WIP: feat: Move Source Hydrator and Commit Server

bundle/manifests/gitops-operator.clusterserviceversion.yaml

@@ -190,7 +190,7 @@ metadata:
     capabilities: Deep Insights
     console.openshift.io/plugins: '["gitops-plugin"]'
     containerImage: quay.io/redhat-developer/gitops-operator
-    createdAt: "2026-07-31T05:20:33Z"
+    createdAt: "2026-08-13T09:28:53Z"
     description: Enables teams to adopt GitOps principles for managing cluster configurations
       and application delivery across hybrid multi-cluster Kubernetes environments.
     features.operators.openshift.io/disconnected: "true"

go.mod

@@ -5,9 +5,10 @@ go 1.26.2
 require (
 	github.com/argoproj-labs/argo-rollouts-manager v0.0.9-0.20260505092152-3e07addcb2cb
 	github.com/argoproj-labs/argocd-image-updater v1.2.1
-	github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260731050707-513e881fcd8e
+	github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260805141109-c13365e8f41d
 	github.com/argoproj/argo-cd/gitops-engine v0.7.1-0.20250908182407-97ad5b59a627
 	github.com/argoproj/argo-cd/v3 v3.4.2
+	github.com/cert-manager/cert-manager v1.20.3
 	github.com/go-logr/logr v1.4.4
 	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.1-0.20241114170450-2d3c2a9cc518
@@ -21,6 +22,7 @@ require (
 	github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.74.0
 	github.com/stretchr/testify v1.11.1
 	go.uber.org/zap v1.28.0
+	golang.org/x/crypto v0.54.0
 	golang.org/x/mod v0.38.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools v2.2.0+incompatible
@@ -58,7 +60,6 @@ require (
 	github.com/casbin/casbin/v2 v2.135.0 // indirect
 	github.com/casbin/govaluate v1.10.0 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
-	github.com/cert-manager/cert-manager v1.20.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chai2010/gettext-go v1.0.3 // indirect
 	github.com/chainguard-dev/git-urls v1.0.2 // indirect
@@ -180,7 +181,6 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.54.0 // indirect
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
 	golang.org/x/net v0.57.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
@@ -210,7 +210,7 @@ require (
 	k8s.io/kube-openapi v0.0.0-20260519202549-bbf5c5577288 // indirect
 	k8s.io/kubectl v0.34.0 // indirect
 	k8s.io/kubernetes v1.34.2 // indirect
-	oras.land/oras-go/v2 v2.6.0 // indirect
+	oras.land/oras-go/v2 v2.6.2 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.33.0 // indirect
 	sigs.k8s.io/gateway-api v1.5.0 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect

go.sum

@@ -43,8 +43,8 @@ github.com/argoproj-labs/argo-rollouts-manager v0.0.9-0.20260505092152-3e07addcb
 github.com/argoproj-labs/argo-rollouts-manager v0.0.9-0.20260505092152-3e07addcb2cb/go.mod h1:Ouqjtkj48SPJhW6r00CYqJ4uM7QDy3D4tinKIK9Y69Q=
 github.com/argoproj-labs/argocd-image-updater v1.2.1 h1:yaJdmpFOOKTkC9688/a7jjOBLpCREj7Wdnmn4A3v1nU=
 github.com/argoproj-labs/argocd-image-updater v1.2.1/go.mod h1:sBS1JqoM9R0QhIDVD4bdWS/GejDQaFwdFUV+yE9TzjA=
-github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260731050707-513e881fcd8e h1:TocoyPvGB+Hf0pWLqIUySr+LsXpK/IylmatMVDLEsBo=
-github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260731050707-513e881fcd8e/go.mod h1:WlaJ1K/BaF0qhltQEoYv8PYwns9/F6/v+dJWMyOi+U0=
+github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260805141109-c13365e8f41d h1:iYXtL9yPDgvXgMswd84SW9Ye9BuzZTrIAVxMoKe9d7Q=
+github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260805141109-c13365e8f41d/go.mod h1:alt7YEhOA0G/am4PZnikVEaZ6m2Y1+zbLIVGKUwBesE=
 github.com/argoproj/argo-cd/gitops-engine v0.0.0-20260512203152-0dc6b1b57dd5 h1:IMzPK0gt1lZRDHtiKGzU0VAez0FmT2veytxlmE2AwyU=
 github.com/argoproj/argo-cd/gitops-engine v0.0.0-20260512203152-0dc6b1b57dd5/go.mod h1:6Q1KZzkeKlnCpzzZ1Fu72+WPMAt+ZeMD9KOO6aMjW68=
 github.com/argoproj/argo-cd/v3 v3.4.2 h1:S3j0K34uGW4geWiM88+0cHcCEtInn2Sa9U7/Sa18L7Y=
@@ -721,8 +721,8 @@ k8s.io/kubernetes v1.34.2 h1:WQdDvYJazkmkwSncgNwGvVtaCt4TYXIU3wSMRgvp3MI=
 k8s.io/kubernetes v1.34.2/go.mod h1:m6pZk6a179pRo2wsTiCPORJ86iOEQmfIzUvtyEF8BwA=
 k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU=
 k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
-oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
-oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
+oras.land/oras-go/v2 v2.6.2 h1:N04RXngAp1LJKTG6ifz3xHPipasEkWr+hFmInja5YKo=
+oras.land/oras-go/v2 v2.6.2/go.mod h1:PlTtg4JTDJkDe8yVHpM2wz7/YDc00GVas+i4jAW2TZ4=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.33.0 h1:qPrZsv1cwQiFeieFlRqT627fVZ+tyfou/+S5S0H5ua0=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.33.0/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
 sigs.k8s.io/controller-runtime v0.23.3 h1:VjB/vhoPoA9l1kEKZHBMnQF33tdCLQKJtydy4iqwZ80=

test/openshift/e2e/ginkgo/fixture/argocd/fixture.go

@@ -82,6 +82,7 @@ func HavePhase(expected string) matcher.GomegaMatcher {
 				"Redis:", argocd.Status.Redis,
 				"Repo:", argocd.Status.Repo,
 				"Server: ", argocd.Status.Server,
+				"CommitServer:", argocd.Status.CommitServer,
 				"ApplicationController:", argocd.Status.ApplicationController,
 				"ApplicationSetController:", argocd.Status.ApplicationSetController,
 				"NotificationsController:", argocd.Status.NotificationsController,
@@ -119,6 +120,13 @@ func HaveServerStatus(status string) matcher.GomegaMatcher {
 	})
 }
 
+func HaveCommitServerStatus(status string) matcher.GomegaMatcher {
+	return fetchArgoCD(func(argocd *argov1beta1api.ArgoCD) bool {
+		GinkgoWriter.Println("HaveCommitServerStatus:", "expected:", status, "/ actual:", argocd.Status.CommitServer)
+		return argocd.Status.CommitServer == status
+	})
+}
+
 func HaveApplicationControllerStatus(status string) matcher.GomegaMatcher {
 	return fetchArgoCD(func(argocd *argov1beta1api.ArgoCD) bool {
 		GinkgoWriter.Println("HaveApplicationControllerStatus:", "expected:", status, "/ actual:", argocd.Status.ApplicationController)

test/openshift/e2e/ginkgo/fixture/fixture.go

@@ -892,7 +892,7 @@ func OutputDebug(namespaceParams ...any) {
 
 	for _, namespace := range namespaces {
 
-		kubectlOutput, err := osFixture.ExecCommandWithOutputParam(false, true, "kubectl", "get", "all", "-n", namespace)
+		kubectlOutput, err := osFixture.ExecCommandWithOutputParam(false, true, "kubectl", "get", "all,serviceaccount", "-n", namespace)
 		if err != nil {
 			GinkgoWriter.Println("unable to list", namespace, err, kubectlOutput)
 			continue

test/openshift/e2e/ginkgo/fixture/gitserver/certs.go

@@ -0,0 +1,79 @@
+package gitserver
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/pem"
+	"fmt"
+	"strings"
+
+	certmanagerv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
+	. "github.com/onsi/gomega"
+	"golang.org/x/crypto/ssh"
+
+	"github.com/argoproj-labs/argocd-operator/controllers/argoutil"
+)
+
+type sshKeyPair struct {
+	privateKeyPEM []byte
+	publicKey     string
+}
+
+func generateSSHKeyPair() sshKeyPair {
+	publicKey, privateKey, err := ed25519.GenerateKey(rand.Reader)
+	Expect(err).NotTo(HaveOccurred())
+
+	sshPublicKey, err := ssh.NewPublicKey(publicKey)
+	Expect(err).NotTo(HaveOccurred())
+
+	privateKeyBlock, err := ssh.MarshalPrivateKey(privateKey, "")
+	Expect(err).NotTo(HaveOccurred())
+
+	return sshKeyPair{
+		privateKeyPEM: pem.EncodeToMemory(privateKeyBlock),
+		publicKey:     string(ssh.MarshalAuthorizedKey(sshPublicKey)),
+	}
+}
+
+func formatSSHKnownHosts(host string, port int32, publicKey ssh.PublicKey) string {
+	keyLine := strings.TrimSpace(string(ssh.MarshalAuthorizedKey(publicKey)))
+	parts := strings.SplitN(keyLine, " ", 3)
+	Expect(len(parts)).To(BeNumerically(">=", 2))
+
+	hostPort := host
+	if port != 22 {
+		hostPort = fmt.Sprintf("[%s]:%d", host, port)
+	}
+	return fmt.Sprintf("%s %s %s\n", hostPort, parts[0], parts[1])
+}
+
+func generateTLSSecretData(domain string, podName string, namespace string) map[string][]byte {
+	key, err := argoutil.NewPrivateKey()
+	Expect(err).NotTo(HaveOccurred())
+
+	caKey, err := argoutil.NewPrivateKey()
+	Expect(err).NotTo(HaveOccurred())
+	caCert, err := argoutil.NewSelfSignedCACertificate(domain, caKey)
+	Expect(err).NotTo(HaveOccurred())
+
+	certSpec := &certmanagerv1.CertificateSpec{
+		CommonName: domain,
+		Subject: &certmanagerv1.X509Subject{
+			Organizations: []string{domain},
+		},
+	}
+	dnsNames := []string{
+		podName,
+		fmt.Sprintf("%s.%s", podName, namespace),
+		fmt.Sprintf("%s.%s.svc", podName, namespace),
+		fmt.Sprintf("%s.%s.svc.cluster.local", podName, namespace),
+	}
+	cert, err := argoutil.NewSignedCertificate(certSpec, dnsNames, key, caCert, caKey)
+	Expect(err).NotTo(HaveOccurred())
+
+	return map[string][]byte{
+		"tls.crt": argoutil.EncodeCertificatePEM(cert),
+		"tls.key": argoutil.EncodePrivateKeyPEM(key),
+		"ca.crt":  argoutil.EncodeCertificatePEM(caCert),
+	}
+}

test/openshift/e2e/ginkgo/fixture/gitserver/gitea.go

@@ -0,0 +1,152 @@
+package gitserver
+
+import (
+	"encoding/base64"
+	"fmt"
+	"strings"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"golang.org/x/crypto/ssh"
+
+	corev1 "k8s.io/api/core/v1"
+
+	argocdutil "github.com/argoproj-labs/argocd-operator/controllers/argocd"
+	osFixture "github.com/argoproj-labs/argocd-operator/tests/ginkgo/fixture/os"
+)
+
+const (
+	giteaImage      = "ghcr.io/go-gitea/gitea:1.26.4-rootless"
+	giteaCustomPath = "/data/gitea"
+)
+
+func giteaEnvVars(domain, internalToken string) []corev1.EnvVar {
+	return []corev1.EnvVar{
+		{Name: "USER_UID", Value: "1000"},
+		{Name: "USER_GID", Value: "1000"},
+		{Name: "GITEA_CUSTOM", Value: giteaCustomPath},
+		{Name: "GITEA_APP_NAME", Value: "Gitea E2E Git Server"},
+		{Name: "GITEA__run_mode", Value: "prod"},
+		{Name: "GITEA__database__DB_TYPE", Value: "sqlite3"},
+		{Name: "GITEA__database__PATH", Value: "/data/gitea/gitea.db"},
+		{Name: "GITEA__repository__DEFAULT_BRANCH", Value: "main"},
+		{Name: "GITEA__server__DOMAIN", Value: domain},
+		{Name: "GITEA__server__SSH_DOMAIN", Value: domain},
+		{Name: "GITEA__server__SSH_USER", Value: giteaSSHLogin},
+		{Name: "GITEA__server__HTTP_PORT", Value: fmt.Sprintf("%d", httpPort)},
+		{Name: "GITEA__server__ROOT_URL", Value: fmt.Sprintf("https://%s:%d/", domain, httpPort)},
+		{Name: "GITEA__server__PROTOCOL", Value: "https"},
+		{Name: "GITEA__server__CERT_FILE", Value: "/etc/gitea/certs/tls.crt"},
+		{Name: "GITEA__server__KEY_FILE", Value: "/etc/gitea/certs/tls.key"},
+		{Name: "GITEA__server__LOCAL_ROOT_URL", Value: fmt.Sprintf("https://127.0.0.1:%d/", httpPort)},
+		{Name: "GITEA__server__START_SSH_SERVER", Value: "true"},
+		{Name: "GITEA__server__SSH_PORT", Value: fmt.Sprintf("%d", sshServicePort)},
+		{Name: "GITEA__server__SSH_LISTEN_PORT", Value: fmt.Sprintf("%d", sshPort)},
+		{Name: "GITEA__server__DISABLE_SSH", Value: "false"},
+		{Name: "GITEA__server__LFS_START_SERVER", Value: "false"},
+		{Name: "GITEA__security__INSTALL_LOCK", Value: "true"},
+		{Name: "GITEA__security__INTERNAL_TOKEN", Value: internalToken},
+		{Name: "GITEA__security__SECRET_KEY", Value: argocdutil.GenerateRandomString(24)},
+		{Name: "GITEA__oauth2__JWT_SECRET", Value: argocdutil.GenerateRandomString(24)},
+		{Name: "GITEA__lfs__LFS_JWT_SECRET", Value: argocdutil.GenerateRandomString(24)},
+		{Name: "GITEA__service__DISABLE_REGISTRATION", Value: "true"},
+		{Name: "GITEA__service__REQUIRE_SIGNIN_VIEW", Value: "false"},
+		{Name: "GITEA__mailer__ENABLED", Value: "false"},
+		{Name: "GITEA__openid__ENABLE_OPENID_SIGNIN", Value: "false"},
+		{Name: "GITEA__openid__ENABLE_OPENID_SIGNUP", Value: "false"},
+	}
+}
+
+func configureGiteaAdmin(server *Server) {
+	By("configuring Gitea admin user and SSH key")
+
+	Eventually(func() error {
+		_, err := execInGiteaPod(server.namespace, "gitea", "admin", "user", "list")
+		return err
+	}, "30s", "5s").Should(Succeed())
+
+	Eventually(func() error {
+		out, err := execInGiteaPod(server.namespace,
+			"gitea", "admin", "user", "create",
+			"--username", gitUsername,
+			"--password", server.httpPassword,
+			"--email", "gituser@test.local",
+			"--admin",
+			"--must-change-password=false",
+		)
+		if err != nil && (strings.Contains(out, "already exists") || strings.Contains(out, "user already")) {
+			return nil
+		}
+		if err != nil {
+			GinkgoWriter.Printf("gitea admin user create failed: %v: %s\n", err, out)
+		}
+		return err
+	}, "30s", "5s").Should(Succeed())
+
+	Eventually(func() error {
+		out, err := giteaAPIPost(server.namespace, server.httpPassword,
+			"/api/v1/user/keys",
+			fmt.Sprintf(`{"title":"e2e-git-ssh-key","key":"%s"}`, strings.TrimSpace(server.sshPublicKey)),
+		)
+		if err != nil && strings.Contains(out, "already") {
+			return nil
+		}
+		if err != nil {
+			GinkgoWriter.Printf("gitea add SSH key failed: %v: %s\n", err, out)
+		}
+		return err
+	}, "30s", "5s").Should(Succeed())
+}
+
+// fetchSSHKnownHosts reads Gitea's generated SSH host public key from the pod and
+// formats it for argocd-ssh-known-hosts-cm.
+func fetchSSHKnownHosts(server *Server) string {
+	const hostPublicKeyPath = "/var/lib/gitea/ssh/gitea.rsa.pub"
+
+	var knownHosts string
+	Eventually(func(g Gomega) {
+		out, err := execInGiteaPod(server.namespace, "cat", hostPublicKeyPath)
+		g.Expect(err).NotTo(HaveOccurred(), out)
+
+		pubKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(strings.TrimSpace(out)))
+		g.Expect(err).NotTo(HaveOccurred(), "parse Gitea SSH host key from %q: %q", hostPublicKeyPath, out)
+
+		knownHosts = formatSSHKnownHosts(server.clusterDomain, sshServicePort, pubKey)
+		g.Expect(knownHosts).NotTo(BeEmpty())
+	}, "2m", "5s").Should(Succeed())
+
+	return knownHosts
+}
+
+func execInGiteaPod(namespace string, args ...string) (string, error) {
+	execArgs := []string{"kubectl", "exec", "-n", namespace, "pod/" + serverName, "-c", serverName, "--"}
+	execArgs = append(execArgs, args...)
+	return osFixture.ExecCommandWithOutputParam(false, false, execArgs...)
+}
+
+func giteaAPIPost(namespace, password, path, body string) (string, error) {
+	auth := base64.StdEncoding.EncodeToString([]byte(gitUsername + ":" + password))
+	return execInGiteaPod(namespace, giteaWgetArgs("Basic "+auth, "POST", path, body)...)
+}
+
+func giteaAPIGet(namespace, password, path string) (string, error) {
+	auth := base64.StdEncoding.EncodeToString([]byte(gitUsername + ":" + password))
+	return execInGiteaPod(namespace, giteaWgetArgs("Basic "+auth, "GET", path, "")...)
+}
+
+func giteaWgetArgs(auth, method, path, body string) []string {
+	args := []string{
+		"wget",
+		"-q", "--no-check-certificate",
+		"--header=Authorization: " + auth,
+		"-O", "-",
+	}
+	if method == "POST" {
+		args = append(args,
+			"--header=Content-Type: application/json",
+			"--post-data="+body,
+		)
+	}
+	args = append(args, fmt.Sprintf("https://127.0.0.1:%d%s", httpPort, path))
+	return args
+}