fix: omit nonResourceURLs from namespaced Roles

[alkakumari016]

What type of PR is this?
/kind bug

What does this PR do / why we need it:
The application-controller Role copies rules from the aggregated admin ClusterRole. Third-party ClusterRoles labeled aggregate-to-admin can contribute nonResourceURLs, which are illegal on a Role, so the API server rejects it and Argo CD reconcile hard-fails (including Dex / OpenShift OAuth).

This PR fixes that by stripping nonResourceURLs from the namespace role while copying from admin ClusterRole.

Have you updated the necessary documentation?

• Documentation update is required by this PR.
• Documentation has been updated.

Which issue(s) this PR fixes:

Fixes #?
argoproj-labs/argocd-operator#2269
https://redhat.atlassian.net/browse/GITOPS-10618
Test acceptance criteria:

• Unit Test
• E2E Test

How to test changes / Special notes to the reviewer:
Steps to Reproduce

Install the affected version of the OpenShift GitOps Operator 1.19.3.

Create a ClusterRole with the aggregate-to-admin label and a nonResourceURLs rule:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: test-aggregated-admin-role
labels:
rbac.authorization.k8s.io/aggregate-to-admin: "true"
rules:

• nonResourceURLs:
  • '*'
    verbs:
  • get

Apply the ClusterRole:

oc apply -f test-aggregated-admin-role.yaml

Verify that the nonResourceURLs rule is propagated to the aggregated admin ClusterRole:

oc get clusterrole admin -o yaml

Create or reconcile an Argo CD instance managed by the OpenShift GitOps Operator.

Observe that the GitOps Operator attempts to create/update the namespaced Role:

openshift-gitops-argocd-application-controller

The reconciliation fails with:

Role.rbac.authorization.k8s.io "openshift-gitops-argocd-application-controller" is invalid:
rules[814].nonResourceURLs: Invalid value: []string{"*"}:
namespaced rules cannot apply to non-resource URLs

Expected Result

The GitOps Operator should not copy the nonResourceURLs rule into the namespaced Application Controller Role. Argo CD reconciliation should complete successfully.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign jannfis for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Team

Run ID: 27808741-495e-4c1e-bab6-5acd62f24010

📥 Commits

Reviewing files that changed from the base of the PR and between fb60a7a and 32ef6e7.

📒 Files selected for processing (3)

• controllers/argocd/openshift/openshift.go
• controllers/argocd/openshift/openshift_test.go
• test/openshift/e2e/ginkgo/sequential/1-113_validate_controller_role_test.go

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• argoproj-labs/argocd-operator (manual)

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • Improved aggregation of administrator permissions into the application controller role.
  • Non-resource URL permissions are now excluded from namespaced roles, while valid resource permissions continue to be retained.
  • Added validation to ensure Argo CD remains available when aggregated permissions include unsupported rule types.

Walkthrough

The controller now filters non-resource rules before aggregating ClusterRole rules into the application-controller Role. Unit and end-to-end tests validate resource rule preservation and non-resource rule omission.

Changes

Namespaced Role filtering

Layer / File(s)	Summary
Filter policy rules controllers/argocd/openshift/openshift.go	The reconciliation hook removes NonResourceURLs and skips empty rules before appending ClusterRole rules to the namespaced Role.
Validate filtered rules controllers/argocd/openshift/openshift_test.go, test/openshift/e2e/ginkgo/sequential/1-113_validate_controller_role_test.go	Unit and end-to-end tests verify that resource rules remain available and non-resource rules are omitted.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 32ef6

Namespaced application-controller Roles now omit invalid non-resource URL permissions while retaining resource permissions, preventing reconciliation rejection without an identified remaining merge risk.

Suggested reviewers: jgwest

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 10 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the primary fix: omitting nonResourceURLs from namespaced Roles.
Description check	✅ Passed	The description explains the issue, the fix, linked issues, and unit and end-to-end test coverage.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@alkakumari016: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/v4.19-kuttl-sequential	32ef6e7	link	true	/test v4.19-kuttl-sequential

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.