _ = Describe("Validate Deployment Env Args For TLS Configuration", func() { Context("When the ArgoCD instance is created with default TLS settings", func() { It("should validate default TLS values and updates on RepoServer, Server and Redis Deployments", func() { - ocVersion := getOCPVersion() - Expect(ocVersion).ToNot(BeEmpty()) - - var major, minor int - _, err := fmt.Sscanf(ocVersion, "%d.%d", &major, &minor) - Expect(err).NotTo(HaveOccurred()) - - if major < 4 || (major == 4 && minor < 22) { - Skip(fmt.Sprintf("skipping this test as OCP version is %s, requires OCP >= 4.22", ocVersion)) - return - } By("creating namespace") ns := &corev1.Namespace{ ObjectMeta: metav1.ObjectMeta{ From e7cff41e65ac64b0a0df877c7afd991767de7803 Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Tue, 25 Aug 2026 17:34:02 +0530 Subject: [PATCH 7/9] changes Signed-off-by: akhil nittala --- ...e_deployment_Env_Args_For_Tls_Configuration_test.go | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go b/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go index 0c4ffd22d9b..367c19880c7 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go @@ -40,6 +40,11 @@ var _ = Describe("Validate Deployment Env Args For TLS Configuration", func() { ctx context.Context ocVersion string ) + BeforeEach(func() { + if fixture.EnvLocalRun() { + Skip("This test is known not to work when running gitops operator locally") + } + }) BeforeEach(func() { fixture.EnsureSequentialCleanSlate() c, _ = utils.GetE2ETestKubeClient() @@ -48,11 +53,6 @@ var _ = Describe("Validate Deployment Env Args For TLS Configuration", func() { Expect(ocVersion).ToNot(BeEmpty()) gitopsFixture.SkipIfMinOCPVersion(ocVersion, gitopsFixture.OCP4_22) }) - BeforeEach(func() { - if fixture.EnvLocalRun() { - Skip("This test is known not to work when running gitops operator locally") - } - }) // --- Helper: Extract TLS values from args --- getTLSValues := func(args []string) (min string, hasMin bool, hasCiphers bool, ciphers string) { for i := 0; i < len(args); i++ { From 219319480b89b92dcd64aee0156550dd1637744d Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Thu, 27 Aug 2026 16:54:49 +0530 Subject: [PATCH 8/9] changes Signed-off-by: akhil nittala --- ...ate_deployment_Env_Args_For_Tls_Configuration_test.go | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go b/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go index 367c19880c7..5c3d2f15dbc 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go @@ -13,14 +13,12 @@ import ( appsv1 "k8s.io/api/apps/v1" corev1 "k8s.io/api/core/v1" - - argov1beta1api "github.com/argoproj-labs/argocd-operator/api/v1beta1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/types" - "sigs.k8s.io/controller-runtime/pkg/client" + argov1beta1api "github.com/argoproj-labs/argocd-operator/api/v1beta1" + . "github.com/onsi/ginkgo/v2" . "github.com/onsi/gomega" @@ -30,7 +28,7 @@ import ( gitopsFixture "github.com/redhat-developer/gitops-operator/test/openshift/e2e/ginkgo/fixture" ) -var _ = Describe("Validate Deployment Env Args For TLS Configuration", func() { +var _ = Describe("Validate Deployment Env Args For TLS Configuration", Label("openshift"), func() { const ( argocdNamespace = "test-tls-argocd" argocdInstanceName = "example-argocd" @@ -228,7 +226,6 @@ var _ = Describe("Validate Deployment Env Args For TLS Configuration", func() { } } - // --- Print results (always helpful in debugging) if !hasCiphersTLS13 || tlsCiphersTLS13 == "" { GinkgoWriter.Printf(" --tls-ciphersuites should not be empty, got %q\n", tlsCiphersTLS13) return false From b93993a174dbe1e375c5e4fa9f112f2fed073cce Mon Sep 17 00:00:00 2001 From: akhil nittala Date: Thu, 27 Aug 2026 17:12:31 +0530 Subject: [PATCH 9/9] changes Signed-off-by: akhil nittala --- ...ate_deployment_Env_Args_For_Tls_Configuration_test.go | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go b/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go index 5c3d2f15dbc..d072ed38b3e 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go @@ -94,16 +94,15 @@ var _ = Describe("Validate Deployment Env Args For TLS Configuration", Label("op By("generating a test certificate to use with redis, using openssl") redis_crt_File, err := os.CreateTemp("", "redis.crt") Expect(err).ToNot(HaveOccurred()) - + Expect(redis_crt_File.Close()).To(Succeed()) redis_key_File, err := os.CreateTemp("", "redis.key") Expect(err).ToNot(HaveOccurred()) - + Expect(redis_key_File.Close()).To(Succeed()) openssl_test_File, err := os.CreateTemp("", "openssl_test.cnf") Expect(err).ToNot(HaveOccurred()) - + Expect(openssl_test_File.Close()).To(Succeed()) opensslTestCNFContents := "\n[SAN]\nsubjectAltName=DNS:argocd-redis." + argocdNamespace + ".svc.cluster.local\n[req]\ndistinguished_name=req" - - err = os.WriteFile(openssl_test_File.Name(), ([]byte)(opensslTestCNFContents), 0666) + err = os.WriteFile(openssl_test_File.Name(), ([]byte)(opensslTestCNFContents), 0600) Expect(err).ToNot(HaveOccurred()) _, err = osFixture.ExecCommandWithOutputParam(false, true, "openssl", "req", "-new", "-x509", "-sha256",