chore(e2e): sync DefaultClusterScopedRoleDisabled tests for principal/agent

go.mod

@@ -5,7 +5,7 @@ go 1.26.2
 require (
 	github.com/argoproj-labs/argo-rollouts-manager v0.0.9-0.20260505092152-3e07addcb2cb
 	github.com/argoproj-labs/argocd-image-updater v1.2.1
-	github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260708101223-285ef22c61ea
+	github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260713190512-b2957ceaa2ab
 	github.com/argoproj/argo-cd/gitops-engine v0.7.1-0.20250908182407-97ad5b59a627
 	github.com/argoproj/argo-cd/v3 v3.4.2
 	github.com/go-logr/logr v1.4.3
@@ -21,7 +21,7 @@ require (
 	github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.74.0
 	github.com/stretchr/testify v1.11.1
 	go.uber.org/zap v1.28.0
-	golang.org/x/mod v0.37.0
+	golang.org/x/mod v0.38.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools v2.2.0+incompatible
 	k8s.io/api v0.35.2
@@ -189,7 +189,7 @@ require (
 	golang.org/x/term v0.44.0 // indirect
 	golang.org/x/text v0.38.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.45.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
 	google.golang.org/genproto v0.0.0-20240401170217-c3f982113cda // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 // indirect

go.sum

@@ -43,8 +43,8 @@ github.com/argoproj-labs/argo-rollouts-manager v0.0.9-0.20260505092152-3e07addcb
 github.com/argoproj-labs/argo-rollouts-manager v0.0.9-0.20260505092152-3e07addcb2cb/go.mod h1:Ouqjtkj48SPJhW6r00CYqJ4uM7QDy3D4tinKIK9Y69Q=
 github.com/argoproj-labs/argocd-image-updater v1.2.1 h1:yaJdmpFOOKTkC9688/a7jjOBLpCREj7Wdnmn4A3v1nU=
 github.com/argoproj-labs/argocd-image-updater v1.2.1/go.mod h1:sBS1JqoM9R0QhIDVD4bdWS/GejDQaFwdFUV+yE9TzjA=
-github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260708101223-285ef22c61ea h1:v8qfDg4zlWu+YQB+RRmWT86Krp0+HIYs89ZQ6+eVKCc=
-github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260708101223-285ef22c61ea/go.mod h1:VahP4wwBBcLux2I/rNgcPo4nVWmuUOvE4K2Wqg5M0vQ=
+github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260713190512-b2957ceaa2ab h1:9aAFHNFozMT4vanTiT3y6WNb6+vcph+JcErjtHmzd/s=
+github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260713190512-b2957ceaa2ab/go.mod h1:vVd7s8gzmMfA3pueuG5ylvvdIk3aFlk+M3uf0xrIvDE=
 github.com/argoproj/argo-cd/gitops-engine v0.0.0-20260512203152-0dc6b1b57dd5 h1:IMzPK0gt1lZRDHtiKGzU0VAez0FmT2veytxlmE2AwyU=
 github.com/argoproj/argo-cd/gitops-engine v0.0.0-20260512203152-0dc6b1b57dd5/go.mod h1:6Q1KZzkeKlnCpzzZ1Fu72+WPMAt+ZeMD9KOO6aMjW68=
 github.com/argoproj/argo-cd/v3 v3.4.2 h1:S3j0K34uGW4geWiM88+0cHcCEtInn2Sa9U7/Sa18L7Y=
@@ -538,8 +538,8 @@ golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=

test/openshift/e2e/ginkgo/sequential/1-051_validate_argocd_agent_principal_test.go

@@ -44,7 +44,6 @@ import (
 )
 
 var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
-
 	const (
 		argoCDName                    = "example"
 		argoCDAgentPrincipalName      = "example-agent-principal" // argoCDName + "-agent-principal"
@@ -54,7 +53,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 	)
 
 	Context("1-051_validate_argocd_agent_principal", func() {
-
 		var (
 			k8sClient                client.Client
 			ctx                      context.Context
@@ -71,16 +69,14 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 			principalDeployment      *appsv1.Deployment
 			expectedEnvVariables     map[string]string
 			secretNames              agentFixture.AgentSecretNames
-			principalNetworkPolicy   *networkingv1.NetworkPolicy
 			principalRoute           *routev1.Route
+			principalNetworkPolicy   *networkingv1.NetworkPolicy
 			resourceProxyServiceName string
 			principalResources       agentFixture.PrincipalResources
 		)
 
 		BeforeEach(func() {
 			fixture.EnsureSequentialCleanSlate()
-			fixture.SetEnvInOperatorSubscriptionOrDeployment("ARGOCD_CLUSTER_CONFIG_NAMESPACES", "openshift-gitops, argocd-agent-principal-1-051")
-
 			k8sClient, _ = fixtureUtils.GetE2ETestKubeClient()
 			ctx = context.Background()
 			ns, cleanupFunc = fixture.CreateNamespaceWithCleanupFunc("argocd-agent-principal-1-051")
@@ -192,12 +188,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 					Namespace: ns.Name,
 				},
 			}
-			principalNetworkPolicy = &networkingv1.NetworkPolicy{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      fmt.Sprintf("%s-agent-principal-network-policy", argoCDName),
-					Namespace: ns.Name,
-				},
-			}
 
 			principalNetworkPolicy = &networkingv1.NetworkPolicy{
 				ObjectMeta: metav1.ObjectMeta{
@@ -293,9 +283,9 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 				ClusterRoleBinding:       clusterRoleBinding,
 				PrincipalDeployment:      principalDeployment,
 				PrincipalRoute:           principalRoute,
-				PrincipalNetworkPolicy:   principalNetworkPolicy,
 				SecretNames:              secretNames,
 				ServiceNames:             serviceNames,
+				PrincipalNetworkPolicy:   principalNetworkPolicy,
 				DeploymentNames:          deploymentNames,
 				ExpectRoute:              expectRoutePtr,
 			})
@@ -347,7 +337,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 		})
 
 		It("should create argocd agent principal resources, and pod should start successfully with default image", func() {
-
 			// Add a custom environment variable to the principal server
 			argoCD.Spec.ArgoCDAgent.Principal.Env = []corev1.EnvVar{{Name: "TEST_ENV", Value: "test_value"}}
 
@@ -409,7 +398,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 		})
 
 		It("Should reflect configuration changes from ArgoCD CR to the principal deployment", func() {
-
 			By("Create ArgoCD instance")
 
 			argoCD.Spec.ArgoCDAgent.Principal.Image = common.ArgoCDAgentPrincipalDefaultImageName
@@ -437,12 +425,11 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 			Expect(k8sClient.Get(ctx, client.ObjectKey{Name: argoCDName, Namespace: ns.Name}, argoCD)).To(Succeed())
 
 			argocdFixture.Update(argoCD, func(ac *argov1beta1api.ArgoCD) {
-
 				ac.Spec.ArgoCDAgent.Principal.LogLevel = "trace"
 				ac.Spec.ArgoCDAgent.Principal.LogFormat = "json"
 				ac.Spec.ArgoCDAgent.Principal.Server.KeepAliveMinInterval = "60s"
 				ac.Spec.ArgoCDAgent.Principal.Server.EnableWebSocket = ptr.To(true)
-				ac.Spec.ArgoCDAgent.Principal.Image = "quay.io/argoprojlabs/argocd-agent:v0.8.1"
+				ac.Spec.ArgoCDAgent.Principal.Image = "quay.io/argoprojlabs/argocd-agent:v0.5.1"
 
 				ac.Spec.ArgoCDAgent.Principal.Namespace.AllowedNamespaces = []string{"agent-managed", "agent-autonomous"}
 				ac.Spec.ArgoCDAgent.Principal.Namespace.EnableNamespaceCreate = ptr.To(true)
@@ -460,7 +447,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 					SecretName:   "argocd-agent-resource-proxy-tls-v2",
 					CASecretName: "argocd-agent-ca-v2",
 				}
-
 			})
 
 			By("Create required secrets and certificates for principal pod to start properly")
@@ -489,7 +475,7 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 					if container == nil {
 						return false
 					}
-					return container.Image == "quay.io/argoprojlabs/argocd-agent:v0.8.1"
+					return container.Image == "quay.io/argoprojlabs/argocd-agent:v0.5.1"
 				}, "120s", "5s").Should(BeTrue(), "Principal deployment should have the updated image")
 
 			By("verify that deployment is in Ready state")
@@ -520,7 +506,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 		})
 
 		It("should handle route disabled configuration correctly", func() {
-
 			By("Create ArgoCD instance with route disabled")
 
 			argoCD.Spec.ArgoCDAgent.Principal.Server.Route = argov1beta1api.ArgoCDAgentPrincipalRouteSpec{
@@ -540,7 +525,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 		})
 
 		It("should handle route enabled configuration correctly", func() {
-
 			By("Create ArgoCD instance with route enabled")
 
 			argoCD.Spec.ArgoCDAgent.Principal.Server.Route = argov1beta1api.ArgoCDAgentPrincipalRouteSpec{
@@ -560,7 +544,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 		})
 
 		It("should handle route toggle from enabled to disabled correctly", func() {
-
 			By("Create ArgoCD instance with route enabled")
 
 			argoCD.Spec.ArgoCDAgent.Principal.Server.Route = argov1beta1api.ArgoCDAgentPrincipalRouteSpec{
@@ -626,7 +609,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 		})
 
 		It("should handle service type ClusterIP configuration correctly", func() {
-
 			By("Create ArgoCD instance with service type ClusterIP")
 
 			argoCD.Spec.ArgoCDAgent.Principal.Server.Service = argov1beta1api.ArgoCDAgentPrincipalServiceSpec{
@@ -651,7 +633,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 		})
 
 		It("should handle service type LoadBalancer configuration correctly", func() {
-
 			By("Create ArgoCD instance with service type LoadBalancer")
 
 			argoCD.Spec.ArgoCDAgent.Principal.Server.Service = argov1beta1api.ArgoCDAgentPrincipalServiceSpec{
@@ -676,7 +657,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 		})
 
 		It("should handle service type updates correctly", func() {
-
 			By("Create ArgoCD instance with service type ClusterIP")
 
 			argoCD.Spec.ArgoCDAgent.Principal.Server.Service = argov1beta1api.ArgoCDAgentPrincipalServiceSpec{
@@ -718,7 +698,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 		})
 
 		It("should deploy principal via namespace-scoped ArgoCD instance and verify cluster role and cluster role binding are not created", func() {
-
 			By("Create namespace-scoped ArgoCD instance")
 
 			// Create namespace for hosting namespace-scoped ArgoCD instance with principal
@@ -772,7 +751,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 		})
 
 		It("should delete existing cluster role and cluster role binding if ArgoCD instance is namespace-scoped", func() {
-
 			By("Create namespace-scoped ArgoCD instance namespace")
 
 			// Create namespace for hosting namespace-scoped ArgoCD instance with principal
@@ -916,7 +894,6 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 		})
 
 		It("should create and delete principal ServiceMonitor based on prometheus enabled flag", func() {
-
 			By("Create ArgoCD instance with principal enabled and prometheus enabled")
 
 			argoCD.Spec.Prometheus.Enabled = true
@@ -963,5 +940,41 @@ var _ = Describe("GitOps Operator Sequential E2E Tests", func() {
 
 			Eventually(principalServiceMonitor, "2m", "2s").Should(k8sFixture.NotExistByName())
 		})
+
+		It("shouldn't create ClusterRole and ClusterRoleBinding for principal if spec.DefaultClusterScopedRoleDisabled is set", func() {
+			By("Create ArgoCD instance with principal enabled and DefaultClusterScopedRoleDisabled is true")
+			argoCD.Spec.DefaultClusterScopedRoleDisabled = true
+			Expect(k8sClient.Create(ctx, argoCD)).To(Succeed())
+
+			By("Verify Argo CD CR is reconciled")
+			Eventually(principalDeployment).Should(k8sFixture.ExistByName())
+
+			By("Verify ClusterRole and ClusterRoleBinding do not exist")
+			Eventually(clusterRole, "60s", "2s").Should(k8sFixture.NotExistByName())
+			Eventually(clusterRoleBinding, "60s", "2s").Should(k8sFixture.NotExistByName())
+
+			Consistently(clusterRole, "15s", "2s").Should(k8sFixture.NotExistByName())
+			Consistently(clusterRoleBinding, "15s", "2s").Should(k8sFixture.NotExistByName())
+
+			By("Namespaced RBAC objects should still exist")
+			Eventually(role, "60s", "2s").Should(k8sFixture.ExistByName())
+			Eventually(roleBinding, "60s", "2s").Should(k8sFixture.ExistByName())
+
+			By("Unset DefaultClusterScopedRoleDisabled and make sure cluster scoped RBAC objects are created")
+			argocdFixture.Update(argoCD, func(ac *argov1beta1api.ArgoCD) {
+				ac.Spec.DefaultClusterScopedRoleDisabled = false
+			})
+			Eventually(clusterRole, "60s", "2s").Should(k8sFixture.ExistByName())
+			Eventually(clusterRoleBinding, "60s", "2s").Should(k8sFixture.ExistByName())
+
+			By("Setting DefaultClusterScopedRoleDisabled again deletes clusterRole and clusterRoleBinding")
+			argocdFixture.Update(argoCD, func(ac *argov1beta1api.ArgoCD) {
+				ac.Spec.DefaultClusterScopedRoleDisabled = true
+			})
+			Eventually(clusterRole, "60s", "2s").Should(k8sFixture.NotExistByName())
+			Eventually(clusterRoleBinding, "60s", "2s").Should(k8sFixture.NotExistByName())
+			Consistently(clusterRole, "10s", "2s").Should(k8sFixture.NotExistByName())
+			Consistently(clusterRoleBinding, "10s", "2s").Should(k8sFixture.NotExistByName())
+		})
 	})
 })