HYPERFLEET-1202 - fix: Enable adapter API auth

[kuudori]

Summary

• HYPERFLEET-1202

Test Plan

• Unit tests added/updated
• make test-all passes
• make lint passes
• Helm chart changes validated with make test-helm (if applicable)
• Deployed to a development cluster and verified (if Helm/config changes)
• E2E tests passed (if cross-component or major changes)

[coderabbitai]

📝 Walkthrough

Walkthrough

Helper.DeployAdapter now delegates Helm flag construction to adapterHelmSetArgs. The helper preserves existing flags and conditionally adds adapterConfig.hyperfleetApi.auth.enabled=true when token-request authentication is enabled. Table-driven tests cover authentication, run-id labels, fullnameOverride, custom values, and omitted flags.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: crizzo71, ldornele

🚥 Pre-merge checks | ✅ 10 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output	✅ Passed	PASS: In non-test changed code, no logger/fmt statement logs token/password/credential/secret; no CWE-532 pattern introduced.
No Hardcoded Secrets	✅ Passed	No hardcoded creds, embedded credentials, or long base64 strings found; touched files only add Helm flags and test fixtures.
No Weak Cryptography	✅ Passed	No banned primitives, ECB mode, custom crypto, or secret/token comparisons were added in the changed files; only sha256 for release-name hashing is present.
No Injection Vectors	✅ Passed	PASS: no CWE-78/89/79/502 sink was introduced; Helm args are passed via exec.CommandContext, RunID is label-validated, and SetValues only feed helm flags.
No Privileged Containers	✅ Passed	Only pkg/helper Go files changed; no manifests/templates/Dockerfiles or privileged flags (privileged, hostNetwork, runAsUser:0) were introduced.
No Pii Or Sensitive Data In Logs	✅ Passed	The patch only refactors Helm arg assembly; no new log statements were added and no log now emits PII, raw bodies, or credentialed hostnames. CWE-532 not triggered.
Title check	✅ Passed	The title matches the main change: enabling adapter API auth.
Description check	✅ Passed	The description references the Jira ticket for this adapter auth change and is on-topic.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/helper/adapter_test.go`:
- Around line 395-422: Add coverage for the IMAGE_PULL_POLICY branch in
adapterHelmSetArgs by adding a pullPolicyEnv field to the table-driven test case
struct, setting it to "IfNotPresent" for a new case, and applying it with
t.Setenv in the test body. Assert the generated Helm arguments include the
expected image pull policy value while keeping environment isolation safe for
parallel tests.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 81c0be92-773d-4b0e-9baf-dfb6ca8d9ad6

📥 Commits

Reviewing files that changed from the base of the PR and between 7de9a96 and e2c5c6b.

📒 Files selected for processing (2)

• pkg/helper/adapter.go
• pkg/helper/adapter_test.go

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual)
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual)
• openshift-hyperfleet/hyperfleet-broker (manual)

🚧 Files skipped from review as they are similar to previous changes (1)

• pkg/helper/adapter.go

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tirthct

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [tirthct]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment