From 8dbb5ff7809f39d6b80874f762c4bad22cd09730 Mon Sep 17 00:00:00 2001
From: Michele Baldessari <michele@acksyn.org>
Date: Tue, 20 Feb 2024 21:20:42 +0100
Subject: [PATCH 1/2] Add support for custom CAs

This feature relies on the VP operator version >= 0.0.44 in order to
work.

The way to enable this is to add a feature flag called 'initcontainers'
in the VP operator. Once this is enabled, we will detect this and take
over the all ArgoCD instances' definition and add initContainers which
will inject the CAs contained in the trusted-bundle-ca configmap and
also the openshift internal CA.

Testing protocol:

  1. (Operator 0.0.44) MCG deployment with experimentalCapabilities set
     to '' and using a github main upstream (i.e. without this PR)

  2. (Operator 0.0.44) MCG deployment with experimentalCapabilities set
     to 'initcontainers' and using a github diconnected common upstream
     (requiring a custom CA) (i.e. with this PR)

  3. (Operator 0.0.44) MCG deployment with experimentalCapabilities set
     to '' and using a github diconnected common upstream. (same as 1.2)
     and then set the initcontainer capability on the hub. Checked that
     the .global.experimentalCapabilities property replicated from hub to
     spoke and the initcontainers have been generated correctly

  3.1 (Operator 0.0.44) Change the repo from github to an internal one
      that does need the custom ca to work

  4. (Operator 0.0.43) Test an old operator with a newer common that
      contains this very branch

Note: Once we will make initcontainers a default feature of the operator
we will remove the ifs added in this PR and just make it the defaut
behaviour.
---
 .../policies/application-policies.yaml        |   3 +
 acm/templates/policies/ocp-gitops-policy.yaml | 167 ++++++++++++++++++
 clustergroup/templates/_helpers.tpl           |   2 +
 .../templates/imperative/_helpers.tpl         | 103 ++++++++++-
 .../templates/imperative/configmap.yaml       |   9 +
 clustergroup/templates/imperative/job.yaml    |  21 ++-
 .../templates/imperative/unsealjob.yaml       |  22 ++-
 clustergroup/templates/plumbing/argocd.yaml   |  43 +++++
 .../plumbing/trusted-bundle-ca-configmap.yaml |   7 +
 9 files changed, 366 insertions(+), 11 deletions(-)
 create mode 100644 clustergroup/templates/plumbing/trusted-bundle-ca-configmap.yaml

diff --git a/acm/templates/policies/application-policies.yaml b/acm/templates/policies/application-policies.yaml
index 68548893..925915c8 100644
--- a/acm/templates/policies/application-policies.yaml
+++ b/acm/templates/policies/application-policies.yaml
@@ -1,4 +1,5 @@
 # TODO: Also create a GitOpsCluster.apps.open-cluster-management.io
+{{- $hasInitContainerCapability := and (.Values.global.experimentalCapabilities) (has "initcontainers" (splitList "," .Values.global.experimentalCapabilities)) }}
 {{- range .Values.clusterGroup.managedClusterGroups }}
 {{- $group := . }}
 {{- if not .hostedArgoSites }}
@@ -75,6 +76,8 @@ spec:
                         value: {{ $.Values.global.clusterPlatform }}
                       - name: clusterGroup.name
                         value: {{ $group.name }}
+                      - name: global.experimentalCapabilities
+                        value: {{ $.Values.global.experimentalCapabilities }}
                      {{- range .helmOverrides }}
                       - name: {{ .name }}
                         value: {{ .value | quote }}
diff --git a/acm/templates/policies/ocp-gitops-policy.yaml b/acm/templates/policies/ocp-gitops-policy.yaml
index a0ed611f..f46b30c6 100644
--- a/acm/templates/policies/ocp-gitops-policy.yaml
+++ b/acm/templates/policies/ocp-gitops-policy.yaml
@@ -1,3 +1,4 @@
+{{- $hasInitContainerCapability := and (.Values.global.experimentalCapabilities) (has "initcontainers" (splitList "," .Values.global.experimentalCapabilities)) }}
 apiVersion: policy.open-cluster-management.io/v1
 kind: Policy
 metadata:
@@ -24,6 +25,15 @@ spec:
             include:
               - default
           object-templates:
+            - complianceType: mustonlyhave
+              objectDefinition:
+                kind: ConfigMap
+                apiVersion: v1
+                metadata:
+                  name: trusted-ca-bundle
+                  namespace: openshift-gitops
+                  labels:
+                    config.openshift.io/inject-trusted-cabundle: 'true'
             - complianceType: mustonlyhave
               objectDefinition:
                 # This is an auto-generated file. DO NOT EDIT
@@ -44,6 +54,163 @@ spec:
                     env:
                       - name: ARGOCD_CLUSTER_CONFIG_NAMESPACES
                         value: "*"
+{{- if $hasInitContainerCapability }}
+            - complianceType: mustonlyhave
+              objectDefinition:
+                apiVersion: argoproj.io/v1beta1
+                kind: ArgoCD
+                metadata:
+                  name: openshift-gitops
+                  namespace: openshift-gitops
+                spec:
+                  applicationSet:
+                    resources:
+                      limits:
+                        cpu: "2"
+                        memory: 1Gi
+                      requests:
+                        cpu: 250m
+                        memory: 512Mi
+                    webhookServer:
+                      ingress:
+                        enabled: false
+                      route:
+                        enabled: false
+                  controller:
+                    processors: {}
+                    resources:
+                      limits:
+                        cpu: "2"
+                        memory: 2Gi
+                      requests:
+                        cpu: 250m
+                        memory: 1Gi
+                    sharding: {}
+                  grafana:
+                    enabled: false
+                    ingress:
+                      enabled: false
+                    resources:
+                      limits:
+                        cpu: 500m
+                        memory: 256Mi
+                      requests:
+                        cpu: 250m
+                        memory: 128Mi
+                    route:
+                      enabled: false
+                  ha:
+                    enabled: false
+                    resources:
+                      limits:
+                        cpu: 500m
+                        memory: 256Mi
+                      requests:
+                        cpu: 250m
+                        memory: 128Mi
+                  initialSSHKnownHosts: {}
+                  monitoring:
+                    enabled: false
+                  notifications:
+                    enabled: false
+                  prometheus:
+                    enabled: false
+                    ingress:
+                      enabled: false
+                    route:
+                      enabled: false
+                  rbac:
+                    defaultPolicy: ""
+                    policy: |-
+                      g, system:cluster-admins, role:admin
+                      g, cluster-admins, role:admin
+                    scopes: '[groups]'
+                  redis:
+                    resources:
+                      limits:
+                        cpu: 500m
+                        memory: 256Mi
+                      requests:
+                        cpu: 250m
+                        memory: 128Mi
+                  repo:
+                    initContainers:
+                    - command:
+                      - bash
+                      - -c
+                      - cat /var/run/kube-root-ca/ca.crt /var/run/trusted-ca/ca-bundle.crt > /tmp/ca-bundles/ca-bundle.crt
+                        || true
+                      image: registry.access.redhat.com/ubi9/ubi-minimal:latest
+                      name: fetch-ca
+                      resources: {}
+                      volumeMounts:
+                      - mountPath: /var/run/kube-root-ca
+                        name: kube-root-ca
+                      - mountPath: /var/run/trusted-ca
+                        name: trusted-ca-bundle
+                      - mountPath: /tmp/ca-bundles
+                        name: ca-bundles
+                    resources:
+                      limits:
+                        cpu: "1"
+                        memory: 1Gi
+                      requests:
+                        cpu: 250m
+                        memory: 256Mi
+                    volumeMounts:
+                    - mountPath: /etc/pki/tls/certs
+                      name: ca-bundles
+                    volumes:
+                    - configMap:
+                        name: kube-root-ca.crt
+                      name: kube-root-ca
+                    - configMap:
+                        name: trusted-ca-bundle
+                        optional: true
+                      name: trusted-ca-bundle
+                    - emptyDir: {}
+                      name: ca-bundles
+                  resourceExclusions: |-
+                    - apiGroups:
+                      - tekton.dev
+                      clusters:
+                      - '*'
+                      kinds:
+                      - TaskRun
+                      - PipelineRun
+                  server:
+                    autoscale:
+                      enabled: false
+                    grpc:
+                      ingress:
+                        enabled: false
+                    ingress:
+                      enabled: false
+                    resources:
+                      limits:
+                        cpu: 500m
+                        memory: 256Mi
+                      requests:
+                        cpu: 125m
+                        memory: 128Mi
+                    route:
+                      enabled: true
+                    service:
+                      type: ""
+                  sso:
+                    dex:
+                      openShiftOAuth: true
+                      resources:
+                        limits:
+                          cpu: 500m
+                          memory: 256Mi
+                        requests:
+                          cpu: 250m
+                          memory: 128Mi
+                    provider: dex
+                  tls:
+                    ca: {}
+{{- end }}{{/* if hasInitContainerCapability */}}
 ---
 apiVersion: policy.open-cluster-management.io/v1
 kind: PlacementBinding
diff --git a/clustergroup/templates/_helpers.tpl b/clustergroup/templates/_helpers.tpl
index 83b06a04..cd0f5e8f 100644
--- a/clustergroup/templates/_helpers.tpl
+++ b/clustergroup/templates/_helpers.tpl
@@ -22,6 +22,8 @@ Default always defined top-level variables for helm charts
   value: {{ coalesce $.Values.global.localClusterDomain $.Values.global.hubClusterDomain }}
 - name: global.privateRepo
   value: {{ $.Values.global.privateRepo | quote }}
+- name: global.experimentalCapabilities
+  value: {{ $.Values.global.experimentalCapabilities | default "" }}
 {{- end }} {{/* clustergroup.globalvaluesparameters */}}
 
 
diff --git a/clustergroup/templates/imperative/_helpers.tpl b/clustergroup/templates/imperative/_helpers.tpl
index f75e781e..64786acf 100644
--- a/clustergroup/templates/imperative/_helpers.tpl
+++ b/clustergroup/templates/imperative/_helpers.tpl
@@ -4,6 +4,29 @@
 # 3. If it is an http secret, generate the correct URL
 # 4. If it is an ssh secret, create the private ssh key and make sure the git clone works
 
+{{/* fetch-ca InitContainer */}}
+{{- define "imperative.initcontainers.fetch-ca" }}
+- name: fetch-ca
+  image: {{ $.Values.clusterGroup.imperative.image }}
+  imagePullPolicy: {{ $.Values.clusterGroup.imperative.imagePullPolicy }}
+  env:
+    - name: HOME
+      value: /git/home
+  command:
+  - 'sh'
+  - '-c'
+  - >-
+    cat /var/run/kube-root-ca/ca.crt /var/run/trusted-ca/ca-bundle.crt > /tmp/ca-bundles/ca-bundle.crt || true;
+    ls -l /tmp/ca-bundles/
+  volumeMounts:
+  - mountPath: /var/run/kube-root-ca
+    name: kube-root-ca
+  - mountPath: /var/run/trusted-ca
+    name: trusted-ca-bundle
+  - mountPath: /tmp/ca-bundles
+    name: ca-bundles
+{{- end }}
+
 {{/* git-init InitContainer */}}
 {{- define "imperative.initcontainers.gitinit" }}
 - name: git-init
@@ -12,6 +35,9 @@
   env:
     - name: HOME
       value: /git/home
+  volumeMounts:
+  - name: git
+    mountPath: "/git"
   command:
   - 'sh'
   - '-c'
@@ -37,11 +63,47 @@
     mkdir /git/{repo,home};
     git clone --single-branch --branch {{ $.Values.global.targetRevision }} --depth 1 -- "${URL}" /git/repo;
     chmod 0770 /git/{repo,home};
+{{- end }}
+
+{{/* git-init-ca InitContainer */}}
+{{- define "imperative.initcontainers.gitinit-ca" }}
+- name: git-init
+  image: {{ $.Values.clusterGroup.imperative.image }}
+  imagePullPolicy: {{ $.Values.clusterGroup.imperative.imagePullPolicy }}
+  env:
+    - name: HOME
+      value: /git/home
   volumeMounts:
   - name: git
     mountPath: "/git"
+  - name: ca-bundles
+    mountPath: /etc/pki/tls/certs
+  command:
+  - 'sh'
+  - '-c'
+  - >-
+    if ! oc get secrets -n openshift-gitops vp-private-repo-credentials &> /dev/null; then
+      URL="{{ $.Values.global.repoURL }}";
+    else
+      if ! oc get secrets -n openshift-gitops vp-private-repo-credentials -o go-template='{{ `{{index .data.sshPrivateKey | base64decode}}` }}' &>/dev/null; then
+        U="$(oc get secret -n openshift-gitops vp-private-repo-credentials -o go-template='{{ `{{index .data.username | base64decode }}` }}')";
+        P="$(oc get secret -n openshift-gitops vp-private-repo-credentials -o go-template='{{ `{{index .data.password | base64decode }}` }}')";
+        URL=$(echo {{ $.Values.global.repoURL }} | sed -E "s/(https?:\/\/)/\1${U}:${P}@/");
+        echo "USER/PASS: ${URL}";
+      else
+        S="$(oc get secret -n openshift-gitops vp-private-repo-credentials -o go-template='{{ `{{index .data.sshPrivateKey | base64decode }}` }}')";
+        mkdir -p --mode 0700 "${HOME}/.ssh";
+        echo "${S}" > "${HOME}/.ssh/id_rsa";
+        chmod 0600 "${HOME}/.ssh/id_rsa";
+        URL=$(echo {{ $.Values.global.repoURL }} | sed -E "s/(https?:\/\/)/\1git@/");
+        git config --global core.sshCommand "ssh -i "${HOME}/.ssh/id_rsa" -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no";
+        echo "SSH: ${URL}";
+      fi;
+    fi;
+    mkdir /git/{repo,home};
+    git clone --single-branch --branch {{ $.Values.global.targetRevision }} --depth 1 -- "${URL}" /git/repo;
+    chmod 0770 /git/{repo,home};
 {{- end }}
-
 {{/* Final done container */}}
 {{- define "imperative.containers.done" }}
 - name: "done"
@@ -56,6 +118,19 @@
 {{- end }}
 
 {{/* volume-mounts for all containers */}}
+{{- define "imperative.volumemounts_ca" }}
+- name: git
+  mountPath: "/git"
+- name: values-volume
+  mountPath: /values/values.yaml
+  subPath: values.yaml
+- mountPath: /var/run/kube-root-ca
+  name: kube-root-ca
+- mountPath: /var/run/trusted-ca
+  name: trusted-ca-bundle
+- mountPath: /tmp/ca-bundles
+  name: ca-bundles
+{{- end }}
 {{- define "imperative.volumemounts" }}
 - name: git
   mountPath: "/git"
@@ -63,3 +138,29 @@
   mountPath: /values/values.yaml
   subPath: values.yaml
 {{- end }}
+
+{{/* volumes for all containers */}}
+{{- define "imperative.volumes" }}
+- name: git
+  emptyDir: {}
+- name: values-volume
+  configMap:
+    name: {{ $.Values.clusterGroup.imperative.valuesConfigMap }}-{{ $.Values.clusterGroup.name }}
+{{- end }}
+
+{{- define "imperative.volumes_ca" }}
+- name: git
+  emptyDir: {}
+- name: values-volume
+  configMap:
+    name: {{ $.Values.clusterGroup.imperative.valuesConfigMap }}-{{ $.Values.clusterGroup.name }}
+- configMap:
+    name: kube-root-ca.crt
+  name: kube-root-ca
+- configMap:
+    name: trusted-ca-bundle
+    optional: true
+  name: trusted-ca-bundle
+- name: ca-bundles
+  emptyDir: {}
+{{- end }}
diff --git a/clustergroup/templates/imperative/configmap.yaml b/clustergroup/templates/imperative/configmap.yaml
index 8ca5a176..9f2d6155 100644
--- a/clustergroup/templates/imperative/configmap.yaml
+++ b/clustergroup/templates/imperative/configmap.yaml
@@ -9,4 +9,13 @@ metadata:
 data:
   values.yaml: |
 {{ tpl $valuesyaml . | indent 4 }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trusted-ca-bundle
+  namespace: {{ $.Values.clusterGroup.imperative.namespace}}
+  annotations:
+  labels:
+    config.openshift.io/inject-trusted-cabundle: 'true'
 {{- end }}
diff --git a/clustergroup/templates/imperative/job.yaml b/clustergroup/templates/imperative/job.yaml
index cb092649..0b82d47c 100644
--- a/clustergroup/templates/imperative/job.yaml
+++ b/clustergroup/templates/imperative/job.yaml
@@ -1,3 +1,5 @@
+{{- $hasInitContainerCapability := and (.Values.global.experimentalCapabilities) (has "initcontainers" (splitList "," .Values.global.experimentalCapabilities)) }}
+
 {{- if not (eq .Values.enabled "plumbing") }}
 {{/* Define this if needed (jobs defined */}}
 {{- if (and $.Values.clusterGroup.imperative (gt (len $.Values.clusterGroup.imperative.jobs) 0)) -}}
@@ -22,7 +24,12 @@ spec:
           initContainers:
             # git init happens in /git/repo so that we can set the folder to 0770 permissions
             # reason for that is ansible refuses to create temporary folders in there
+{{- if $hasInitContainerCapability }}
+            {{- include  "imperative.initcontainers.fetch-ca" . | indent 12 }}
+            {{- include  "imperative.initcontainers.gitinit-ca" . | indent 12 }}
+{{- else }}
             {{- include  "imperative.initcontainers.gitinit" . | indent 12 }}
+{{- end }}
     {{- range $.Values.clusterGroup.imperative.jobs }}
       {{- if ne (.disabled | default "false" | toString | lower ) "true" }}
             - name: {{ .name }}
@@ -53,17 +60,21 @@ spec:
                 {{- end }}
                 - {{ .playbook }}
               volumeMounts:
+{{- if $hasInitContainerCapability }}
+                {{- include "imperative.volumemounts_ca" . | indent 16 }}
+{{- else }}
                 {{- include "imperative.volumemounts" . | indent 16 }}
+{{- end }}
       {{- end }}
     {{- end }}
           containers:
           {{- include "imperative.containers.done" . | indent 12 }}
           volumes:
-          - name: git
-            emptyDir: {}
-          - name: values-volume
-            configMap:
-              name: {{ $.Values.clusterGroup.imperative.valuesConfigMap }}-{{ $.Values.clusterGroup.name }}
+{{- if $hasInitContainerCapability }}
+          {{- include "imperative.volumes_ca" . | indent 12 }}
+{{- else }}
+          {{- include "imperative.volumes" . | indent 12 }}
+{{- end }}
           restartPolicy: Never
 {{- end }}
 {{- end }}
diff --git a/clustergroup/templates/imperative/unsealjob.yaml b/clustergroup/templates/imperative/unsealjob.yaml
index b251c5da..e0ff2c78 100644
--- a/clustergroup/templates/imperative/unsealjob.yaml
+++ b/clustergroup/templates/imperative/unsealjob.yaml
@@ -1,3 +1,5 @@
+{{- $hasInitContainerCapability := and (.Values.global.experimentalCapabilities) (has "initcontainers" (splitList "," .Values.global.experimentalCapabilities)) }}
+
 {{/* If the backend is not set at all we default to "vault". See https://www.github.com/helm/helm/issues/3308
      why we avoid using the default function */}}
 {{- if or (eq .Values.global.secretStore.backend "vault") (not (hasKey .Values.global.secretStore "backend")) }}
@@ -24,7 +26,13 @@ spec:
           initContainers:
             # git init happens in /git/repo so that we can set the folder to 0770 permissions
             # reason for that is ansible refuses to create temporary folders in there
+{{- if $hasInitContainerCapability }}
+
+            {{- include  "imperative.initcontainers.fetch-ca" . | indent 12 }}
+            {{- include  "imperative.initcontainers.gitinit-ca" . | indent 12 }}
+{{- else }}
             {{- include  "imperative.initcontainers.gitinit" . | indent 12 }}
+{{- end }}
             - name: unseal-playbook
               image: {{ $.Values.clusterGroup.imperative.image }}
               imagePullPolicy: {{ $.Values.clusterGroup.imperative.imagePullPolicy }}
@@ -47,15 +55,19 @@ spec:
                 - 'vault_init,vault_unseal,vault_secrets_init,vault_spokes_init'
                 - "common/ansible/playbooks/vault/vault.yaml"
               volumeMounts:
+{{- if $hasInitContainerCapability }}
+                {{- include "imperative.volumemounts_ca" . | indent 16 }}
+{{- else }}
                 {{- include "imperative.volumemounts" . | indent 16 }}
+{{- end }}
           containers:
           {{- include "imperative.containers.done" . | indent 12 }}
           volumes:
-          - name: git
-            emptyDir: {}
-          - name: values-volume
-            configMap:
-              name: {{ $.Values.clusterGroup.imperative.valuesConfigMap }}-{{ $.Values.clusterGroup.name }}
+{{- if $hasInitContainerCapability }}
+          {{- include "imperative.volumes_ca" . | indent 12 }}
+{{- else }}
+          {{- include "imperative.volumes" . | indent 12 }}
+{{- end }}
           restartPolicy: Never
 {{- end }}
 {{- end }}
diff --git a/clustergroup/templates/plumbing/argocd.yaml b/clustergroup/templates/plumbing/argocd.yaml
index 12e362aa..dcce1b4b 100644
--- a/clustergroup/templates/plumbing/argocd.yaml
+++ b/clustergroup/templates/plumbing/argocd.yaml
@@ -1,3 +1,5 @@
+{{- $hasInitContainerCapability := and (.Values.global.experimentalCapabilities) (has "initcontainers" (splitList "," .Values.global.experimentalCapabilities)) }}
+
 {{- if (eq .Values.enabled "all") }}
 {{- $namespace := print $.Values.global.pattern "-" $.Values.clusterGroup.name }}
 apiVersion: argoproj.io/v1beta1
@@ -68,9 +70,50 @@ spec:
   rbac:
     defaultPolicy: role:admin
   repo:
+{{- if $hasInitContainerCapability }}
+    initContainers:
+    - command:
+      - bash
+      - -c
+      - cat /var/run/kube-root-ca/ca.crt /var/run/trusted-ca/ca-bundle.crt > /tmp/ca-bundles/ca-bundle.crt || true
+      image: {{ $.Values.clusterGroup.imperative.image }}
+      name: fetch-ca
+      resources: {}
+      volumeMounts:
+      - mountPath: /var/run/kube-root-ca
+        name: kube-root-ca
+      - mountPath: /var/run/trusted-ca
+        name: trusted-ca-bundle
+      - mountPath: /tmp/ca-bundles
+        name: ca-bundles
+    resources:
+      limits:
+        cpu: "1"
+        memory: 1Gi
+      requests:
+        cpu: 250m
+        memory: 256Mi
+    volumeMounts:
+    - mountPath: /etc/pki/tls/certs
+      name: ca-bundles
+    volumes:
+    - configMap:
+        name: kube-root-ca.crt
+      name: kube-root-ca
+    - configMap:
+        name: trusted-ca-bundle
+        optional: true
+      name: trusted-ca-bundle
+    - emptyDir: {}
+      name: ca-bundles
+{{- if len $.Values.clusterGroup.argoCD.initContainers }}
+{{ $.Values.clusterGroup.argoCD.initContainers | toPrettyJson }}
+{{- end }}
+{{- else }}
 {{- if len $.Values.clusterGroup.argoCD.initContainers }}
     initContainers: {{ $.Values.clusterGroup.argoCD.initContainers | toPrettyJson }}
 {{- end }}
+{{- end }}{{/* if $hasInitContainerCapability */}}
 {{- if len $.Values.clusterGroup.argoCD.configManagementPlugins }}
     sidecarContainers:
 {{- range $cmp := $.Values.clusterGroup.argoCD.configManagementPlugins }}
diff --git a/clustergroup/templates/plumbing/trusted-bundle-ca-configmap.yaml b/clustergroup/templates/plumbing/trusted-bundle-ca-configmap.yaml
new file mode 100644
index 00000000..8b2a9cde
--- /dev/null
+++ b/clustergroup/templates/plumbing/trusted-bundle-ca-configmap.yaml
@@ -0,0 +1,7 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: trusted-ca-bundle
+  namespace: {{ $.Values.global.pattern }}-{{ .Values.clusterGroup.name }}
+  labels:
+    config.openshift.io/inject-trusted-cabundle: 'true'

From 4e75d71f061dc2c9ba2826fc74549fcb83149a48 Mon Sep 17 00:00:00 2001
From: Michele Baldessari <michele@acksyn.org>
Date: Thu, 11 Apr 2024 18:12:05 +0200
Subject: [PATCH 2/2] Update tests

---
 .../acm-industrial-edge-factory.expected.yaml |  9 +++
 tests/acm-industrial-edge-hub.expected.yaml   | 11 +++
 tests/acm-medical-diagnosis-hub.expected.yaml | 11 +++
 tests/acm-naked.expected.yaml                 |  9 +++
 tests/acm-normal.expected.yaml                | 13 +++
 ...roup-industrial-edge-factory.expected.yaml | 39 ++++++---
 ...tergroup-industrial-edge-hub.expected.yaml | 69 +++++++++++-----
 ...rgroup-medical-diagnosis-hub.expected.yaml | 81 ++++++++++++++-----
 tests/clustergroup-naked.expected.yaml        | 37 ++++++---
 tests/clustergroup-normal.expected.yaml       | 59 +++++++++-----
 10 files changed, 266 insertions(+), 72 deletions(-)

diff --git a/tests/acm-industrial-edge-factory.expected.yaml b/tests/acm-industrial-edge-factory.expected.yaml
index 66c0c0b9..0291231a 100644
--- a/tests/acm-industrial-edge-factory.expected.yaml
+++ b/tests/acm-industrial-edge-factory.expected.yaml
@@ -89,6 +89,15 @@ spec:
             include:
               - default
           object-templates:
+            - complianceType: mustonlyhave
+              objectDefinition:
+                kind: ConfigMap
+                apiVersion: v1
+                metadata:
+                  name: trusted-ca-bundle
+                  namespace: openshift-gitops
+                  labels:
+                    config.openshift.io/inject-trusted-cabundle: 'true'
             - complianceType: mustonlyhave
               objectDefinition:
                 # This is an auto-generated file. DO NOT EDIT
diff --git a/tests/acm-industrial-edge-hub.expected.yaml b/tests/acm-industrial-edge-hub.expected.yaml
index 59c7e60f..a912f0cd 100644
--- a/tests/acm-industrial-edge-hub.expected.yaml
+++ b/tests/acm-industrial-edge-hub.expected.yaml
@@ -248,6 +248,8 @@ spec:
                         value: aws
                       - name: clusterGroup.name
                         value: factory
+                      - name: global.experimentalCapabilities
+                        value: 
                       - name: clusterGroup.isHubCluster
                         value: "false"
                   destination:
@@ -296,6 +298,15 @@ spec:
             include:
               - default
           object-templates:
+            - complianceType: mustonlyhave
+              objectDefinition:
+                kind: ConfigMap
+                apiVersion: v1
+                metadata:
+                  name: trusted-ca-bundle
+                  namespace: openshift-gitops
+                  labels:
+                    config.openshift.io/inject-trusted-cabundle: 'true'
             - complianceType: mustonlyhave
               objectDefinition:
                 # This is an auto-generated file. DO NOT EDIT
diff --git a/tests/acm-medical-diagnosis-hub.expected.yaml b/tests/acm-medical-diagnosis-hub.expected.yaml
index 3a65a6be..3ac5fe17 100644
--- a/tests/acm-medical-diagnosis-hub.expected.yaml
+++ b/tests/acm-medical-diagnosis-hub.expected.yaml
@@ -239,6 +239,8 @@ spec:
                         value: aws
                       - name: clusterGroup.name
                         value: region-one
+                      - name: global.experimentalCapabilities
+                        value: 
                       - name: clusterGroup.isHubCluster
                         value: "false"
                   destination:
@@ -287,6 +289,15 @@ spec:
             include:
               - default
           object-templates:
+            - complianceType: mustonlyhave
+              objectDefinition:
+                kind: ConfigMap
+                apiVersion: v1
+                metadata:
+                  name: trusted-ca-bundle
+                  namespace: openshift-gitops
+                  labels:
+                    config.openshift.io/inject-trusted-cabundle: 'true'
             - complianceType: mustonlyhave
               objectDefinition:
                 # This is an auto-generated file. DO NOT EDIT
diff --git a/tests/acm-naked.expected.yaml b/tests/acm-naked.expected.yaml
index 880ef747..4f0ac751 100644
--- a/tests/acm-naked.expected.yaml
+++ b/tests/acm-naked.expected.yaml
@@ -90,6 +90,15 @@ spec:
             include:
               - default
           object-templates:
+            - complianceType: mustonlyhave
+              objectDefinition:
+                kind: ConfigMap
+                apiVersion: v1
+                metadata:
+                  name: trusted-ca-bundle
+                  namespace: openshift-gitops
+                  labels:
+                    config.openshift.io/inject-trusted-cabundle: 'true'
             - complianceType: mustonlyhave
               objectDefinition:
                 # This is an auto-generated file. DO NOT EDIT
diff --git a/tests/acm-normal.expected.yaml b/tests/acm-normal.expected.yaml
index af97f532..1a3f6e72 100644
--- a/tests/acm-normal.expected.yaml
+++ b/tests/acm-normal.expected.yaml
@@ -642,6 +642,8 @@ spec:
                         value: aws
                       - name: clusterGroup.name
                         value: acm-edge
+                      - name: global.experimentalCapabilities
+                        value: 
                       - name: clusterGroup.isHubCluster
                         value: "false"
                   destination:
@@ -738,6 +740,8 @@ spec:
                         value: aws
                       - name: clusterGroup.name
                         value: acm-provision-edge
+                      - name: global.experimentalCapabilities
+                        value: 
                       - name: clusterGroup.isHubCluster
                         value: "false"
                   destination:
@@ -786,6 +790,15 @@ spec:
             include:
               - default
           object-templates:
+            - complianceType: mustonlyhave
+              objectDefinition:
+                kind: ConfigMap
+                apiVersion: v1
+                metadata:
+                  name: trusted-ca-bundle
+                  namespace: openshift-gitops
+                  labels:
+                    config.openshift.io/inject-trusted-cabundle: 'true'
             - complianceType: mustonlyhave
               objectDefinition:
                 # This is an auto-generated file. DO NOT EDIT
diff --git a/tests/clustergroup-industrial-edge-factory.expected.yaml b/tests/clustergroup-industrial-edge-factory.expected.yaml
index 851119a8..39ec60c7 100644
--- a/tests/clustergroup-industrial-edge-factory.expected.yaml
+++ b/tests/clustergroup-industrial-edge-factory.expected.yaml
@@ -198,6 +198,16 @@ data:
       kind: ClusterSecretStore
       name: vault-backend
 ---
+# Source: clustergroup/templates/imperative/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trusted-ca-bundle
+  namespace: imperative
+  annotations:
+  labels:
+    config.openshift.io/inject-trusted-cabundle: 'true'
+---
 # Source: clustergroup/templates/plumbing/argocd-cmp-plugin-cms.yaml
 kind: ConfigMap
 apiVersion: v1
@@ -230,6 +240,15 @@ data:
           --set clusterGroup.name=factory
           --post-renderer ./kustomize"]
 ---
+# Source: clustergroup/templates/plumbing/trusted-bundle-ca-configmap.yaml
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: trusted-ca-bundle
+  namespace: mypattern-factory
+  labels:
+    config.openshift.io/inject-trusted-cabundle: 'true'
+---
 # Source: clustergroup/templates/imperative/clusterrole.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -359,6 +378,9 @@ spec:
               env:
                 - name: HOME
                   value: /git/home
+              volumeMounts:
+              - name: git
+                mountPath: "/git"
               command:
               - 'sh'
               - '-c'
@@ -384,9 +406,6 @@ spec:
                 mkdir /git/{repo,home};
                 git clone --single-branch --branch main --depth 1 -- "${URL}" /git/repo;
                 chmod 0770 /git/{repo,home};
-              volumeMounts:
-              - name: git
-                mountPath: "/git"
             - name: test
               image: registry.redhat.io/ansible-automation-platform-24/ee-supported-rhel9:latest
               imagePullPolicy: Always
@@ -419,12 +438,12 @@ spec:
                 - 'echo'
                 - 'done'
                 - '\n'
-          volumes:
-          - name: git
-            emptyDir: {}
-          - name: values-volume
-            configMap:
-              name: helm-values-configmap-factory
+          volumes:            
+            - name: git
+              emptyDir: {}
+            - name: values-volume
+              configMap:
+                name: helm-values-configmap-factory
           restartPolicy: Never
 ---
 # Source: clustergroup/templates/core/subscriptions.yaml
@@ -527,6 +546,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   syncPolicy:
     automated: {}
     retry:
diff --git a/tests/clustergroup-industrial-edge-hub.expected.yaml b/tests/clustergroup-industrial-edge-hub.expected.yaml
index 611ecbb7..8355852c 100644
--- a/tests/clustergroup-industrial-edge-hub.expected.yaml
+++ b/tests/clustergroup-industrial-edge-hub.expected.yaml
@@ -359,6 +359,16 @@ data:
       kind: ClusterSecretStore
       name: vault-backend
 ---
+# Source: clustergroup/templates/imperative/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trusted-ca-bundle
+  namespace: imperative
+  annotations:
+  labels:
+    config.openshift.io/inject-trusted-cabundle: 'true'
+---
 # Source: clustergroup/templates/plumbing/argocd-cmp-plugin-cms.yaml
 kind: ConfigMap
 apiVersion: v1
@@ -391,6 +401,15 @@ data:
           --set clusterGroup.name=datacenter
           --post-renderer ./kustomize"]
 ---
+# Source: clustergroup/templates/plumbing/trusted-bundle-ca-configmap.yaml
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: trusted-ca-bundle
+  namespace: mypattern-datacenter
+  labels:
+    config.openshift.io/inject-trusted-cabundle: 'true'
+---
 # Source: clustergroup/templates/imperative/clusterrole.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -520,6 +539,9 @@ spec:
               env:
                 - name: HOME
                   value: /git/home
+              volumeMounts:
+              - name: git
+                mountPath: "/git"
               command:
               - 'sh'
               - '-c'
@@ -545,9 +567,6 @@ spec:
                 mkdir /git/{repo,home};
                 git clone --single-branch --branch main --depth 1 -- "${URL}" /git/repo;
                 chmod 0770 /git/{repo,home};
-              volumeMounts:
-              - name: git
-                mountPath: "/git"
             - name: test
               image: registry.redhat.io/ansible-automation-platform-24/ee-supported-rhel9:latest
               imagePullPolicy: Always
@@ -580,12 +599,12 @@ spec:
                 - 'echo'
                 - 'done'
                 - '\n'
-          volumes:
-          - name: git
-            emptyDir: {}
-          - name: values-volume
-            configMap:
-              name: helm-values-configmap-datacenter
+          volumes:            
+            - name: git
+              emptyDir: {}
+            - name: values-volume
+              configMap:
+                name: helm-values-configmap-datacenter
           restartPolicy: Never
 ---
 # Source: clustergroup/templates/imperative/unsealjob.yaml
@@ -615,6 +634,9 @@ spec:
               env:
                 - name: HOME
                   value: /git/home
+              volumeMounts:
+              - name: git
+                mountPath: "/git"
               command:
               - 'sh'
               - '-c'
@@ -640,9 +662,6 @@ spec:
                 mkdir /git/{repo,home};
                 git clone --single-branch --branch main --depth 1 -- "${URL}" /git/repo;
                 chmod 0770 /git/{repo,home};
-              volumeMounts:
-              - name: git
-                mountPath: "/git"
             - name: unseal-playbook
               image: registry.redhat.io/ansible-automation-platform-24/ee-supported-rhel9:latest
               imagePullPolicy: Always
@@ -677,12 +696,12 @@ spec:
                 - 'echo'
                 - 'done'
                 - '\n'
-          volumes:
-          - name: git
-            emptyDir: {}
-          - name: values-volume
-            configMap:
-              name: helm-values-configmap-datacenter
+          volumes:            
+            - name: git
+              emptyDir: {}
+            - name: values-volume
+              configMap:
+                name: helm-values-configmap-datacenter
           restartPolicy: Never
 ---
 # Source: clustergroup/templates/core/subscriptions.yaml
@@ -821,6 +840,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   ignoreDifferences: [
   {
     "group": "internal.open-cluster-management.io",
@@ -884,6 +905,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   syncPolicy:
     automated: {}
     retry:
@@ -938,6 +961,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   syncPolicy:
     automated: {}
     retry:
@@ -992,6 +1017,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   ignoreDifferences: [
   {
     "group": "apps",
@@ -1076,6 +1103,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   syncPolicy:
     automated: {}
     retry:
@@ -1130,6 +1159,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   syncPolicy:
     automated: {}
     retry:
@@ -1211,6 +1242,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
         - name: global.openshift
           value: "true"
         - name: injector.enabled
diff --git a/tests/clustergroup-medical-diagnosis-hub.expected.yaml b/tests/clustergroup-medical-diagnosis-hub.expected.yaml
index 9855500c..819e2ef1 100644
--- a/tests/clustergroup-medical-diagnosis-hub.expected.yaml
+++ b/tests/clustergroup-medical-diagnosis-hub.expected.yaml
@@ -318,6 +318,25 @@ data:
       kind: ClusterSecretStore
       name: vault-backend
 ---
+# Source: clustergroup/templates/imperative/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trusted-ca-bundle
+  namespace: imperative
+  annotations:
+  labels:
+    config.openshift.io/inject-trusted-cabundle: 'true'
+---
+# Source: clustergroup/templates/plumbing/trusted-bundle-ca-configmap.yaml
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: trusted-ca-bundle
+  namespace: mypattern-hub
+  labels:
+    config.openshift.io/inject-trusted-cabundle: 'true'
+---
 # Source: clustergroup/templates/imperative/clusterrole.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -447,6 +466,9 @@ spec:
               env:
                 - name: HOME
                   value: /git/home
+              volumeMounts:
+              - name: git
+                mountPath: "/git"
               command:
               - 'sh'
               - '-c'
@@ -472,9 +494,6 @@ spec:
                 mkdir /git/{repo,home};
                 git clone --single-branch --branch main --depth 1 -- "${URL}" /git/repo;
                 chmod 0770 /git/{repo,home};
-              volumeMounts:
-              - name: git
-                mountPath: "/git"
             - name: test
               image: registry.redhat.io/ansible-automation-platform-24/ee-supported-rhel9:latest
               imagePullPolicy: Always
@@ -507,12 +526,12 @@ spec:
                 - 'echo'
                 - 'done'
                 - '\n'
-          volumes:
-          - name: git
-            emptyDir: {}
-          - name: values-volume
-            configMap:
-              name: helm-values-configmap-hub
+          volumes:            
+            - name: git
+              emptyDir: {}
+            - name: values-volume
+              configMap:
+                name: helm-values-configmap-hub
           restartPolicy: Never
 ---
 # Source: clustergroup/templates/imperative/unsealjob.yaml
@@ -542,6 +561,9 @@ spec:
               env:
                 - name: HOME
                   value: /git/home
+              volumeMounts:
+              - name: git
+                mountPath: "/git"
               command:
               - 'sh'
               - '-c'
@@ -567,9 +589,6 @@ spec:
                 mkdir /git/{repo,home};
                 git clone --single-branch --branch main --depth 1 -- "${URL}" /git/repo;
                 chmod 0770 /git/{repo,home};
-              volumeMounts:
-              - name: git
-                mountPath: "/git"
             - name: unseal-playbook
               image: registry.redhat.io/ansible-automation-platform-24/ee-supported-rhel9:latest
               imagePullPolicy: Always
@@ -604,12 +623,12 @@ spec:
                 - 'echo'
                 - 'done'
                 - '\n'
-          volumes:
-          - name: git
-            emptyDir: {}
-          - name: values-volume
-            configMap:
-              name: helm-values-configmap-hub
+          volumes:            
+            - name: git
+              emptyDir: {}
+            - name: values-volume
+              configMap:
+                name: helm-values-configmap-hub
           restartPolicy: Never
 ---
 # Source: clustergroup/templates/core/subscriptions.yaml
@@ -706,6 +725,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   syncPolicy:
     automated: {}
     retry:
@@ -760,6 +781,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   syncPolicy:
     automated: {}
     retry:
@@ -814,6 +837,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   syncPolicy:
     automated: {}
     retry:
@@ -868,6 +893,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   syncPolicy:
     automated: {}
     retry:
@@ -922,6 +949,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   syncPolicy:
     automated: {}
     retry:
@@ -976,6 +1005,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   syncPolicy:
     automated: {}
     retry:
@@ -1030,6 +1061,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   syncPolicy:
     automated: {}
     retry:
@@ -1084,6 +1117,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
         - name: global.openshift
           value: "true"
         - name: injector.enabled
@@ -1156,6 +1191,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   syncPolicy:
     automated: {}
     retry:
@@ -1210,6 +1247,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   syncPolicy:
     automated: {}
     retry:
@@ -1264,6 +1303,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   ignoreDifferences: [
   {
     "group": "apps.openshift.io",
@@ -1327,6 +1368,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   ignoreDifferences: [
   {
     "group": "apps.openshift.io",
@@ -1390,6 +1433,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   syncPolicy:
     automated: {}
     retry:
diff --git a/tests/clustergroup-naked.expected.yaml b/tests/clustergroup-naked.expected.yaml
index 194bfa8f..b8e329d6 100644
--- a/tests/clustergroup-naked.expected.yaml
+++ b/tests/clustergroup-naked.expected.yaml
@@ -83,6 +83,25 @@ data:
       kind: ClusterSecretStore
       name: vault-backend
 ---
+# Source: clustergroup/templates/imperative/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trusted-ca-bundle
+  namespace: imperative
+  annotations:
+  labels:
+    config.openshift.io/inject-trusted-cabundle: 'true'
+---
+# Source: clustergroup/templates/plumbing/trusted-bundle-ca-configmap.yaml
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: trusted-ca-bundle
+  namespace: common-example
+  labels:
+    config.openshift.io/inject-trusted-cabundle: 'true'
+---
 # Source: clustergroup/templates/imperative/clusterrole.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -212,6 +231,9 @@ spec:
               env:
                 - name: HOME
                   value: /git/home
+              volumeMounts:
+              - name: git
+                mountPath: "/git"
               command:
               - 'sh'
               - '-c'
@@ -237,9 +259,6 @@ spec:
                 mkdir /git/{repo,home};
                 git clone --single-branch --branch main --depth 1 -- "${URL}" /git/repo;
                 chmod 0770 /git/{repo,home};
-              volumeMounts:
-              - name: git
-                mountPath: "/git"
             - name: unseal-playbook
               image: registry.redhat.io/ansible-automation-platform-24/ee-supported-rhel9:latest
               imagePullPolicy: Always
@@ -274,12 +293,12 @@ spec:
                 - 'echo'
                 - 'done'
                 - '\n'
-          volumes:
-          - name: git
-            emptyDir: {}
-          - name: values-volume
-            configMap:
-              name: helm-values-configmap-example
+          volumes:            
+            - name: git
+              emptyDir: {}
+            - name: values-volume
+              configMap:
+                name: helm-values-configmap-example
           restartPolicy: Never
 ---
 # Source: clustergroup/templates/plumbing/argocd.yaml
diff --git a/tests/clustergroup-normal.expected.yaml b/tests/clustergroup-normal.expected.yaml
index f038446d..b3387af2 100644
--- a/tests/clustergroup-normal.expected.yaml
+++ b/tests/clustergroup-normal.expected.yaml
@@ -280,6 +280,25 @@ data:
       kind: ClusterSecretStore
       name: vault-backend
 ---
+# Source: clustergroup/templates/imperative/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trusted-ca-bundle
+  namespace: imperative
+  annotations:
+  labels:
+    config.openshift.io/inject-trusted-cabundle: 'true'
+---
+# Source: clustergroup/templates/plumbing/trusted-bundle-ca-configmap.yaml
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: trusted-ca-bundle
+  namespace: mypattern-example
+  labels:
+    config.openshift.io/inject-trusted-cabundle: 'true'
+---
 # Source: clustergroup/templates/imperative/clusterrole.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -409,6 +428,9 @@ spec:
               env:
                 - name: HOME
                   value: /git/home
+              volumeMounts:
+              - name: git
+                mountPath: "/git"
               command:
               - 'sh'
               - '-c'
@@ -434,9 +456,6 @@ spec:
                 mkdir /git/{repo,home};
                 git clone --single-branch --branch main --depth 1 -- "${URL}" /git/repo;
                 chmod 0770 /git/{repo,home};
-              volumeMounts:
-              - name: git
-                mountPath: "/git"
             - name: test
               image: registry.redhat.io/ansible-automation-platform-24/ee-supported-rhel9:latest
               imagePullPolicy: Always
@@ -469,12 +488,12 @@ spec:
                 - 'echo'
                 - 'done'
                 - '\n'
-          volumes:
-          - name: git
-            emptyDir: {}
-          - name: values-volume
-            configMap:
-              name: helm-values-configmap-example
+          volumes:            
+            - name: git
+              emptyDir: {}
+            - name: values-volume
+              configMap:
+                name: helm-values-configmap-example
           restartPolicy: Never
 ---
 # Source: clustergroup/templates/imperative/unsealjob.yaml
@@ -504,6 +523,9 @@ spec:
               env:
                 - name: HOME
                   value: /git/home
+              volumeMounts:
+              - name: git
+                mountPath: "/git"
               command:
               - 'sh'
               - '-c'
@@ -529,9 +551,6 @@ spec:
                 mkdir /git/{repo,home};
                 git clone --single-branch --branch main --depth 1 -- "${URL}" /git/repo;
                 chmod 0770 /git/{repo,home};
-              volumeMounts:
-              - name: git
-                mountPath: "/git"
             - name: unseal-playbook
               image: registry.redhat.io/ansible-automation-platform-24/ee-supported-rhel9:latest
               imagePullPolicy: Always
@@ -566,12 +585,12 @@ spec:
                 - 'echo'
                 - 'done'
                 - '\n'
-          volumes:
-          - name: git
-            emptyDir: {}
-          - name: values-volume
-            configMap:
-              name: helm-values-configmap-example
+          volumes:            
+            - name: git
+              emptyDir: {}
+            - name: values-volume
+              configMap:
+                name: helm-values-configmap-example
           restartPolicy: Never
 ---
 # Source: clustergroup/templates/core/subscriptions.yaml
@@ -670,6 +689,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   ignoreDifferences: [
   {
     "group": "internal.open-cluster-management.io",
@@ -736,6 +757,8 @@ spec:
           value: apps.region.example.com
         - name: global.privateRepo
           value: 
+        - name: global.experimentalCapabilities
+          value: 
   syncPolicy:
     automated: {}
     retry: