Conversation
Add empty-string defaults for db_fields_encryption_secret and
container_token_secret to roles/common/defaults/main.yml, and update the
corresponding guard conditions to handle both undefined and empty-string
cases.
The existing guards use 'is undefined' / 'is not defined' which do not
treat an empty string as unset. This causes auto-generation to fail
when the CR field is not provided (the empty-string default makes the
variable "defined" but unusable). The updated guards use
'not var | default("")' which correctly handles both cases:
- CR field set (e.g. to a VSO-synced secret name) -> non-empty -> guard
skips -> operator uses the pre-existing secret
- CR field not set -> default '' -> falsy -> guard fires -> operator
auto-generates with default name
This aligns the Galaxy operator guard pattern with the AWX operator
which already uses '| length' for the same purpose.
Files changed:
- roles/common/defaults/main.yml (add 2 defaults)
- roles/common/tasks/db_fields_encryption_configuration.yml (line 18)
- roles/galaxy-config/tasks/combine_galaxy_settings.yml (line 35)
Validated on OpenShift with AAP 2.7:
- Test A PASS: operator respects pre-existing secrets when CR field set
- Test B PASS: operator auto-generates secrets when CR field not set
- Hub API healthy in both scenarios
Ref: AAP-88888, ANSTRAT-2212
Signed-off-by: Suyash Nalawade <sunalawa@redhat.com>
sunalawa
marked this pull request as ready for review
September 17, 2026 09:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
db_fields_encryption_secretandcontainer_token_secretinroles/common/defaults/main.ymlis undefined/is not definedtonot var | default('')indb_fields_encryption_configuration.ymlandcombine_galaxy_settings.ymlWhy
The existing guards do not handle empty strings. Adding defaults alone breaks auto-generation because
'' is undefinedevaluates tofalse. The updated guards (aligned with AWX operator's| lengthpattern) correctly handle both:''-> falsy -> guard fires -> auto-generatesValidated on OpenShift (AAP 2.7)
automation-platform-hub-db-fields-encryptionandautomation-platform-hub-container-auth. Hub API healthy.Test plan
Ref: AAP-88888, ANSTRAT-2212