Skip to content

Add a linter check for environment selectors. #2619

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bergmannf wants to merge 2 commits into
base: master
Choose a base branch
from
+25 −7
Open

Add a linter check for environment selectors. #2619

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c53e466
Add a linter check for environment selectors.
bergmannf Dec 23, 2025
7abefbd
Update to ubi9 & python3.12
bergmannf Dec 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,8 +77,8 @@ generate-rosa-brand-logo:
.PHONY: generate-hive-templates
generate-hive-templates: generate-oauth-templates
if [ -z ${IN_CONTAINER} ]; then \
$(CONTAINER_ENGINE) run $(CONTAINER_RUN_FLAGS) registry.access.redhat.com/ubi8/python-39 /bin/bash -xc "cd `pwd -P`; pip install --disable-pip-version-check oyaml; curl -sSL https://github.com/open-cluster-management-io/policy-generator-plugin/releases/download/${POLICYGEN_VERSION}/linux-amd64-PolicyGenerator --output /opt/app-root/bin/PolicyGenerator; chmod +x /opt/app-root/bin/PolicyGenerator; ${GEN_POLICY_CONFIG}; ${GEN_POLICY_CONFIG_SP}; ${GEN_POLICY}; ${GEN_CMO_CONFIG}";\
$(CONTAINER_ENGINE) run $(CONTAINER_RUN_FLAGS) registry.access.redhat.com/ubi8/python-39 /bin/bash -xc "cd `pwd -P`; pip install --disable-pip-version-check oyaml; ${GEN_TEMPLATE}"; \
$(CONTAINER_ENGINE) run $(CONTAINER_RUN_FLAGS) registry.access.redhat.com/ubi9/python-312 /bin/bash -xc "cd `pwd -P`; pip install --disable-pip-version-check oyaml; curl -sSL https://github.com/open-cluster-management-io/policy-generator-plugin/releases/download/${POLICYGEN_VERSION}/linux-amd64-PolicyGenerator --output /opt/app-root/bin/PolicyGenerator; chmod +x /opt/app-root/bin/PolicyGenerator; ${GEN_POLICY_CONFIG}; ${GEN_POLICY_CONFIG_SP}; ${GEN_POLICY}; ${GEN_CMO_CONFIG}";\
$(CONTAINER_ENGINE) run $(CONTAINER_RUN_FLAGS) registry.access.redhat.com/ubi9/python-312 /bin/bash -xc "cd `pwd -P`; pip install --disable-pip-version-check oyaml; ${GEN_TEMPLATE}"; \
else \
${GEN_POLICY_CONFIG};\
${GEN_POLICY_CONFIG_SP};\
Expand Down
1 change: 0 additions & 1 deletion deploy/osd-fedramp-machineconfig/stg/pre-4.15/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,6 @@ selectorSyncSet:
operator: In
values:
- "staging"
- "stage"
Copy link
Contributor

@joshbranham joshbranham Jan 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I doubt this is the case, but would be good to check with fedramp folks to make sure they aren't using stage

- key: hive.openshift.io/version-major-minor
operator: In
values: ["4.11", "4.12", "4.13", "4.14", "4.15", "4.16"]
1 change: 0 additions & 1 deletion hack/00-osd-managed-cluster-config-integration.yaml.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40493,7 +40493,6 @@ objects:
operator: In
values:
- staging
- stage
- key: hive.openshift.io/version-major-minor
operator: In
values:
Expand Down
1 change: 0 additions & 1 deletion hack/00-osd-managed-cluster-config-production.yaml.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40493,7 +40493,6 @@ objects:
operator: In
values:
- staging
- stage
- key: hive.openshift.io/version-major-minor
operator: In
values:
Expand Down
1 change: 0 additions & 1 deletion hack/00-osd-managed-cluster-config-stage.yaml.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40493,7 +40493,6 @@ objects:
operator: In
values:
- staging
- stage
- key: hive.openshift.io/version-major-minor
operator: In
values:
Expand Down
24 changes: 23 additions & 1 deletion scripts/generate_template.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,12 @@
import argparse
import copy
import re
from typing import Any

cluster_platform_ann = "hive.openshift.io/cluster-platform"
config_filename = "config.yaml"
environment_selector = "api.openshift.com/environment"
valid_environments = ["production", "staging", "integration"]

data_sss = []
data_resources = {
Expand Down Expand Up @@ -96,6 +99,7 @@ def add_sss_for(name, directory, config):
# collect the new sss for later processing
data_sss.append(o)


if __name__ == '__main__':
#Argument parser
parser = argparse.ArgumentParser(description="template generation tool", usage='%(prog)s [options]')
Expand Down Expand Up @@ -127,7 +131,7 @@ def add_sss_for(name, directory, config):
deploymentMode = "SelectorSyncSet"

if "deploymentMode" in config:
deploymentMode = config["deploymentMode"]
deploymentMode: str = config["deploymentMode"]

# skip any directory only containing governance policies, as they are only for hypershift
if deploymentMode == "Policy":
Expand Down Expand Up @@ -159,6 +163,24 @@ def add_sss_for(name, directory, config):
print("The selectorsyncset name should be lowercase. Found selectorsyncset with name " + sss_name)
sys.exit(1)

# Verify that environment selectors make sense
sss = config["selectorSyncSet"]
expressions: list[dict[str, Any]] = sss.get("matchExpressions", []) if sss else []
for expression in expressions:
if not expression["key"] == environment_selector:
continue
values: str|list[str] = expression["values"]
match values:
case list(x):
for value in x:
if value not in valid_environments:
raise RuntimeError(f"The environment value {value} for {dirpath} does not match a known environment: must be one of {valid_environments}")
case str(x):
if x not in valid_environments:
raise RuntimeError(f"The environment value {values} for {dirpath} does not match a known environment: must be one of {valid_environments}")
case _:
raise RuntimeError(f"Received invalid values {values} for {dirpath} for key: {environment_selector}")

# If no matchLabelsApplyMode, process as nornmal
if "matchLabelsApplyMode" in config["selectorSyncSet"] and config["selectorSyncSet"]["matchLabelsApplyMode"] == "OR":
# generate new SSS per matchLabels line
Expand Down