updated ocm so that it works

charts/hub/opp/templates/policy-ocm-observability.yaml

@@ -19,6 +19,8 @@ spec:
       kind: ConfigurationPolicy
       metadata:
         name: policy-ocm-observability
+        annotations:
+          argocd.argoproj.io/compare-options: IgnoreExtraneous
       spec:
         object-templates:
         - complianceType: musthave
@@ -32,12 +34,12 @@ spec:
               thanos.yaml: |
                 type: s3
                 config:
-                  bucket: {{ (lookup "objectbucket.io/v1alpha1" "ObjectBucket" "" "quay-registry-quay-datastore").BUCKET_NAME }}
-                  endpoint: {{ (lookup "objectbucket.io/v1alpha1" "ObjectBucket" "" "quay-registry-quay-datastore").BUCKET_HOST }}
+                  bucket: '{{ `{{ (lookup "objectbucket.io/v1alpha1" "ObjectBucket" "" "obc-quay-enterprise-quay-registry-quay-datastore").spec.endpoint.bucketName }}` }}'
+                  endpoint: '{{ `{{ (lookup "objectbucket.io/v1alpha1" "ObjectBucket" "" "obc-quay-enterprise-quay-registry-quay-datastore").spec.endpoint.bucketHost }}` }}'
                   insecure: true
-                  access_key: {{ .Values.ocm.accessKey }}
-                  secret_key: {{ .Values.ocm.secretKey }}
-            type: Opaque
+                  access_key: '{{ `{{ (lookup "v1" "Secret" "openshift-storage" "noobaa-admin").data.AWS_ACCESS_KEY_ID }}` }}'
+                  secret_key: '{{ `{{ (lookup "v1" "Secret" "openshift-storage" "noobaa-admin").data.AWS_SECRET_ACCESS_KEY }}` }}'
+              type: Opaque
         - complianceType: musthave
           objectDefinition:
             apiVersion: observability.open-cluster-management.io/v1beta2

charts/hub/opp/templates/policyset-managed.yaml

@@ -11,4 +11,5 @@ spec:
     them to work well together. This policy set if focued on the components that install
     to every managed cluster.
   policies:
-  - policy-acs-secured-status
+  - policy-acs-secured-status
+  - policy-ocm-observability

charts/hub/opp/values.yaml

@@ -1,6 +1,6 @@
 # No Values
-ocm:
-  accessKey: '{{ `{{ fromSecret "openshift-storage" "noobaa-admin" "AWS_ACCESS_KEY_ID" }}` }}'
-  secretKey: '{{ `{{ fromSecret "openshift-storage" "noobaa-admin" "AWS_SECRET_ACCESS_KEY" }}` }}'
+# Need to use fromSecret for these keys. problems ith json output.
+##  accessKey: '{{ `{{ fromSecret "openshift-storage" "noobaa-admin" "AWS_ACCESS_KEY_ID" }}` }}'
+##  secretKey: '{{ `{{ fromSecret "openshift-storage" "noobaa-admin" "AWS_SECRET_ACCESS_KEY" }}` }}'
 
 

tests/hub-opp-naked.expected.yaml

@@ -104,6 +104,8 @@ spec:
       kind: ConfigurationPolicy
       metadata:
         name: policy-ocm-observability
+        annotations:
+          argocd.argoproj.io/compare-options: IgnoreExtraneous
       spec:
         object-templates:
         - complianceType: musthave
@@ -117,12 +119,12 @@ spec:
               thanos.yaml: |
                 type: s3
                 config:
-                  bucket: 
-                  endpoint: 
+                  bucket: '{{ (lookup "objectbucket.io/v1alpha1" "ObjectBucket" "" "obc-quay-enterprise-quay-registry-quay-datastore").spec.endpoint.bucketName }}'
+                  endpoint: '{{ (lookup "objectbucket.io/v1alpha1" "ObjectBucket" "" "obc-quay-enterprise-quay-registry-quay-datastore").spec.endpoint.bucketHost }}'
                   insecure: true
-                  access_key: {{ `{{ fromSecret "openshift-storage" "noobaa-admin" "AWS_ACCESS_KEY_ID" }}` }}
-                  secret_key: {{ `{{ fromSecret "openshift-storage" "noobaa-admin" "AWS_SECRET_ACCESS_KEY" }}` }}
-            type: Opaque
+                  access_key: '{{ (lookup "v1" "Secret" "openshift-storage" "noobaa-admin").data.AWS_ACCESS_KEY_ID }}'
+                  secret_key: '{{ (lookup "v1" "Secret" "openshift-storage" "noobaa-admin").data.AWS_SECRET_ACCESS_KEY }}'
+              type: Opaque
         - complianceType: musthave
           objectDefinition:
             apiVersion: observability.open-cluster-management.io/v1beta2
@@ -173,3 +175,4 @@ spec:
     to every managed cluster.
   policies:
   - policy-acs-secured-status
+  - policy-ocm-observability

tests/hub-opp-normal.expected.yaml

@@ -104,6 +104,8 @@ spec:
       kind: ConfigurationPolicy
       metadata:
         name: policy-ocm-observability
+        annotations:
+          argocd.argoproj.io/compare-options: IgnoreExtraneous
       spec:
         object-templates:
         - complianceType: musthave
@@ -117,12 +119,12 @@ spec:
               thanos.yaml: |
                 type: s3
                 config:
-                  bucket: 
-                  endpoint: 
+                  bucket: '{{ (lookup "objectbucket.io/v1alpha1" "ObjectBucket" "" "obc-quay-enterprise-quay-registry-quay-datastore").spec.endpoint.bucketName }}'
+                  endpoint: '{{ (lookup "objectbucket.io/v1alpha1" "ObjectBucket" "" "obc-quay-enterprise-quay-registry-quay-datastore").spec.endpoint.bucketHost }}'
                   insecure: true
-                  access_key: {{ `{{ fromSecret "openshift-storage" "noobaa-admin" "AWS_ACCESS_KEY_ID" }}` }}
-                  secret_key: {{ `{{ fromSecret "openshift-storage" "noobaa-admin" "AWS_SECRET_ACCESS_KEY" }}` }}
-            type: Opaque
+                  access_key: '{{ (lookup "v1" "Secret" "openshift-storage" "noobaa-admin").data.AWS_ACCESS_KEY_ID }}'
+                  secret_key: '{{ (lookup "v1" "Secret" "openshift-storage" "noobaa-admin").data.AWS_SECRET_ACCESS_KEY }}'
+              type: Opaque
         - complianceType: musthave
           objectDefinition:
             apiVersion: observability.open-cluster-management.io/v1beta2
@@ -173,3 +175,4 @@ spec:
     to every managed cluster.
   policies:
   - policy-acs-secured-status
+  - policy-ocm-observability

values-global.yaml

@@ -34,7 +34,7 @@ global:
 devel:
   appURL: https://github.com/ipbabble/chat-client.git
   image: quay.io/ipbabble/chat-client:latest
-  npmbase: quay.io/ipbabble/ubi-npm:latest
+  npmbase: quay.io/hybridcloudpatterns/ubi-npm:latest
 
 main:
   clusterGroupName: hub

values-secret.yaml.template

@@ -11,3 +11,8 @@ secrets:
     username: USERNAME
     password: 'encoded password in single quotes'
 
+# This is NOT for Quay.io. This is for the installed Quay registry. 
+  quay:
+    account: QUAYADMINNAME 
+    password: QUAYPASSWORD
+    email: quayadmin@example.com