From 1d95092a2a050dca290a6e9eeaa85fe444f184db Mon Sep 17 00:00:00 2001 From: Suyash Nalawade Date: Wed, 26 Aug 2026 18:22:20 +0530 Subject: [PATCH] Add defaults and update guards for VSO secret injection support Add empty-string defaults for db_fields_encryption_secret and container_token_secret to roles/common/defaults/main.yml, and update the corresponding guard conditions to handle both undefined and empty-string cases. The existing guards use 'is undefined' / 'is not defined' which do not treat an empty string as unset. This causes auto-generation to fail when the CR field is not provided (the empty-string default makes the variable "defined" but unusable). The updated guards use 'not var | default("")' which correctly handles both cases: - CR field set (e.g. to a VSO-synced secret name) -> non-empty -> guard skips -> operator uses the pre-existing secret - CR field not set -> default '' -> falsy -> guard fires -> operator auto-generates with default name This aligns the Galaxy operator guard pattern with the AWX operator which already uses '| length' for the same purpose. Files changed: - roles/common/defaults/main.yml (add 2 defaults) - roles/common/tasks/db_fields_encryption_configuration.yml (line 18) - roles/galaxy-config/tasks/combine_galaxy_settings.yml (line 35) Validated on OpenShift with AAP 2.7: - Test A PASS: operator respects pre-existing secrets when CR field set - Test B PASS: operator auto-generates secrets when CR field not set - Hub API healthy in both scenarios Ref: AAP-88888, ANSTRAT-2212 Signed-off-by: Suyash Nalawade --- roles/common/defaults/main.yml | 2 ++ roles/common/tasks/db_fields_encryption_configuration.yml | 2 +- roles/galaxy-config/tasks/combine_galaxy_settings.yml | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/roles/common/defaults/main.yml b/roles/common/defaults/main.yml index ef2079bc..7b111da9 100644 --- a/roles/common/defaults/main.yml +++ b/roles/common/defaults/main.yml @@ -3,6 +3,8 @@ image_pull_secret: '' image_pull_secrets: [] operator_service_account_name: '{{ lookup("env","OPERATOR_SA_NAME") | default("galaxy-operator-sa",true) }}' bundle_cacert_secret: '' +db_fields_encryption_secret: '' +container_token_secret: '' # Proxy environment variables for Galaxy containers. # Values are inherited from the operator pod environment. diff --git a/roles/common/tasks/db_fields_encryption_configuration.yml b/roles/common/tasks/db_fields_encryption_configuration.yml index 2fb7d1f6..7463dbbc 100644 --- a/roles/common/tasks/db_fields_encryption_configuration.yml +++ b/roles/common/tasks/db_fields_encryption_configuration.yml @@ -15,7 +15,7 @@ set_fact: db_fields_encryption_secret: '{{ ansible_operator_meta.name }}-db-fields-encryption' cacheable: yes - when: db_fields_encryption_secret is undefined + when: not db_fields_encryption_secret | default('') - name: Check for specified DB fields encryption configuration k8s_info: diff --git a/roles/galaxy-config/tasks/combine_galaxy_settings.yml b/roles/galaxy-config/tasks/combine_galaxy_settings.yml index a9f3e49e..c7fd910f 100644 --- a/roles/galaxy-config/tasks/combine_galaxy_settings.yml +++ b/roles/galaxy-config/tasks/combine_galaxy_settings.yml @@ -32,7 +32,7 @@ set_fact: container_token_secret: '{{ ansible_operator_meta.name }}-container-auth' cacheable: yes - when: container_token_secret is not defined + when: not container_token_secret | default('') - include_tasks: file: get_node_ip.yml