From 3daba04abe33152f9b9ea3f8d7301e09aed059fe Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Tue, 23 Jun 2026 16:27:54 +0530 Subject: [PATCH 01/12] Initital CI automation for GitOps operator support for xKS test assisted-by: ClaudeCode Signed-off-by: Anand Kumar Singh --- .github/workflows/deploy-test.yaml | 57 ++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 .github/workflows/deploy-test.yaml diff --git a/.github/workflows/deploy-test.yaml b/.github/workflows/deploy-test.yaml new file mode 100644 index 00000000000..5b0bbdcae36 --- /dev/null +++ b/.github/workflows/deploy-test.yaml @@ -0,0 +1,57 @@ +name: Build, Push, Deploy and Test on kind + +on: + pull_request: + branches: + - '*' + +env: + IMG: quay.io/redhat-developer/gitops-operator:pr-${{ github.event.pull_request.number }}-${{ github.run_id }} + +jobs: + deploy-test: + name: Build image, deploy to kind cluster and run tests + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Go + uses: actions/setup-go@v5 + with: + go-version-file: 'go.mod' + + - name: Log in to Quay.io + uses: docker/login-action@v3 + with: + registry: quay.io + username: ${{ secrets.QUAY_USERNAME }} + password: ${{ secrets.QUAY_PASSWORD }} + + - name: Build manager image with TTL label + run: | + docker build -t ${{ env.IMG }} --label quay.expires-after=1d . + + - name: Push image to Quay.io + run: | + docker push ${{ env.IMG }} + + - name: Create kind cluster + uses: helm/kind-action@v1 + with: + cluster_name: gitops-test + + - name: Install CRDs + run: | + make install + + - name: Deploy operator + run: | + make deploy IMG=${{ env.IMG }} + + - name: Verify Controller Manager deployment is available + run: | + kubectl wait --for=condition=available --timeout=120s \ + deployment/openshift-gitops-operator-controller-manager \ + -n openshift-gitops-operator + kubectl get pods -n openshift-gitops-operator From 528a7df47fa26efc386b34280111420970aac4a0 Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Tue, 23 Jun 2026 21:18:20 +0530 Subject: [PATCH 02/12] use kind internal registry to deploy assisted-by: ClaudeCode Signed-off-by: Anand Kumar Singh --- .github/workflows/deploy-test.yaml | 25 +++++++++---------------- 1 file changed, 9 insertions(+), 16 deletions(-) diff --git a/.github/workflows/deploy-test.yaml b/.github/workflows/deploy-test.yaml index 5b0bbdcae36..39d2866d491 100644 --- a/.github/workflows/deploy-test.yaml +++ b/.github/workflows/deploy-test.yaml @@ -1,4 +1,4 @@ -name: Build, Push, Deploy and Test on kind +name: Build, Deploy and Test on kind on: pull_request: @@ -6,7 +6,7 @@ on: - '*' env: - IMG: quay.io/redhat-developer/gitops-operator:pr-${{ github.event.pull_request.number }}-${{ github.run_id }} + IMG: gitops-operator:test jobs: deploy-test: @@ -21,25 +21,18 @@ jobs: with: go-version-file: 'go.mod' - - name: Log in to Quay.io - uses: docker/login-action@v3 + - name: Create kind cluster + uses: helm/kind-action@v1 with: - registry: quay.io - username: ${{ secrets.QUAY_USERNAME }} - password: ${{ secrets.QUAY_PASSWORD }} + cluster_name: gitops-test - - name: Build manager image with TTL label + - name: Build manager image run: | - docker build -t ${{ env.IMG }} --label quay.expires-after=1d . + docker build -t ${{ env.IMG }} . - - name: Push image to Quay.io + - name: Load image into kind run: | - docker push ${{ env.IMG }} - - - name: Create kind cluster - uses: helm/kind-action@v1 - with: - cluster_name: gitops-test + kind load docker-image ${{ env.IMG }} --name gitops-test - name: Install CRDs run: | From cc5b2bd6f8a7e5c2ff05d009e9d7535de43aa90c Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Thu, 25 Jun 2026 11:55:46 +0530 Subject: [PATCH 03/12] remove prometheus from make deploy kustomize Signed-off-by: Anand Kumar Singh --- .github/workflows/deploy-test.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/deploy-test.yaml b/.github/workflows/deploy-test.yaml index 39d2866d491..d8d46b4267b 100644 --- a/.github/workflows/deploy-test.yaml +++ b/.github/workflows/deploy-test.yaml @@ -28,7 +28,9 @@ jobs: - name: Build manager image run: | - docker build -t ${{ env.IMG }} . + # comment out prometheus from config/default/kustomization.yaml + sed -i 's|^- ../prometheus|#- ../prometheus|' config/default/kustomization.yaml + make build IMG=${{ env.IMG }} - name: Load image into kind run: | From d02c14c9418e0c436f8161988ae96e501210f54b Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Thu, 25 Jun 2026 12:06:56 +0530 Subject: [PATCH 04/12] minor fix Signed-off-by: Anand Kumar Singh --- .github/workflows/deploy-test.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/deploy-test.yaml b/.github/workflows/deploy-test.yaml index d8d46b4267b..6fc54d3ec09 100644 --- a/.github/workflows/deploy-test.yaml +++ b/.github/workflows/deploy-test.yaml @@ -30,7 +30,7 @@ jobs: run: | # comment out prometheus from config/default/kustomization.yaml sed -i 's|^- ../prometheus|#- ../prometheus|' config/default/kustomization.yaml - make build IMG=${{ env.IMG }} + make docker-build IMG=${{ env.IMG }} - name: Load image into kind run: | From 35a1984d353e190e2e505b3edd91606c9f124c86 Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Thu, 25 Jun 2026 12:27:51 +0530 Subject: [PATCH 05/12] debug commit Signed-off-by: Anand Kumar Singh --- .github/workflows/deploy-test.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/deploy-test.yaml b/.github/workflows/deploy-test.yaml index 6fc54d3ec09..5f105dea8c0 100644 --- a/.github/workflows/deploy-test.yaml +++ b/.github/workflows/deploy-test.yaml @@ -46,7 +46,8 @@ jobs: - name: Verify Controller Manager deployment is available run: | + kubectl get deployment -n openshift-gitops-operator + kubectl describe deployment -n openshift-gitops-operator kubectl wait --for=condition=available --timeout=120s \ deployment/openshift-gitops-operator-controller-manager \ -n openshift-gitops-operator - kubectl get pods -n openshift-gitops-operator From 2da27ae8f4cfc79508e05077df9f25d602c1bf2b Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Mon, 29 Jun 2026 14:58:13 +0530 Subject: [PATCH 06/12] make webhook option with make deploy Signed-off-by: Anand Kumar Singh --- .github/workflows/deploy-test.yaml | 14 +++++++++----- config/default/manager_webhook_patch.yaml | 1 + 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/.github/workflows/deploy-test.yaml b/.github/workflows/deploy-test.yaml index 5f105dea8c0..285931ad22c 100644 --- a/.github/workflows/deploy-test.yaml +++ b/.github/workflows/deploy-test.yaml @@ -14,22 +14,26 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Setup Go - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version-file: 'go.mod' - name: Create kind cluster - uses: helm/kind-action@v1 + uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1 with: cluster_name: gitops-test - - name: Build manager image + - name: Disable webhook and prometheus for non-OCP cluster run: | - # comment out prometheus from config/default/kustomization.yaml + sed -i 's|^- ../webhook|#- ../webhook|' config/default/kustomization.yaml + sed -i 's|^- manager_webhook_patch.yaml|#- manager_webhook_patch.yaml|' config/default/kustomization.yaml sed -i 's|^- ../prometheus|#- ../prometheus|' config/default/kustomization.yaml + + - name: Build manager image + run: | make docker-build IMG=${{ env.IMG }} - name: Load image into kind diff --git a/config/default/manager_webhook_patch.yaml b/config/default/manager_webhook_patch.yaml index 738de350b71..8b4e4aa8d77 100644 --- a/config/default/manager_webhook_patch.yaml +++ b/config/default/manager_webhook_patch.yaml @@ -21,3 +21,4 @@ spec: secret: defaultMode: 420 secretName: webhook-server-cert + optional: true From 17974778405e511130c9af7db15e652f4fadeea7 Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Wed, 1 Jul 2026 11:56:13 +0530 Subject: [PATCH 07/12] update filename, create argocd instance and check for resources to be up Signed-off-by: Anand Kumar Singh --- .github/workflows/deploy-test.yaml | 57 ----------- .github/workflows/kind-ci-automation.yaml | 109 ++++++++++++++++++++++ 2 files changed, 109 insertions(+), 57 deletions(-) delete mode 100644 .github/workflows/deploy-test.yaml create mode 100644 .github/workflows/kind-ci-automation.yaml diff --git a/.github/workflows/deploy-test.yaml b/.github/workflows/deploy-test.yaml deleted file mode 100644 index 285931ad22c..00000000000 --- a/.github/workflows/deploy-test.yaml +++ /dev/null @@ -1,57 +0,0 @@ -name: Build, Deploy and Test on kind - -on: - pull_request: - branches: - - '*' - -env: - IMG: gitops-operator:test - -jobs: - deploy-test: - name: Build image, deploy to kind cluster and run tests - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - - - name: Setup Go - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 - with: - go-version-file: 'go.mod' - - - name: Create kind cluster - uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1 - with: - cluster_name: gitops-test - - - name: Disable webhook and prometheus for non-OCP cluster - run: | - sed -i 's|^- ../webhook|#- ../webhook|' config/default/kustomization.yaml - sed -i 's|^- manager_webhook_patch.yaml|#- manager_webhook_patch.yaml|' config/default/kustomization.yaml - sed -i 's|^- ../prometheus|#- ../prometheus|' config/default/kustomization.yaml - - - name: Build manager image - run: | - make docker-build IMG=${{ env.IMG }} - - - name: Load image into kind - run: | - kind load docker-image ${{ env.IMG }} --name gitops-test - - - name: Install CRDs - run: | - make install - - - name: Deploy operator - run: | - make deploy IMG=${{ env.IMG }} - - - name: Verify Controller Manager deployment is available - run: | - kubectl get deployment -n openshift-gitops-operator - kubectl describe deployment -n openshift-gitops-operator - kubectl wait --for=condition=available --timeout=120s \ - deployment/openshift-gitops-operator-controller-manager \ - -n openshift-gitops-operator diff --git a/.github/workflows/kind-ci-automation.yaml b/.github/workflows/kind-ci-automation.yaml new file mode 100644 index 00000000000..5feb8935d28 --- /dev/null +++ b/.github/workflows/kind-ci-automation.yaml @@ -0,0 +1,109 @@ +name: Build, Deploy and Test on kind + +on: + pull_request: + branches: + - '*' + +env: + IMG: gitops-operator:test + +jobs: + ci-build: + name: Build image, deploy to kind cluster + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + + - name: Setup Go + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 + with: + go-version-file: 'go.mod' + + - name: Create kind cluster + uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1 + with: + cluster_name: gitops-test + + - name: Disable webhook and prometheus for non-OCP cluster + run: | + sed -i 's|^- ../webhook|#- ../webhook|' config/default/kustomization.yaml + sed -i 's|^- manager_webhook_patch.yaml|#- manager_webhook_patch.yaml|' config/default/kustomization.yaml + sed -i 's|^- ../prometheus|#- ../prometheus|' config/default/kustomization.yaml + + - name: Build manager image + run: | + make docker-build IMG=${{ env.IMG }} + + - name: Load image into kind + run: | + kind load docker-image ${{ env.IMG }} --name gitops-test + + - name: Install CRDs + run: | + make install + + - name: Deploy operator + run: | + make deploy IMG=${{ env.IMG }} + + - name: Verify Controller Manager deployment is available + run: | + kubectl get deployment -n openshift-gitops-operator + kubectl describe deployment -n openshift-gitops-operator + kubectl wait --for=condition=available --timeout=120s \ + deployment/openshift-gitops-operator-controller-manager \ + -n openshift-gitops-operator + + - name: Create ArgoCD instance + run: | + kubectl create ns test-argocd + kubectl apply -f - <<'EOF' + apiVersion: argoproj.io/v1beta1 + kind: ArgoCD + metadata: + name: argocd + namespace: test-argocd + EOF + + - name: Wait for ArgoCD component pods to exist + run: | + EXPECTED_LABELS=("argocd-application-controller" "argocd-redis" "argocd-repo-server" "argocd-server") + TIMEOUT=300 + INTERVAL=10 + ELAPSED=0 + + echo "Waiting for ArgoCD component pods to exist in test-argocd..." + while true; do + ALL_EXIST=true + for label in "${EXPECTED_LABELS[@]}"; do + if ! kubectl get pod -n test-argocd -l "app.kubernetes.io/name=${label}" --no-headers 2>/dev/null | grep -q .; then + ALL_EXIST=false + break + fi + done + + if $ALL_EXIST; then + echo "All ArgoCD component pods exist after ${ELAPSED}s." + break + fi + + if [ $ELAPSED -ge $TIMEOUT ]; then + echo "Timed out after ${TIMEOUT}s waiting for ArgoCD pods." + kubectl get pods -n test-argocd + kubectl get argocd -n test-argocd -o yaml + exit 1 + fi + + sleep $INTERVAL + ELAPSED=$((ELAPSED + INTERVAL)) + done + + - name: Verify ArgoCD components are ready + run: | + kubectl get pods -n test-argocd + kubectl wait --for=condition=Ready -n test-argocd pod --timeout=300s \ + -l 'app.kubernetes.io/name in (argocd-application-controller,argocd-redis,argocd-repo-server,argocd-server)' + echo "All ArgoCD components are ready." + kubectl get pods -n test-argocd From b10c42484da28f08db76d32d5411d04c372beb8f Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Wed, 1 Jul 2026 14:17:08 +0530 Subject: [PATCH 08/12] debug ci Signed-off-by: Anand Kumar Singh --- .github/workflows/kind-ci-automation.yaml | 49 +++++++++++++++++++++-- 1 file changed, 45 insertions(+), 4 deletions(-) diff --git a/.github/workflows/kind-ci-automation.yaml b/.github/workflows/kind-ci-automation.yaml index 5feb8935d28..82bd4dbd5d8 100644 --- a/.github/workflows/kind-ci-automation.yaml +++ b/.github/workflows/kind-ci-automation.yaml @@ -26,11 +26,14 @@ jobs: with: cluster_name: gitops-test - - name: Disable webhook and prometheus for non-OCP cluster + - name: Disable webhook and conversion for non-OCP cluster run: | sed -i 's|^- ../webhook|#- ../webhook|' config/default/kustomization.yaml - sed -i 's|^- manager_webhook_patch.yaml|#- manager_webhook_patch.yaml|' config/default/kustomization.yaml - sed -i 's|^- ../prometheus|#- ../prometheus|' config/default/kustomization.yaml + sed -i 's|^- patches/webhook_in_argocds.yaml|#- patches/webhook_in_argocds.yaml|' config/crd/kustomization.yaml + sed -i 's|^- patches/cainjection_in_argocds.yaml|#- patches/cainjection_in_argocds.yaml|' config/crd/kustomization.yaml + echo "=== Verify sed applied ===" + grep -n 'webhook\|prometheus' config/default/kustomization.yaml + grep -n 'patches/' config/crd/kustomization.yaml - name: Build manager image run: | @@ -52,7 +55,7 @@ jobs: run: | kubectl get deployment -n openshift-gitops-operator kubectl describe deployment -n openshift-gitops-operator - kubectl wait --for=condition=available --timeout=120s \ + kubectl wait --for=condition=available --timeout=300s \ deployment/openshift-gitops-operator-controller-manager \ -n openshift-gitops-operator @@ -107,3 +110,41 @@ jobs: -l 'app.kubernetes.io/name in (argocd-application-controller,argocd-redis,argocd-repo-server,argocd-server)' echo "All ArgoCD components are ready." kubectl get pods -n test-argocd + + - name: Collect operator debug info on failure + if: failure() + run: | + echo "=== Deployment status ===" + kubectl get deployment -n openshift-gitops-operator -o wide || true + echo "" + echo "=== Pod status ===" + kubectl get pods -n openshift-gitops-operator -o wide || true + echo "" + echo "=== Pod descriptions ===" + kubectl describe pods -n openshift-gitops-operator || true + echo "" + echo "=== Controller manager logs ===" + kubectl logs deployment/openshift-gitops-operator-controller-manager \ + -n openshift-gitops-operator --all-containers=true --tail=200 || true + echo "" + echo "=== Events in operator namespace ===" + kubectl get events -n openshift-gitops-operator --sort-by='.lastTimestamp' || true + echo "" + echo "=== CRD conversion config ===" + kubectl get crd argocds.argoproj.io -o jsonpath='{.spec.conversion}' || true + echo "" + + - name: Collect ArgoCD debug info on failure + if: failure() + run: | + echo "=== ArgoCD resources ===" + kubectl get argocds -n test-argocd -o yaml 2>/dev/null || true + echo "" + echo "=== Pods in test-argocd ===" + kubectl get pods -n test-argocd -o wide 2>/dev/null || true + echo "" + echo "=== Pod descriptions in test-argocd ===" + kubectl describe pods -n test-argocd 2>/dev/null || true + echo "" + echo "=== Events in test-argocd ===" + kubectl get events -n test-argocd --sort-by='.lastTimestamp' 2>/dev/null || true From a9b3dbd7c9e253a82b3adc33f2c04440ca5e88e7 Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Wed, 1 Jul 2026 14:26:46 +0530 Subject: [PATCH 09/12] comment prometheus Signed-off-by: Anand Kumar Singh --- .github/workflows/kind-ci-automation.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/kind-ci-automation.yaml b/.github/workflows/kind-ci-automation.yaml index 82bd4dbd5d8..6f948079b82 100644 --- a/.github/workflows/kind-ci-automation.yaml +++ b/.github/workflows/kind-ci-automation.yaml @@ -28,6 +28,7 @@ jobs: - name: Disable webhook and conversion for non-OCP cluster run: | + sed -i 's|^- ../prometheus|#- ../prometheus|' config/default/kustomization.yaml sed -i 's|^- ../webhook|#- ../webhook|' config/default/kustomization.yaml sed -i 's|^- patches/webhook_in_argocds.yaml|#- patches/webhook_in_argocds.yaml|' config/crd/kustomization.yaml sed -i 's|^- patches/cainjection_in_argocds.yaml|#- patches/cainjection_in_argocds.yaml|' config/crd/kustomization.yaml From cbc80d1ad0ea24bcbe30d2b556aedfbf17f0495d Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Thu, 2 Jul 2026 13:30:21 +0530 Subject: [PATCH 10/12] debug Signed-off-by: Anand Kumar Singh --- .github/workflows/kind-ci-automation.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/kind-ci-automation.yaml b/.github/workflows/kind-ci-automation.yaml index 6f948079b82..daf937ca518 100644 --- a/.github/workflows/kind-ci-automation.yaml +++ b/.github/workflows/kind-ci-automation.yaml @@ -50,7 +50,8 @@ jobs: - name: Deploy operator run: | - make deploy IMG=${{ env.IMG }} + echo "manifests: $(KUSTOMIZE) build config/default" + make deploy IMG=${{ env.IMG }} | tee /tmp/deploy.log - name: Verify Controller Manager deployment is available run: | From f565daa2c8423fe14ec19c51526664fe53be5bb7 Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Thu, 2 Jul 2026 17:05:21 +0530 Subject: [PATCH 11/12] make metrics-cert optional Signed-off-by: Anand Kumar Singh --- config/manager/manager.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml index d3da79874bc..ba3aaf50156 100644 --- a/config/manager/manager.yaml +++ b/config/manager/manager.yaml @@ -70,5 +70,6 @@ spec: - name: metrics-certs secret: secretName: openshift-gitops-operator-metrics-tls + optional: true serviceAccountName: controller-manager terminationGracePeriodSeconds: 10 \ No newline at end of file From d78b34155a49a1d75d8432561450ffda16e9b1c8 Mon Sep 17 00:00:00 2001 From: Anand Kumar Singh Date: Mon, 6 Jul 2026 09:16:22 +0530 Subject: [PATCH 12/12] adress comments Signed-off-by: Anand Kumar Singh --- .github/workflows/kind-ci-automation.yaml | 4 +++- bundle/manifests/gitops-operator.clusterserviceversion.yaml | 3 ++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/kind-ci-automation.yaml b/.github/workflows/kind-ci-automation.yaml index daf937ca518..d21f8f2d4c8 100644 --- a/.github/workflows/kind-ci-automation.yaml +++ b/.github/workflows/kind-ci-automation.yaml @@ -3,7 +3,8 @@ name: Build, Deploy and Test on kind on: pull_request: branches: - - '*' + - "master" + - "v*" env: IMG: gitops-operator:test @@ -26,6 +27,7 @@ jobs: with: cluster_name: gitops-test + # TODO: check if porting is required for non-OCP clusters - name: Disable webhook and conversion for non-OCP cluster run: | sed -i 's|^- ../prometheus|#- ../prometheus|' config/default/kustomization.yaml diff --git a/bundle/manifests/gitops-operator.clusterserviceversion.yaml b/bundle/manifests/gitops-operator.clusterserviceversion.yaml index 466417f6ea3..cb42eba81eb 100644 --- a/bundle/manifests/gitops-operator.clusterserviceversion.yaml +++ b/bundle/manifests/gitops-operator.clusterserviceversion.yaml @@ -190,7 +190,7 @@ metadata: capabilities: Deep Insights console.openshift.io/plugins: '["gitops-plugin"]' containerImage: quay.io/redhat-developer/gitops-operator - createdAt: "2026-06-30T06:15:57Z" + createdAt: "2026-07-02T15:48:02Z" description: Enables teams to adopt GitOps principles for managing cluster configurations and application delivery across hybrid multi-cluster Kubernetes environments. features.operators.openshift.io/disconnected: "true" @@ -922,6 +922,7 @@ spec: volumes: - name: metrics-certs secret: + optional: true secretName: openshift-gitops-operator-metrics-tls permissions: - rules: