subscriptions: enable "auto" manageSubscription flag

tsf-subscriptions handles the "auto" value by listing cluster
Subscriptions owned by this Helm release (via lookup and release
annotations) and only merging catalog entries whose name is in
that set.

This allows subscriptions to not be created when it was installed without the installer.

Assisted-by: Claude

rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED

Author: Roming22

installer/charts/_common/_helpers.tpl

@@ -46,7 +46,7 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
 Need deleted labels
 */}}
 {{- define "common.postDeployDeleteLabels" -}}
-helmet.t.t.t.t.t.t.t.t.t.redhat-appstudio.github.com/post-deploy: delete
+helmet.redhat-appstudio.github.com/post-deploy: delete
 {{- end }}
 
 {{/*

installer/charts/tsf-pipelines/Chart.yaml

@@ -7,5 +7,5 @@ version: "0.1.0"
 appVersion: "1.20"
 annotations:
   helmet.redhat-appstudio.github.com/product-name: OpenShift Pipelines
-  helmet.redhat-appstudio.github.com/depends-on: tsf-openshift, tsf-subscriptions
+  helmet.redhat-appstudio.github.com/depends-on: tsf-openshift, tsf-subscriptions, tsf-tas
   helmet.redhat-appstudio.github.com/integrations-required: tas

installer/charts/tsf-subscriptions/templates/_subscriptions.tpl

@@ -10,13 +10,66 @@
   {{- end -}}
   {{- $enabled | toYaml -}}
 {{- end -}}
+{{- /*
+  True if the Subscription object is owned by this Helm release.
+*/ -}}
+{{- define "subscriptions.itemOwnedByRelease" -}}
+  {{- $root := .root -}}
+  {{- $item := .item -}}
+  {{- $meta := $item.metadata | default dict -}}
+  {{- $labels := $meta.labels | default dict -}}
+  {{- $ann := $meta.annotations | default dict -}}
+  {{- $managedBy := index $labels "app.kubernetes.io/managed-by" | default "" -}}
+  {{- $relName := index $ann "meta.helm.sh/release-name" | default "" -}}
+  {{- $relNs := index $ann "meta.helm.sh/release-namespace" | default "" -}}
+  {{- if and (eq $managedBy "Helm") (eq $relName $root.Release.Name) (eq $relNs $root.Release.Namespace) -}}
+true
+  {{- else -}}
+false
+  {{- end -}}
+{{- end -}}
+{{- /*
+  Package names (.spec.name) of Subscriptions on the cluster that belong to this Helm release
+  (cluster-wide list; see subscriptions.itemOwnedByRelease). Used for managed: auto.
+  Renders YAML list; empty when lookup is unavailable (e.g. helm template without cluster).
+*/ -}}
+{{- define "subscriptions.managedSubscriptions" -}}
+  {{- $root := . -}}
+  {{- $names := list -}}
+  {{- $subsList := lookup "operators.coreos.com/v1alpha1" "Subscription" "" "" -}}
+  {{- if and $subsList ($subsList.items | default list) -}}
+    {{- range $item := $subsList.items -}}
+      {{- if eq (include "subscriptions.itemOwnedByRelease" (dict "root" $root "item" $item) | trim) "true" -}}
+        {{- $spec := $item.spec | default dict -}}
+        {{- $pkgName := $spec.name | default "" -}}
+        {{- if $pkgName -}}
+          {{- $names = append $names $pkgName -}}
+        {{- end -}}
+      {{- end -}}
+    {{- end -}}
+  {{- end -}}
+  {{- $names | compact | uniq | toYaml -}}
+{{- end -}}
 {{- /*
   Select the managed subscriptions.
 */ -}}
 {{- define "subscriptions.managed" -}}
   {{- $managed := dict -}}
+  {{- $managedSubscriptions := include "subscriptions.managedSubscriptions" . | fromYaml | default list -}}
   {{- range $k, $v := .Values.subscriptions -}}
-    {{- if $v.managed -}}
+    {{- $isManaged := false -}}
+    {{- if eq $v.managed "auto" -}}
+      {{- if $v.name -}}
+        {{- range $managedSubscriptions -}}
+          {{- if eq . $v.name -}}
+            {{- $isManaged = true -}}
+          {{- end -}}
+        {{- end -}}
+      {{- end -}}
+    {{- else -}}
+      {{- $isManaged = eq $v.managed "true" -}}
+    {{- end -}}
+    {{- if $isManaged -}}
       {{- $managed = merge $managed (dict $k $v) -}}
     {{- end -}}
   {{- end -}}

installer/config.yaml

@@ -15,31 +15,31 @@ tsf:
       enabled: true
       # Uses the installer's namespace.
       properties:
-        manageSubscription: true
-    # Red Hat Trusted Artifact Signer (TAS) enhances software supply chain
-    # security by simplifying cryptographic signing and verification of software
-    # artifacts like container images, binaries, and documents, leveraging an
-    # OpenID Connect (OIDC) provider such as Keycloak for identity-based signing.
-    - name: Trusted Artifact Signer
+        manageSubscription: "auto"
+    # Community Konflux Operator  provides the CRDs for the Trusted Software Factory
+    # platform.
+    - name: Konflux
       enabled: true
-      namespace: tsf-tas
+      namespace: konflux-ui
       properties:
-        manageSubscription: true
+        manageSubscription: "true"
     # Red Hat OpenShift Pipelines is a cloud-native CI/CD (Continuous
     # Integration/Continuous Delivery) solution built on Tekton that automates
     # application delivery and reduces time to market on Red Hat OpenShift.
     - name: OpenShift Pipelines
       enabled: true
       # Uses the installer's namespace.
       properties:
-        manageSubscription: true
-    # Community Konflux Operator  provides the CRDs for the Trusted Software Factory
-    # platform.
-    - name: Konflux
+        manageSubscription: "true"
+    # Red Hat Trusted Artifact Signer (TAS) enhances software supply chain
+    # security by simplifying cryptographic signing and verification of software
+    # artifacts like container images, binaries, and documents, leveraging an
+    # OpenID Connect (OIDC) provider such as Keycloak for identity-based signing.
+    - name: Trusted Artifact Signer
       enabled: true
-      namespace: konflux-ui
+      namespace: tsf-tas
       properties:
-        manageSubscription: true
+        manageSubscription: "true"
     # Red Hat Trusted Profile Analyzer (TPA), which leverages the community-driven
     # Trustification project, helps organizations manage their software supply
     # chain's security by analyzing Software Bills of Materials (SBOMs), vendor
@@ -49,4 +49,4 @@ tsf:
       enabled: true
       namespace: tsf-tpa
       properties:
-        manageSubscription: true
+        manageSubscription: "true"

installer/values.yaml.tpl

@@ -46,7 +46,8 @@ openshift:
 {{- end }}
 {{- if $tpa.Enabled }}
     - {{ $tpa.Namespace }}
-    {{- if $tpa.Properties.manageSubscription }}
+    {{- $tpaMS := dig "manageSubscription" "false" ($tpa.Properties | default dict) -}}
+    {{- if ne $tpaMS "false" }}
     - rhtpa-operator
     {{- end }}
 {{- end }}
@@ -59,25 +60,25 @@ openshift:
 subscriptions:
   konflux:
     enabled: {{ $konflux.Enabled }}
-    managed: {{ and $konflux.Enabled $konflux.Properties.manageSubscription }}
+    managed: '{{ if $konflux.Enabled }}{{ dig "manageSubscription" "auto" ($konflux.Properties | default dict) | toString }}{{ else }}false{{ end }}'
   openshiftCertManager:
     enabled: {{ $certManager.Enabled }}
-    managed: {{ and $certManager.Enabled $certManager.Properties.manageSubscription }}
+    managed: '{{ if $certManager.Enabled }}{{ dig "manageSubscription" "auto" ($certManager.Properties | default dict) | toString }}{{ else }}false{{ end }}'
   openshiftKeycloak:
     enabled: {{ $keycloakEnabled }}
-    managed: {{ $keycloakEnabled }}
+    managed: '{{ $keycloakEnabled }}'
     operatorGroup:
       targetNamespaces:
         - {{ default "empty" $keycloakNamespace }}
   openshiftPipelines:
     enabled: {{ $pipelines.Enabled }}
-    managed: {{ and $pipelines.Enabled $pipelines.Properties.manageSubscription }}
+    managed: '{{ if $pipelines.Enabled }}{{ dig "manageSubscription" "auto" ($pipelines.Properties | default dict) | toString }}{{ else }}false{{ end }}'
   openshiftTrustedArtifactSigner:
     enabled: {{ $tas.Enabled }}
-    managed: {{ and $tas.Enabled $tas.Properties.manageSubscription }}
+    managed: '{{ if $tas.Enabled }}{{ dig "manageSubscription" "auto" ($tas.Properties | default dict) | toString }}{{ else }}false{{ end }}'
   trustedProfileAnalyzer:
     enabled: {{ $tpa.Enabled }}
-    managed: {{ and $tpa.Enabled $tpa.Properties.manageSubscription }}
+    managed: '{{ if $tpa.Enabled }}{{ dig "manageSubscription" "auto" ($tpa.Properties | default dict) | toString }}{{ else }}false{{ end }}'
 
 #
 # tsf-infrastructure