From 9f4dc42969d576303fbf97e4a7aed32ba7e00853 Mon Sep 17 00:00:00 2001 From: OAharoni-RedHat Date: Mon, 9 Nov 2026 11:02:32 -0500 Subject: [PATCH 1/2] feat: add byoc to mcg --- values-secret.yaml.template | 24 ++++++++++++++++++++++++ variants/hub/values-hub.yaml | 28 ++++++++++++++++++++++++++-- 2 files changed, 50 insertions(+), 2 deletions(-) diff --git a/values-secret.yaml.template b/values-secret.yaml.template index c068200f3..34c922504 100644 --- a/values-secret.yaml.template +++ b/values-secret.yaml.template @@ -38,3 +38,27 @@ secrets: # fields: # - name: content # path: ~/.pullsecret.json + + # Bring-your-own clusters: load kubeconfigs into Vault on the hub, then + # enable import via acm.importedClusters in variants/hub/values-hub.yaml. + # Secret names MUST end with _cluster_kubeconfig; the ManagedCluster name is the + # remainder (e.g. mcg-primary_cluster_kubeconfig -> mcg-primary). + # Example enablement in values-hub.yaml (passed through to the ACM chart): + # acm: + # importedClusters: + # - secretName: mcg-primary_cluster_kubeconfig + # clusterGroup: group-one + # The clusterGroup label must match an existing managedClusterGroups Placement + # (MCG already defines group-one). + #- name: mcg-primary_cluster_kubeconfig + # vaultPrefixes: + # - hub + # fields: + # - name: kubeconfig + # path: /path/to/primary.kubeconfig + #- name: mcg-secondary_cluster_kubeconfig + # vaultPrefixes: + # - hub + # fields: + # - name: kubeconfig + # path: /path/to/secondary.kubeconfig diff --git a/variants/hub/values-hub.yaml b/variants/hub/values-hub.yaml index 9b29943ab..a220e06ec 100644 --- a/variants/hub/values-hub.yaml +++ b/variants/hub/values-hub.yaml @@ -50,8 +50,19 @@ clusterGroup: name: acm namespace: open-cluster-management argoProject: hub - chart: acm - chartVersion: 0.2.* + # Test BYOC import against the fork instead of charts.validatedpatterns.io + repoURL: https://github.com/OAharoni-RedHat/acm-chart.git + path: . + chartVersion: main + # ACM mutates ManagedCluster labels/spec after import (cloud/vendor discovery, + # addon feature labels, clusterset, managedClusterClientConfigs). Ignore those + # so the ACM app stays Synced while still owning clusterGroup via the chart. + ignoreDifferences: + - group: cluster.open-cluster-management.io + kind: ManagedCluster + jqPathExpressions: + - .metadata.labels | with_entries(select(.key != "clusterGroup")) + - .spec.managedClusterClientConfigs vault: name: vault namespace: vault @@ -123,6 +134,19 @@ clusterGroup: # clusters: # - Two # - Three + +# Optional: auto-import existing (BYOC) clusters into ACM. Requires matching +# kubeconfig secrets in values-secret (vaultPrefixes: hub; name must end with +# _cluster_kubeconfig — see values-secret.yaml.template). Cluster name is +# secretName with that suffix removed. clusterGroup must match a +# managedClusterGroups Placement label above (e.g. group-one) so policies attach. +acm: + importedClusters: + - secretName: mcg-primary_cluster_kubeconfig + clusterGroup: group-one +# - secretName: mcg-secondary_cluster_kubeconfig +# clusterGroup: group-one + # To have apps in multiple flavors, use namespaces and use helm overrides as appropriate # # pipelines: From 5b249b49c4a727d4325f5a0c8cd7aefcda3f5db6 Mon Sep 17 00:00:00 2001 From: OAharoni-RedHat Date: Mon, 9 Nov 2026 14:25:12 -0500 Subject: [PATCH 2/2] fix rebase --- overrides/values-imported-clusters.yaml | 15 +++++++++++++++ values-secret.yaml.template | 14 +++----------- variants/hub/values-hub.yaml | 21 +++++---------------- 3 files changed, 23 insertions(+), 27 deletions(-) create mode 100644 overrides/values-imported-clusters.yaml diff --git a/overrides/values-imported-clusters.yaml b/overrides/values-imported-clusters.yaml new file mode 100644 index 000000000..ac0987793 --- /dev/null +++ b/overrides/values-imported-clusters.yaml @@ -0,0 +1,15 @@ +# Auto-import existing (BYOC) clusters into ACM via the ACM chart. +# Requires matching kubeconfig secrets in values-secret (vaultPrefixes: hub; +# name must end with _cluster_kubeconfig — see values-secret.yaml.template). +# Cluster name is secretName with that suffix removed. +# clusterGroup must match a managedClusterGroups Placement label +# (e.g. group-one in variants/hub/values-hub.yaml) so policies attach. +# +# This file is included by the ACM application via extraValueFiles. +# To enable its usage, uncomment the following lines. +# acm: +# importedClusters: +# - secretName: mcg-primary_cluster_kubeconfig +# clusterGroup: group-one + # - secretName: mcg-secondary_cluster_kubeconfig + # clusterGroup: group-one diff --git a/values-secret.yaml.template b/values-secret.yaml.template index 34c922504..26aa9ba6a 100644 --- a/values-secret.yaml.template +++ b/values-secret.yaml.template @@ -39,26 +39,18 @@ secrets: # - name: content # path: ~/.pullsecret.json - # Bring-your-own clusters: load kubeconfigs into Vault on the hub, then - # enable import via acm.importedClusters in variants/hub/values-hub.yaml. + # Bring-your-own clusters: load kubeconfigs into Vault on the hub, then list + # them under acm.importedClusters in overrides/values-imported-clusters.yaml + # (wired to the ACM app via extraValueFiles in variants/hub/values-hub.yaml). # Secret names MUST end with _cluster_kubeconfig; the ManagedCluster name is the # remainder (e.g. mcg-primary_cluster_kubeconfig -> mcg-primary). - # Example enablement in values-hub.yaml (passed through to the ACM chart): - # acm: - # importedClusters: - # - secretName: mcg-primary_cluster_kubeconfig - # clusterGroup: group-one # The clusterGroup label must match an existing managedClusterGroups Placement # (MCG already defines group-one). #- name: mcg-primary_cluster_kubeconfig - # vaultPrefixes: - # - hub # fields: # - name: kubeconfig # path: /path/to/primary.kubeconfig #- name: mcg-secondary_cluster_kubeconfig - # vaultPrefixes: - # - hub # fields: # - name: kubeconfig # path: /path/to/secondary.kubeconfig diff --git a/variants/hub/values-hub.yaml b/variants/hub/values-hub.yaml index a220e06ec..4fc95a304 100644 --- a/variants/hub/values-hub.yaml +++ b/variants/hub/values-hub.yaml @@ -50,10 +50,11 @@ clusterGroup: name: acm namespace: open-cluster-management argoProject: hub - # Test BYOC import against the fork instead of charts.validatedpatterns.io - repoURL: https://github.com/OAharoni-RedHat/acm-chart.git - path: . - chartVersion: main + chart: acm + chartVersion: 0.2.* + # BYOC importedClusters list lives here (not in values-hub body) + extraValueFiles: + - '/overrides/values-imported-clusters.yaml' # ACM mutates ManagedCluster labels/spec after import (cloud/vendor discovery, # addon feature labels, clusterset, managedClusterClientConfigs). Ignore those # so the ACM app stays Synced while still owning clusterGroup via the chart. @@ -135,18 +136,6 @@ clusterGroup: # - Two # - Three -# Optional: auto-import existing (BYOC) clusters into ACM. Requires matching -# kubeconfig secrets in values-secret (vaultPrefixes: hub; name must end with -# _cluster_kubeconfig — see values-secret.yaml.template). Cluster name is -# secretName with that suffix removed. clusterGroup must match a -# managedClusterGroups Placement label above (e.g. group-one) so policies attach. -acm: - importedClusters: - - secretName: mcg-primary_cluster_kubeconfig - clusterGroup: group-one -# - secretName: mcg-secondary_cluster_kubeconfig -# clusterGroup: group-one - # To have apps in multiple flavors, use namespaces and use helm overrides as appropriate # # pipelines: