[GITOPS-8560]: Validation webhook to reject invalid SSO configs in Ar…

Dockerfile

@@ -1,7 +1,10 @@
 # Build the manager binary
-FROM golang:1.24 as builder
+FROM golang:1.25 as builder
 
 WORKDIR /workspace
+
+COPY argocd-operator /workspace/argocd-operator
+
 # Copy the Go Modules manifests
 COPY go.mod go.mod
 COPY go.sum go.sum

Makefile

@@ -214,7 +214,7 @@ run: manifests generate fmt vet ## Run a controller from your host.
 	CLUSTER_SCOPED_ARGO_ROLLOUTS_NAMESPACES=argo-rollouts,test-rom-ns-1,rom-ns-1,openshift-gitops  ARGOCD_CLUSTER_CONFIG_NAMESPACES="openshift-gitops, argocd-e2e-cluster-config, argocd-test-impersonation-1-046, argocd-agent-principal-1-051, argocd-agent-agent-1-052, appset-argocd, appset-old-ns, appset-new-ns"  REDIS_CONFIG_PATH="build/redis"   go run ./cmd/main.go
 
 .PHONY: docker-build
-docker-build: test ## Build container image with the manager.
+docker-build: ## Build container image with the manager.
 	$(CONTAINER_RUNTIME) build -t ${IMG} .
 
 .PHONY: docker-push

cmd/main.go

@@ -32,14 +32,14 @@
 
 	rolloutManagerApi "github.com/argoproj-labs/argo-rollouts-manager/api/v1alpha1"
 	rolloutManagerProvisioner "github.com/argoproj-labs/argo-rollouts-manager/controllers"
 	argov1alpha1api "github.com/argoproj-labs/argocd-operator/api/v1alpha1"
 	argov1beta1api "github.com/argoproj-labs/argocd-operator/api/v1beta1"
 	argocdcommon "github.com/argoproj-labs/argocd-operator/common"
 	argocdprovisioner "github.com/argoproj-labs/argocd-operator/controllers/argocd"
 	"github.com/argoproj-labs/argocd-operator/controllers/argoutil"
 	notificationsprovisioner "github.com/argoproj-labs/argocd-operator/controllers/notificationsconfiguration"
 	"github.com/argoproj-labs/argocd-operator/pkg/cacheutils"
 	cw "github.com/argoproj-labs/argocd-operator/pkg/clientwrapper"
 	appsv1 "github.com/openshift/api/apps/v1"
 	configv1 "github.com/openshift/api/config/v1"
 	console "github.com/openshift/api/console/v1"
@@ -218,6 +218,11 @@
 		}
 	}
 
+	if err = (&argov1beta1api.ArgoCD{}).SetupWebhookWithManager(mgr); err != nil {
+		setupLog.Error(err, "unable to create webhook", "webhook", "ArgoCD")
+		os.Exit(1)
+	}
+
 	if err = (&controllers.ReconcileGitopsService{
 		Client:                client,
 		Scheme:                mgr.GetScheme(),

config/crd/bases/pipelines.openshift.io_gitopsservices.yaml

@@ -56,7 +56,7 @@ spec:
                               Claims lists the names of resources, defined in spec.resourceClaims,
                               that are used by this container.
 
-                              This is an alpha field and requires enabling the
+                              This field depends on the
                               DynamicResourceAllocation feature gate.
 
                               This field is immutable. It can only be set for containers.
@@ -121,7 +121,7 @@ spec:
                               Claims lists the names of resources, defined in spec.resourceClaims,
                               that are used by this container.
 
-                              This is an alpha field and requires enabling the
+                              This field depends on the
                               DynamicResourceAllocation feature gate.
 
                               This field is immutable. It can only be set for containers.

config/default/kustomization.yaml

@@ -72,3 +72,6 @@ vars:
 #    kind: Service
 #    version: v1
 #    name: webhook-service
+# If needed, add commonAnnotations for webhook CA injection
+commonAnnotations:
+  service.beta.openshift.io/inject-cabundle: "true"

config/manager/kustomization.yaml

@@ -12,4 +12,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 images:
 - name: controller
-  newName: quay.io/redhat-developer/gitops-operator
+  newName: quay.io/nittalaakhil/openshift-gitops-operator
+  newTag: 0.0.1

config/rbac/role.yaml

@@ -18,13 +18,7 @@ rules:
   - services
   - services/finalizers
   verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
+  - '*'
 - apiGroups:
   - ""
   resources:
@@ -96,19 +90,20 @@ rules:
   resources:
   - daemonsets
   - deployments
-  - podtemplates
   - replicasets
   - statefulsets
   verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
+  - '*'
+- apiGroups:
+  - apps
+  resources:
+  - deployments/finalizers
+  verbs:
   - update
-  - watch
 - apiGroups:
   - apps
+  resourceNames:
+  - argocd-operator
   resources:
   - deployments/finalizers
   verbs:
@@ -121,8 +116,21 @@ rules:
   - deployments/finalizers
   verbs:
   - update
+- apiGroups:
+  - apps
+  resources:
+  - podtemplates
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - apps.openshift.io
+  - route.openshift.io
   resources:
   - '*'
   verbs:
@@ -133,6 +141,13 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - argocd-image-updater.argoproj.io
+  resources:
+  - imageupdaters
+  - imageupdaters/finalizers
+  verbs:
+  - '*'
 - apiGroups:
   - argoproj.io
   resources:
@@ -142,8 +157,6 @@ rules:
   - clusteranalysistemplates
   - experiments
   - experiments/finalizers
-  - namespacemanagements
-  - namespacemanagements/status
   - rollouts
   - rollouts/finalizers
   - rollouts/scale
@@ -165,6 +178,29 @@ rules:
   - argocds
   - argocds/finalizers
   - argocds/status
+  verbs:
+  - '*'
+- apiGroups:
+  - argoproj.io
+  resources:
+  - argocdexports
+  - argocdexports/finalizers
+  - argocdexports/status
+  - namespacemanagements/finalizers
+  - notificationsconfigurations
+  - notificationsconfigurations/finalizers
+  verbs:
+  - '*'
+- apiGroups:
+  - argoproj.io
+  resources:
+  - namespacemanagements
+  - namespacemanagements/status
+  verbs:
+  - '*'
+- apiGroups:
+  - argoproj.io
+  resources:
   - rolloutmanagers
   verbs:
   - create
@@ -174,13 +210,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - argoproj.io
-  resources:
-  - notificationsconfigurations
-  - notificationsconfigurations/finalizers
-  verbs:
-  - '*'
 - apiGroups:
   - argoproj.io
   resources:
@@ -200,26 +229,14 @@ rules:
   resources:
   - horizontalpodautoscalers
   verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
+  - '*'
 - apiGroups:
   - batch
   resources:
   - cronjobs
   - jobs
   verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
+  - '*'
 - apiGroups:
   - config.openshift.io
   resources:
@@ -298,13 +315,7 @@ rules:
   - prometheusrules
   - servicemonitors
   verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
+  - '*'
 - apiGroups:
   - networking.istio.io
   resources:
@@ -320,6 +331,11 @@ rules:
   - networking.k8s.io
   resources:
   - ingresses
+  verbs:
+  - '*'
+- apiGroups:
+  - networking.k8s.io
+  resources:
   - networkpolicies
   verbs:
   - create
@@ -386,16 +402,7 @@ rules:
   - clusterrolebindings
   - clusterroles
   verbs:
-  - bind
-  - create
-  - delete
-  - deletecollection
-  - escalate
-  - get
-  - list
-  - patch
-  - update
-  - watch
+  - '*'
 - apiGroups:
   - rbac.authorization.k8s.io
   resources:
@@ -412,17 +419,10 @@ rules:
 - apiGroups:
   - route.openshift.io
   resources:
-  - '*'
   - routes
   - routes/custom-host
   verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
+  - '*'
 - apiGroups:
   - split.smi-spec.io
   resources:
@@ -440,13 +440,7 @@ rules:
   - templateinstances
   - templates
   verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
+  - '*'
 - apiGroups:
   - traefik.containo.us
   resources:

config/webhook/kustomization.yaml

@@ -1,6 +1,10 @@
 resources:
-#- manifests.yaml
+- manifests.yaml
 - service.yaml
 
 configurations:
 - kustomizeconfig.yaml
+
+commonAnnotations:
+  service.beta.openshift.io/inject-cabundle: "true"
+  service.beta.openshift.io/serving-cert-secret-name: webhook-server-cert

config/webhook/manifests.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: validating-webhook-configuration
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /validate-argoproj-io-v1beta1-argocd
+  failurePolicy: Fail
+  name: vargocd.kb.io
+  rules:
+  - apiGroups:
+    - argoproj.io
+    apiVersions:
+    - v1beta1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - argocds
+  sideEffects: None

config/webhook/service.yaml

@@ -5,6 +5,7 @@ metadata:
   name: webhook-service
   namespace: system
   annotations:
+    service.beta.openshift.io/inject-cabundle: "true"
     service.beta.openshift.io/serving-cert-secret-name: webhook-server-cert
 spec:
   ports: