mbp-1188: Enable consolidated Argo CD instances

README.md

@@ -197,10 +197,9 @@ The [pattern.sh](pattern.sh) script is used to deploy the Layered Zero Trust Val
 
 Once the pattern has been successfully deployed, you can review the deployed components. Each are deployed and managed using OpenShift GitOps.
 
-Two (2) instances of OpenShift GitOps has been deployed to your Hub Cluster. Each can be seen within the OpenShift Console by selecting the Application Selector at the top navigation bar (box with 9 smaller squares).
+One instance of OpenShift GitOps is deployed to your Hub Cluster. It can be seen within the OpenShift Console by selecting the Application Selector at the top navigation bar (box with 9 smaller squares).
 
-1. Cluster Argo CD - Deploys an Argo CD App of Apps Application called _layered-zero-trust-hub_ which deploys the components associated with the pattern. These _Applications_ are managed by the Hub Argo CD instance (see below)
-2. Hub Argo CD - Manages the individual components associated with the pattern on the Hub OpenShift instance.
+The consolidated Argo CD instance (namespace `vp-gitops`) manages all pattern applications.
 
 If all of the Argo CD applications are reporting healthy, the pattern has been deployed successfully.
 

charts/rh-keycloak/templates/cleanup-keycloak-setup.yaml

@@ -21,6 +21,9 @@ rules:
 - apiGroups: [""]
   resources: ["secrets"]
   verbs: ["list", "delete"]
+- apiGroups: ["k8s.keycloak.org"]
+  resources: ["keycloakrealmimports"]
+  verbs: ["get"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -49,7 +52,7 @@ metadata:
     argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
 spec:
   backoffLimit: 2
-  activeDeadlineSeconds: 120
+  activeDeadlineSeconds: 600
   template:
     metadata:
       labels:
@@ -64,6 +67,35 @@ spec:
         - /bin/bash
         - -ce
         - |
-          oc delete secret -l "validatedpatterns.io/cleanup=delete" -n "{{ .Release.Namespace }}" --ignore-not-found
+          echo "Waiting for ztvp-realm-import to complete before cleanup..."
+          TIMEOUT=540
+          ELAPSED=0
+          IMPORT_DONE=false
+          while [ $ELAPSED -lt $TIMEOUT ]; do
+            DONE=$(oc get keycloakrealmimport ztvp-realm-import \
+              -n "{{ .Release.Namespace }}" \
+              -o jsonpath='{.status.conditions[?(@.type=="Done")].status}' 2>/dev/null || echo "")
+            ERRORS=$(oc get keycloakrealmimport ztvp-realm-import \
+              -n "{{ .Release.Namespace }}" \
+              -o jsonpath='{.status.conditions[?(@.type=="HasErrors")].status}' 2>/dev/null || echo "")
+            if [ "$DONE" = "True" ]; then
+              echo "Realm import finished successfully"
+              IMPORT_DONE=true
+              break
+            fi
+            if [ "$ERRORS" = "True" ]; then
+              echo "Realm import has errors (${ELAPSED}s elapsed) — keeping secrets so the Job can retry, waiting 15s..."
+            else
+              echo "Realm import still in progress (${ELAPSED}s elapsed), waiting 15s..."
+            fi
+            sleep 15
+            ELAPSED=$((ELAPSED + 15))
+          done
+          if [ "$IMPORT_DONE" != "true" ]; then
+            echo "Timeout waiting for realm import (Done never became True). Leaving secrets intact — retry this hook after the import completes." >&2
+            exit 1
+          fi
+          oc delete secret -l "validatedpatterns.io/cleanup=delete" \
+            -n "{{ .Release.Namespace }}" --ignore-not-found
           echo "Cleanup complete."
 {{- end }}

docs/oidc/entraid.md

@@ -489,7 +489,7 @@ When the pipeline reaches any of these tasks, we will need to follow these steps
 ##### Using the OpenShift Web UI
 
 1. Select **Pipelines -> Pipelines** from the left hand navigation bar.
-2. Locate the **qtodo-supply-chain** pipeline. It's within the **layered-zero-trust-hub** project.
+2. Locate the **qtodo-supply-chain** pipeline. It's within the **vp-gitops** project.
 3. Select the last `PipelineRun` or start a new one.
 4. On the logs tab, select the signing task: `qtodo-sign-artifact`, `qtodo-sign-image` or `qtodo-sbom-attestation`
 5. In the log box, on the last lines, you can get the verification code.
@@ -499,24 +499,24 @@ When the pipeline reaches any of these tasks, we will need to follow these steps
 
 ##### Using the OpenShift CLI
 
-1. List the `TaskRuns` in the namespace **layered-zero-trust-hub**.
+1. List the `TaskRuns` in the namespace **vp-gitops**.
 
     ```shell
-    oc get taskrun -n layered-zero-trust-hub
+    oc get taskrun -n vp-gitops
     ```
 
 2. Continue monitoring the status of the tasks until one of the signing tasks (`qtodo-sign-artifact`, `qtodo-sign-image` or `qtodo-sbom-attestation`) starts.
 3. For each signing task, obtain the verification code and verify it using a Web browser:
 
     ```shell
-    export SIGN_ARTIFACT_POD=$(oc get taskrun -n layered-zero-trust-hub -l tekton.dev/pipelineTask=qtodo-sign-artifact -o jsonpath='{ .items[0].status.podName }')
-    oc logs -n layered-zero-trust-hub ${SIGN_ARTIFACT_POD} | grep 'verification code'
+    export SIGN_ARTIFACT_POD=$(oc get taskrun -n vp-gitops -l tekton.dev/pipelineTask=qtodo-sign-artifact -o jsonpath='{ .items[0].status.podName }')
+    oc logs -n vp-gitops ${SIGN_ARTIFACT_POD} | grep 'verification code'
 
-    export SIGN_IMAGE_POD=$(oc get taskrun -n layered-zero-trust-hub -l tekton.dev/pipelineTask=qtodo-sign-image -o jsonpath='{ .items[0].status.podName }')
-    oc logs -n layered-zero-trust-hub ${SIGN_IMAGE_POD} | grep 'verification code'
+    export SIGN_IMAGE_POD=$(oc get taskrun -n vp-gitops -l tekton.dev/pipelineTask=qtodo-sign-image -o jsonpath='{ .items[0].status.podName }')
+    oc logs -n vp-gitops ${SIGN_IMAGE_POD} | grep 'verification code'
 
-    export SIGN_SBOM_POD=$(oc get taskrun -n layered-zero-trust-hub -l tekton.dev/pipelineTask=qtodo-sbom-attestation -o jsonpath='{ .items[0].status.podName }')
-    oc logs -n layered-zero-trust-hub ${SIGN_SBOM_POD} | grep 'verification code'
+    export SIGN_SBOM_POD=$(oc get taskrun -n vp-gitops -l tekton.dev/pipelineTask=qtodo-sbom-attestation -o jsonpath='{ .items[0].status.podName }')
+    oc logs -n vp-gitops ${SIGN_SBOM_POD} | grep 'verification code'
     ```
 
 4. Go to [https://login.microsoft.com/device](https://login.microsoft.com/device) and enter the verification code
@@ -827,7 +827,7 @@ vault_jwt_roles:
 **Key Parameters**:
 
 * **audience**: Internal identifier for supply chain Vault authentication (`supply-chain`)
-* **subject**: The SPIFFE ID of the Tekton pipeline service account (e.g., `spiffe://apps.<domain>/ns/layered-zero-trust-hub/sa/pipeline`)
+* **subject**: The SPIFFE ID of the Tekton pipeline service account (e.g., `spiffe://apps.<domain>/ns/vp-gitops/sa/pipeline`)
 * **policies**: Vault policies granting access to supply chain secrets
 
 **Vault Policy for Supply Chain**:

docs/supply-chain.md

@@ -261,7 +261,7 @@ Once the supply-chain application has synced in Argo CD, start the pipeline usin
 
 1. Launch the OpenShift Web console.
 2. Select **Pipelines -> Pipelines** from the left hand navigation bar.
-3. Locate the **qtodo-supply-chain** pipeline. It's within the **layered-zero-trust-hub** project.
+3. Locate the **qtodo-supply-chain** pipeline. It's within the **vp-gitops** project.
 4. In the kebab menu (three vertical dots) from the right-hand, select **Start**.
 
    Review the configurable parameters. Most parameters should be correct with their default values if we are in single-cluster mode. But, double-check their values just in case.
@@ -287,7 +287,7 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   generateName: qtodo-manual-run-
-  namespace: layered-zero-trust-hub
+  namespace: vp-gitops
 spec:
   pipelineRef:
     name: qtodo-supply-chain
@@ -318,7 +318,7 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   generateName: qtodo-manual-run-
-  namespace: layered-zero-trust-hub
+  namespace: vp-gitops
 spec:
   pipelineRef:
     name: qtodo-supply-chain
@@ -348,20 +348,20 @@ oc create -f qtodo-pipeline.yaml
 You can review the current pipeline logs using the [Tekton CLI](https://tekton.dev/docs/cli/).
 
 ```shell
-tkn pipeline logs -n layered-zero-trust-hub -L -f
+tkn pipeline logs -n vp-gitops -L -f
 ```
 
 Or use `oc` commands to monitor progress:
 
 ```shell
 # List pipeline runs
-oc get pipelinerun -n layered-zero-trust-hub
+oc get pipelinerun -n vp-gitops
 
 # Check task status for a specific run
-oc get taskruns -n layered-zero-trust-hub -l tekton.dev/pipelineRun=<pipelinerun-name>
+oc get taskruns -n vp-gitops -l tekton.dev/pipelineRun=<pipelinerun-name>
 
 # View logs for a specific task
-oc logs -n layered-zero-trust-hub -l tekton.dev/pipelineRun=<pipelinerun-name>,tekton.dev/pipelineTask=<task-name>
+oc logs -n vp-gitops -l tekton.dev/pipelineRun=<pipelinerun-name>,tekton.dev/pipelineTask=<task-name>
 ```
 
 ### Protected Repositories
@@ -498,7 +498,7 @@ This section applies whenever the pipeline clones from a Git server whose TLS ce
 
 When a repository is hosted on an internal Git server (e.g. GitLab behind a corporate CA), the `git-clone` task will fail with `SSL certificate problem: self-signed certificate in certificate chain` because the pod does not trust the corporate CA.
 
-The `ztvp-certificates` chart already extracts and distributes the cluster's CA bundle (ingress, service, and any custom/corporate CAs). When the `supply-chain` feature is enabled, the `ztvp-trusted-ca` ConfigMap is automatically distributed to the pipeline namespace (`layered-zero-trust-hub`) via ACM policy.
+The `ztvp-certificates` chart already extracts and distributes the cluster's CA bundle (ingress, service, and any custom/corporate CAs). When the `supply-chain` feature is enabled, the `ztvp-trusted-ca` ConfigMap is automatically distributed to the pipeline namespace (`vp-gitops`) via ACM policy.
 
 To make the `git-clone` task use this CA bundle, enable the SSL CA bundle mount in the `supply-chain` application overrides:
 
@@ -553,7 +553,7 @@ The pipeline we have prepared has the following steps:
 
 1. Launch the OpenShift Web console.
 2. Select **Pipelines -> Pipelines** from the left hand navigation bar.
-3. Locate the **qtodo-supply-chain** pipeline (**layered-zero-trust-hub** project).
+3. Locate the **qtodo-supply-chain** pipeline (**vp-gitops** project).
 4. Select the **PipelineRun** link in the column **Last run**.
 5. In the **Details** tab we can see a summary of the pipeline execution and tasks.
 6. By **clicking** on each individual task, or on the **Logs** tab, we can see the output of the tasks.
@@ -563,7 +563,7 @@ The pipeline we have prepared has the following steps:
 The first thing we'll check is whether our pipeline has finished successfully.
 
 ```shell
-oc get pipelinerun -n layered-zero-trust-hub
+oc get pipelinerun -n vp-gitops
 
 NAME                        SUCCEEDED   REASON      STARTTIME   COMPLETIONTIME
 qtodo-manual-run-p46f7      True        Succeeded   7m4s        2m12s
@@ -572,7 +572,7 @@ qtodo-manual-run-p46f7      True        Succeeded   7m4s        2m12s
 We can see the individual result of each step by reviewing the `TaskRuns`.
 
 ```shell
-oc get taskruns -n layered-zero-trust-hub
+oc get taskruns -n vp-gitops
 
 NAME                                               SUCCEEDED   REASON             STARTTIME   COMPLETIONTIME
 qtodo-manual-run-p46f7-qtodo-build-artifact        True        Succeeded          7m44s       5m17s
@@ -587,10 +587,10 @@ qtodo-manual-run-p46f7-qtodo-verify-artifact       True        Succeeded
 qtodo-manual-run-p46f7-qtodo-verify-image          True        Succeeded          3m22s       3m3s
 ```
 
-Tasks run as pods within OpenShift. We can find these pods in the namespace `layered-zero-trust-hub`.
+Tasks run as pods within OpenShift. We can find these pods in the namespace `vp-gitops`.
 
 ```shell
-oc get pods -n layered-zero-trust-hub
+oc get pods -n vp-gitops
 
 NAME                                                    READY   STATUS      RESTARTS   AGE
 qtodo-manual-run-p46f7-qtodo-build-artifact-pod         0/1     Completed   0          10m
@@ -608,7 +608,7 @@ qtodo-manual-run-p46f7-qtodo-verify-image-pod           0/1     Completed   0
 If we want to see the output of a particular step, we can view this information in the pod logs. For example, let's look at the image verification messages:
 
 ```shell
-oc logs -n layered-zero-trust-hub qtodo-manual-run-p46f7-qtodo-verify-image-pod
+oc logs -n vp-gitops qtodo-manual-run-p46f7-qtodo-verify-image-pod
 
 Success: true
 Result: SUCCESS
@@ -649,7 +649,7 @@ The credentials to access the Quay web interface can be obtained as follows:
 * Quay password:
 
   ```shell
-  oc get secret -n layered-zero-trust-hub qtodo-quay-password -o json | jq '.data["password"] | @base64d'
+  oc get secret -n vp-gitops qtodo-quay-password -o json | jq '.data["password"] | @base64d'
   ```
 
 Now that we have the credentials, we can check the content in Quay.

overrides/values-vault-network-policy.yaml

@@ -33,7 +33,7 @@ vault:
                 job-name: registry-token-refresher-seed
             namespaceSelector:
               matchLabels:
-                kubernetes.io/metadata.name: layered-zero-trust-hub
+                kubernetes.io/metadata.name: vp-gitops
         # registry-token-refresher CronJob — periodic token refresh to Vault
         - ports:
           - protocol: TCP
@@ -44,7 +44,7 @@ vault:
                 app.kubernetes.io/name: registry-token-refresher
             namespaceSelector:
               matchLabels:
-                kubernetes.io/metadata.name: layered-zero-trust-hub
+                kubernetes.io/metadata.name: vp-gitops
         # Vault cluster replication port — HA readiness
         - ports:
           - protocol: TCP

scripts/gen-imageset-config.py

@@ -177,7 +177,7 @@ def get_workload_namespaces() -> set:
 
     Namespaces with the argocd.argoproj.io/managed-by label are ZTVP workload
     namespaces.  The label value is the ArgoCD instance namespace itself
-    (e.g. layered-zero-trust-hub), which we exclude since it contains ArgoCD
+    (e.g. vp-gitops), which we exclude since it contains ArgoCD
     infrastructure images already covered by the GitOps operator catalog.
     """
     # Always include these regardless of ArgoCD labels

tests/interop/test_validate_hub_site_components.py

@@ -71,7 +71,7 @@ def test_validate_argocd_reachable_hub_site(openshift_dyn_client):
 @pytest.mark.validate_argocd_applications_health_hub_site
 def test_validate_argocd_applications_health_hub_site(openshift_dyn_client):
     logger.info("Get all applications deployed by argocd on hub site")
-    projects = ["openshift-gitops", "layered-zero-trust-hub"]
+    projects = ["openshift-gitops", "vp-gitops"]
     unhealthy_apps = application.get_argocd_application_status(
         openshift_dyn_client, projects
     )

values-global.yaml

@@ -1,6 +1,7 @@
 ---
 global:
   pattern: layered-zero-trust
+  singleArgoCD: true
   options:
     useCSV: false
     syncPolicy: Automatic