Configure Compliance Operator for ROSA HCP

[JustinKuli]

As mentioned in the Compliance Operator documentation, when installed on ROSA hosted control planes, a special node selector must be configured for the operator to run. This update uses conditionals to only make this configuration only on those clusters.

Refs:

• https://issues.redhat.com/browse/ACM-14161

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JustinKuli, yiraeChristineKim

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [JustinKuli,yiraeChristineKim]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dhaiducek]

Nice work! Not necessary to update now, but this would be cleaner as a folded multiline string:

config: >-
  {{ if and 
    (eq "ROSA" (fromClusterClaim "product.open-cluster-management.io"))
    (eq "true" (fromClusterClaim "hostedcluster.hypershift.openshift.io"))
  }}
    {"nodeSelector":{"node-role.kubernetes.io/worker":""} }
  {{ else }}
    {{ "{}" | toLiteral }}
  {{ end }}

But actually, now that I do that, it looks like it'd fail--it has an extra } in there after the nodeSelector?

[JustinKuli]

Using >- is generally a good idea! But multiline yaml can be incredibly frustrating. In this case, the indents break the line folding, so I think this would be necessary:

config: >-
  {{ if and
  (eq "ROSA" (fromClusterClaim "product.open-cluster-management.io"))
  (eq "true" (fromClusterClaim "hostedcluster.hypershift.openshift.io"))
  }}
  {"nodeSelector":{"node-role.kubernetes.io/worker":""} }
  {{ else }}
  {{ "{}" | toLiteral }}
  {{ end }}

You also had a space at the end of the first line, emphasizing how tricky this is.