GITOPSRVCE-778: only create operations for missing external cluster secrets

[jgwest]

Description:

• At present, in cluster-agent's namespace_reconciler.go, in recreateClusterSecrets, we are iterating through the list of ManagedEnvironments looking for those that do not have a corresponding Argo CD Cluster Secret.
• However, there exist many ManagedEnvironment rows that do not require a cluster secret: any managed environment that corresponds to a '*_tenant' Namespace on the cluster does not require an Argo CD cluster secret. Why? Because Argo CD by default already has the credentials needed to read/write from any namespace on the that it is deployed to.
• We can thus update logic in 'recreateClusterSecrets' to avoid creating Operations for ManagedEnvironments/Applications that target the same cluster as Argo CD.

This PR:

• moves "serviceaccount_bearer_token" to a string constant
• skips creating Argo CD Cluster secret in recreateClusterSecrets for ManagedEnvironents that have a default serviceaccount_bearer_token
• adds a new test case to verify this case

Link to JIRA Story (if applicable): https://issues.redhat.com/browse/GITOPSRVCE-778

[openshift-ci-robot]

@jgwest: This pull request references GITOPSRVCE-778 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.15.0" version, but no target version was set.

In response to this:

Description:

• At present, in cluster-agent's namespace_reconciler.go, in recreateClusterSecrets, we are iterating through the list of ManagedEnvironments looking for those that do not have a corresponding Argo CD Cluster Secret.
• However, there exist many ManagedEnvironment rows that do not require a cluster secret: any managed environment that corresponds to a '*_tenant' Namespace on the cluster does not require an Argo CD cluster secret. Why? Because Argo CD by default already has the credentials needed to read/write from any namespace on the that it is deployed to.
• We can thus update logic in 'recreateClusterSecrets' to avoid creating Operations for ManagedEnvironments/Applications that target the same cluster as Argo CD.

This PR:

• moves "serviceaccount_bearer_token" to a string constant
• skips creating Argo CD Cluster secret in recreateClusterSecrets for ManagedEnvironents that have a default serviceaccount_bearer_token
• adds a new test case to verify this case

Link to JIRA Story (if applicable):

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci-robot]

@jgwest: This pull request references GITOPSRVCE-778 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.15.0" version, but no target version was set.

In response to this:

Description:

• At present, in cluster-agent's namespace_reconciler.go, in recreateClusterSecrets, we are iterating through the list of ManagedEnvironments looking for those that do not have a corresponding Argo CD Cluster Secret.
• However, there exist many ManagedEnvironment rows that do not require a cluster secret: any managed environment that corresponds to a '*_tenant' Namespace on the cluster does not require an Argo CD cluster secret. Why? Because Argo CD by default already has the credentials needed to read/write from any namespace on the that it is deployed to.
• We can thus update logic in 'recreateClusterSecrets' to avoid creating Operations for ManagedEnvironments/Applications that target the same cluster as Argo CD.

This PR:

• moves "serviceaccount_bearer_token" to a string constant
• skips creating Argo CD Cluster secret in recreateClusterSecrets for ManagedEnvironents that have a default serviceaccount_bearer_token
• adds a new test case to verify this case

Link to JIRA Story (if applicable): https://issues.redhat.com/browse/GITOPSRVCE-778

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jgwest

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [jgwest]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

Attention: 5 lines in your changes are missing coverage. Please review.

Comparison is base (eb5a1c0) 61.82% compared to head (b5b959d) 61.79%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #682      +/-   ##
==========================================
- Coverage   61.82%   61.79%   -0.03%     
==========================================
  Files          99       99              
  Lines       18091    18099       +8     
==========================================
+ Hits        11184    11185       +1     
- Misses       5655     5659       +4     
- Partials     1252     1255       +3     

Files	Coverage Δ
backend-shared/db/clustercredentials.go	38.34% <ø> (ø)
backend-shared/db/util/utils.go	71.42% <100.00%> (ø)
...nt/controllers/argoproj.io/namespace_reconciler.go	66.53% <37.50%> (-0.45%)	⬇️

... and 1 file with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[jparsai]

/lgtm