Merge remote-tracking branch 'origin/upstream'

Signed-off-by: Elias Rami <[email protected]>

Author: Elyytscha

cmd/util/app_test.go

@@ -369,6 +369,10 @@ func Test_setAppSpecOptions(t *testing.T) {
 		require.NoError(t, f.SetFlag("sync-source-path", "apps"))
 		assert.Equal(t, "apps", f.spec.SourceHydrator.SyncSource.Path)
 
+		// Test sync-source-repo flag - this is the new field for different repository support
+		require.NoError(t, f.SetFlag("sync-source-repo", "https://github.com/argoproj/gitops-manifests"))
+		assert.Equal(t, "https://github.com/argoproj/gitops-manifests", f.spec.SourceHydrator.SyncSource.RepoURL)
+
 		require.NoError(t, f.SetFlag("hydrate-to-branch", "env/test-next"))
 		assert.Equal(t, "env/test-next", f.spec.SourceHydrator.HydrateTo.TargetBranch)
 

controller/hydrator/hydrator_test.go

@@ -709,6 +709,63 @@ func TestValidateApplications_RootPath(t *testing.T) {
 	require.ErrorContains(t, errs[app.QualifiedName()], "app is configured to hydrate to the repository root")
 }
 
+// TestValidateApplications_SyncSourceRepoNotPermitted tests that the sync source repo
+// must be permitted in the project. When SyncSource.RepoURL is set to a different repo,
+// that repo must be permitted. This tests PR #25464 code.
+func TestValidateApplications_SyncSourceRepoNotPermitted(t *testing.T) {
+	t.Parallel()
+	d := mocks.NewDependencies(t)
+	app := newTestApp("test-app")
+	// Set a different sync source repo URL that is not permitted in the project
+	// The dry source repo (https://example.com/repo) is permitted, but the sync source repo is not
+	app.Spec.SourceHydrator.SyncSource.RepoURL = "https://example.com/not-permitted-repo"
+	// Project permits https://example.com/repo (dry source) but not the sync source repo
+	proj := newTestProject()
+	d.EXPECT().GetProcessableAppProj(app).Return(proj, nil).Once()
+	h := &Hydrator{dependencies: d}
+
+	projects, errs := h.validateApplications([]*v1alpha1.Application{app})
+	require.Nil(t, projects)
+	require.Len(t, errs, 1)
+	// When SyncSource.RepoURL is set, GetSource() returns that repo URL, so the first validation check fails
+	require.ErrorContains(t, errs[app.QualifiedName()], "application repo https://example.com/not-permitted-repo is not permitted in project")
+}
+
+// TestValidateApplications_DestinationRepoPermitted tests that validation passes when
+// the destination repo (sync source) is permitted in the project
+func TestValidateApplications_DestinationRepoPermitted(t *testing.T) {
+	t.Parallel()
+	d := mocks.NewDependencies(t)
+	app := newTestApp("test-app")
+	// Set sync source repo URL that IS permitted in the project
+	app.Spec.SourceHydrator.SyncSource.RepoURL = "https://example.com/repo"
+	// Project permits https://example.com/repo
+	proj := newTestProject()
+	d.EXPECT().GetProcessableAppProj(app).Return(proj, nil).Once()
+	h := &Hydrator{dependencies: d}
+
+	projects, errs := h.validateApplications([]*v1alpha1.Application{app})
+	require.NotNil(t, projects)
+	require.Empty(t, errs)
+}
+
+// TestValidateApplications_DestinationRepoSameAsDrySource tests that validation passes when
+// the sync source repo URL is empty (defaults to dry source repo)
+func TestValidateApplications_DestinationRepoSameAsDrySource(t *testing.T) {
+	t.Parallel()
+	d := mocks.NewDependencies(t)
+	app := newTestApp("test-app")
+	// Empty sync source repo URL - should use dry source repo URL which is permitted
+	app.Spec.SourceHydrator.SyncSource.RepoURL = ""
+	proj := newTestProject()
+	d.EXPECT().GetProcessableAppProj(app).Return(proj, nil).Once()
+	h := &Hydrator{dependencies: d}
+
+	projects, errs := h.validateApplications([]*v1alpha1.Application{app})
+	require.NotNil(t, projects)
+	require.Empty(t, errs)
+}
+
 func TestValidateApplications_DuplicateDestination(t *testing.T) {
 	t.Parallel()
 	d := mocks.NewDependencies(t)

docs/operator-manual/health.md

@@ -16,8 +16,13 @@ with at least one value for `hostname` or `IP`.
 ### Ingress
 * The `status.loadBalancer.ingress` list is non-empty, with at least one value for `hostname` or `IP`.
 
+### CronJob
+* If the last scheduled job for this CronJob failed, the CronJob will be marked as "Degraded"
+* If the last scheduled job for this CronJob is running, the CronJob will be marked as "Progressing"
+
 ### Job
 * If job `.spec.suspended` is set to 'true', then the job and app health will be marked as suspended.
+
 ### PersistentVolumeClaim
 * The `status.phase` is `Bound`