From 4d4d7916634947e6b4e087b3a1826f1206233d90 Mon Sep 17 00:00:00 2001
From: Todd Swatling <todd.swatling@gmail.com>
Date: Mon, 16 Dec 2024 14:14:06 -0500
Subject: [PATCH] operators-installer - private registry support tests refactor

implement/refactor unit tests for the operators-installer operator approvaer job image pull from a private registry
---
 .../action.yaml                               | 168 ++++++++++++++++++
 ...integration-tests-operators-installer.yaml | 150 +++++++---------
 .github/workflows/install-unit-test.yaml      |  59 +-----
 .../kind-config.yaml                          |   5 +
 .../private-registry/Chart.yaml               |   0
 _test/private-registry/README.md              |   4 +
 .../templates/ConfigMap_local-registry.yaml   |  11 ++
 .../templates/Deployment_registry.yaml        |   0
 .../private-registry/templates/Ingress.yaml   |   2 +-
 .../templates/PersistentVolumeClaim.yaml      |   0
 .../templates/Secret_htpasswd.yaml            |   0
 .../private-registry/templates/Service.yaml   |   0
 .../private-registry/templates/values.yaml    |   0
 _test/private-registry/values.yaml            |   3 +
 .../private-registry/values.yaml              |   3 -
 ...c-intermediate-manual-upgrades-values.yaml |   4 +-
 ...-approver-image-from-private-registry.yaml |  23 +++
 ...ator-approve-not-via-helm-hook-values.yaml |   4 +-
 18 files changed, 283 insertions(+), 153 deletions(-)
 create mode 100644 .github/actions/setup-kind-cluster-for-helm-chart-testing/action.yaml
 rename {charts/operators-installer/_integration-tests => _test}/kind-config.yaml (54%)
 rename {charts/operators-installer/_integration-tests => _test}/private-registry/Chart.yaml (100%)
 create mode 100644 _test/private-registry/README.md
 create mode 100644 _test/private-registry/templates/ConfigMap_local-registry.yaml
 rename {charts/operators-installer/_integration-tests => _test}/private-registry/templates/Deployment_registry.yaml (100%)
 rename {charts/operators-installer/_integration-tests => _test}/private-registry/templates/Ingress.yaml (86%)
 rename {charts/operators-installer/_integration-tests => _test}/private-registry/templates/PersistentVolumeClaim.yaml (100%)
 rename {charts/operators-installer/_integration-tests => _test}/private-registry/templates/Secret_htpasswd.yaml (100%)
 rename {charts/operators-installer/_integration-tests => _test}/private-registry/templates/Service.yaml (100%)
 rename {charts/operators-installer/_integration-tests => _test}/private-registry/templates/values.yaml (100%)
 create mode 100644 _test/private-registry/values.yaml
 delete mode 100644 charts/operators-installer/_integration-tests/private-registry/values.yaml
 create mode 100644 charts/operators-installer/_integration-tests/test-install-operator-with-approver-image-from-private-registry.yaml

diff --git a/.github/actions/setup-kind-cluster-for-helm-chart-testing/action.yaml b/.github/actions/setup-kind-cluster-for-helm-chart-testing/action.yaml
new file mode 100644
index 00000000..5de80753
--- /dev/null
+++ b/.github/actions/setup-kind-cluster-for-helm-chart-testing/action.yaml
@@ -0,0 +1,168 @@
+name: 'Setup Kind Cluster for Helm Chart Testing'
+description: 'Setup Kind cluster for testing Helm Charts that expect to run with OLM and ingress'
+inputs:
+  # renovate: datasource=github-releases depName=helm/helm
+  helm-version:
+    description: helm version to install
+    required: true
+    default: 'v3.16.3'
+  
+  # renovate: datasource=github-tags depName=python/cpython
+  python-version:
+    description: python version to install
+    required: true
+    default: 'v3.13.0'
+
+  # renovate: datasource=github-releases depName=kubernetes-sigs/kind
+  kind-version:
+    description: kind version to install
+    required: true
+    default: 'v0.25.0'
+
+  # renovate: datasource=github-releases depName=operator-framework/operator-lifecycle-manager
+  olm-version:
+    description: olm version to install
+    required: true
+    default: 'v0.30.0'
+
+  local-registry-enabled:
+    description: whether to enable local authenticated registry
+    required: true
+    type: boolean
+    default: false
+
+  local-registry-user:
+    description: local authenticated registry username
+    required: false
+    default: 'registryuser1'
+
+  local-registry-password: 
+    description: local authenticated registry password
+    required: false
+    default: 'registrypassword1'
+
+  local-registry-uri:
+    description: local authenticated registry uri
+    required: false
+    default: 'registry.localhost'
+
+  local-registry-images:
+    description: space separated list of remote container images to seed into the local private registry
+    required: false
+    default: ''
+
+runs:
+  using: "composite"
+  steps:
+  - name: Setup Helm 🧰
+    uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4
+    with:
+      version: ${{ inputs.helm-version }}
+
+  - name: Setup Python 🐍
+    uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
+    with:
+      python-version: ${{ inputs.python-version }}
+
+  - name: Setup kind cluster 🧰
+    uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
+    with:
+      version: ${{ inputs.kind-version }}
+      config: _test/kind-config.yaml
+
+  # for helm charts we are testing that require installing operators 
+  - name: Setup kind cluster - Install OLM 🧰
+    env:
+      OLM_VERSION: ${{ inputs.olm-version }}
+    shell: bash
+    run: |
+      curl -L https://github.com/operator-framework/operator-lifecycle-manager/releases/download/${OLM_VERSION}/install.sh -o install.sh
+      chmod +x install.sh
+        ./install.sh ${OLM_VERSION}
+
+  # for helm charts we are testing that require ingress
+  - name: Setup kind cluster - Install ingress controller 🧰
+    shell: bash
+    run: |
+      helm repo add haproxy-ingress https://haproxy-ingress.github.io/charts
+      helm install haproxy-ingress haproxy-ingress/haproxy-ingress \
+          --create-namespace --namespace=ingress-controller \
+          --set controller.hostNetwork=true
+      kubectl apply -f - <<EOF
+      apiVersion: networking.k8s.io/v1
+      kind: IngressClass
+      metadata:
+        name: haproxy
+        annotations:
+          ingressclass.kubernetes.io/is-default-class: 'true'
+      spec:
+        controller: haproxy-ingress.github.io/controller
+      EOF
+
+  # for helm charts we are testing that require/expect certain default namespaces from Red Hat OpenShift
+  - name: Setup kind cluster - create expected namespaces 🧰
+    shell: bash
+    run: |
+      kubectl create namespace openshift-operators
+
+  # install private registry for those that need it
+  - name: Setup kind cluster - install private registry 🧰
+    env:
+      LOCAL_REGISTRY_USER: ${{ inputs.local-registry-user }}
+      LOCAL_REGISTRY_PASSWORD: ${{ inputs.local-registry-password }}
+      LOCAL_REGISTRY_URI: ${{ inputs.local-registry-uri }}
+    shell: bash
+    run: |
+      helm upgrade --install private-registry _test/private-registry \
+        --namespace registry \
+        --create-namespace \
+        --wait \
+        --set registryUser=${LOCAL_REGISTRY_USER} \
+        --set registryPassword=${LOCAL_REGISTRY_PASSWORD} \
+        --set registryIngressHost=${LOCAL_REGISTRY_URI}
+    if: inputs.local-registry-enabled == 'true'
+  
+  # copy images needed by CT tests that use private registry to the private registry
+  - name: Setup kind cluster - Copy images into private registry 🔺
+    env:
+      LOCAL_REGISTRY_USER: ${{ inputs.local-registry-user }}
+      LOCAL_REGISTRY_PASSWORD: ${{ inputs.local-registry-password }}
+      LOCAL_REGISTRY_URI: ${{ inputs.local-registry-uri }}
+      LOCAL_REGISTRY_IMAGES: ${{ inputs.local-registry-images }}
+    shell: bash
+    run: |
+      for image in ${LOCAL_REGISTRY_IMAGES}; do
+          image_name_regex='.*\/(.*$)'
+          if [[ "${image}" =~ ${image_name_regex} ]]; then
+              image_name="${BASH_REMATCH[1]}"
+              remote_image="docker://${image}"
+              local_image="docker://${LOCAL_REGISTRY_URI}/${image_name}"
+
+              echo "Copy image (${remote_image}) to local registry (${local_image})"
+              skopeo copy \
+                --dest-creds ${LOCAL_REGISTRY_USER}:${LOCAL_REGISTRY_PASSWORD} \
+                --dest-tls-verify=false \
+                ${remote_image} \
+                ${local_image}
+          else
+              echo "ERROR: parsing image name from source image uri: ${image}"
+              exit 1
+          fi
+      done
+    if: inputs.local-registry-enabled == 'true'
+
+  # SOURCE: https://kind.sigs.k8s.io/docs/user/local-registry/
+  - name: Setup kind cluster - Add the registry config to the nodes 🧰
+    env:
+      LOCAL_REGISTRY_URI: ${{ inputs.local-registry-uri }}
+      CLUSTER_NAME: chart-testing
+    shell: bash
+    run: |
+      REGISTRY_DIR="/etc/containerd/certs.d/${LOCAL_REGISTRY_URI}"
+      for node in $(kind get nodes -n "${CLUSTER_NAME}"); do
+        docker exec "${node}" mkdir -p "${REGISTRY_DIR}"
+        cat <<EOF | docker exec -i "${node}" cp /dev/stdin "${REGISTRY_DIR}/hosts.toml"
+      [host."http://${LOCAL_REGISTRY_URI}"]
+      EOF
+      done
+    if: inputs.local-registry-enabled == 'true'
diff --git a/.github/workflows/install-integration-tests-operators-installer.yaml b/.github/workflows/install-integration-tests-operators-installer.yaml
index a506f5c5..73062191 100644
--- a/.github/workflows/install-integration-tests-operators-installer.yaml
+++ b/.github/workflows/install-integration-tests-operators-installer.yaml
@@ -3,13 +3,12 @@
 #
 # NOTE: can't use chart-testing because `ct` does not allow for a fixed release so you can't run two different tests that affect the same resources
 
-name: Install Integration Test - operators-installer
+name: Install Integration Tests - operators-installer
 
 on:
   pull_request:
     paths:
     - .github/**
-    - _test/charts-integration-tests/operators-installer/**
     - charts/operators-installer/**
 
 # Declare default permissions as read only.
@@ -19,87 +18,20 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-env:
-  registry_user: registryuser1
-  registry_password: registrypassword1
-
 jobs:
-  install-integration-test:
+  test-install-and-multi-stage-upgrade:
     runs-on: ubuntu-latest
     env:
-      # renovate: datasource=github-releases depName=helm/helm
-      HELM_VERSION: v3.16.3
-      # renovate: datasource=github-tags depName=python/cpython
-      PYTHON_VERSION: v3.13.0
-      # renovate: datasource=github-releases depName=kubernetes-sigs/kind
-      KIND_VERSION: v0.25.0
-      # renovate: datasource=github-releases depName=operator-framework/operator-lifecycle-manager
-      OLM_VERSION: v0.30.0
+      TEST_NAMESPACE: 'operators-installer-integration-test'
     steps:
     - name: Checkout 🛎️
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         fetch-depth: 0
-
-    - name: Setup Helm 🧰
-      uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4
-      with:
-        version: ${{ env.HELM_VERSION }}
-
-    - name: Setup Python 🐍
-      uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
-      with:
-        python-version: ${{ env.PYTHON_VERSION }}
-
-    - name: Setup kind cluster 🧰
-      uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
-      with:
-        version: ${{ env.KIND_VERSION }}
-        config: charts/operators-installer/_integration-tests/kind-config.yaml
-
-    # for helm charts we are testing that require installing operators 
-    - name: Setup kind cluster - Install OLM 🧰
-      run: |
-        curl -L https://github.com/operator-framework/operator-lifecycle-manager/releases/download/${OLM_VERSION}/install.sh -o install.sh
-        chmod +x install.sh
-        ./install.sh ${OLM_VERSION}
-
-    # for helm charts we are testing that require ingress
-    - name: Setup kind cluster - Install ingress controller 🧰
-      run: |
-        helm repo add haproxy-ingress https://haproxy-ingress.github.io/charts
-        helm install haproxy-ingress haproxy-ingress/haproxy-ingress \
-            --create-namespace --namespace=ingress-controller \
-            --set controller.hostNetwork=true
-        kubectl apply -f - <<EOF
-        apiVersion: networking.k8s.io/v1
-        kind: IngressClass
-        metadata:
-          name: haproxy
-          annotations:
-            ingressclass.kubernetes.io/is-default-class: 'true'
-        spec:
-          controller: haproxy-ingress.github.io/controller
-        EOF
-
-    # for testing operators-installer image from private repository
-    - name: Setup private registry in kind cluster 🧰
-      run: |
-        helm upgrade --install private-registry charts/operators-installer/_integration-tests/private-registry \
-          --namespace registry \
-          --create-namespace \
-          --wait \
-          --set registryUser=${registry_user} \
-          --set registryPassword=${registry_password}
-
-    # copies image used to install argo into local private registry
-    - name: Copy image into private repository 💿
-      run: |
-        skopeo copy \
-          --dest-creds ${registry_user}:${registry_password} \
-          --dest-tls-verify=false \
-          docker://$(awk '$1 ~/Image:/ {print $2}' charts/operators-installer/_integration-tests/test-install-operator-0-automatic-intermediate-manual-upgrades-values.yaml) \
-          docker://registry.localhost/origin-cli:5000
+    
+    # set up kind cluster (using re-usable local composite action)
+    - name: Setup Kind Cluster for Helm Chart Testing 🧰
+      uses: ./.github/actions/setup-kind-cluster-for-helm-chart-testing
 
     # NOTE: can't use chart-testing because `ct` does not allow for a fixed release so you can't run two different tests that affect the same resources
     - name: Run integration tests 🧪
@@ -108,27 +40,69 @@ jobs:
         echo "##########################################################################################################"
         echo "# Install argo at old version                                                                            #"
         echo "##########################################################################################################"
-        helm upgrade --install operators-installer-integration-test charts/operators-installer \
-          --namespace operators-installer-integration-test \
+        helm upgrade --install install-and-multi-stage-upgrade charts/operators-installer \
+          --namespace ${TEST_NAMESPACE} \
           --create-namespace \
           --wait \
           --values charts/operators-installer/_integration-tests/test-install-operator-0-automatic-intermediate-manual-upgrades-values.yaml \
           --debug --timeout 10m0s
 
         echo "##########################################################################################################"
-        echo "# Create pull secret used in next step                                                                   #"
+        echo "# Upgrade argo to newer version requiring many intermediate updates along the way                        #"
         echo "##########################################################################################################"
-        oc create secret docker-registry local-registry-pullsecret \
-          --namespace operators-installer-integration-test \
-          --docker-password="${registry_user}" \
-          --docker-username="${registry_password}" \
-          --docker-server=registry.localhost
+        helm upgrade --install install-and-multi-stage-upgrade charts/operators-installer \
+          --namespace ${TEST_NAMESPACE} \
+          --wait \
+          --values charts/operators-installer/_integration-tests/test-install-operator-1-automatic-intermediate-manual-upgrades-values.yaml \
+          --debug --timeout 30m0s
+
+  test-approver-job-image-from-authenticated-registry:
+    runs-on: ubuntu-latest
+    env:
+      TEST_NAMESPACE: 'external-secrets-operator'
+      LOCAL_REGISTRY_USER: registryuser1
+      LOCAL_REGISTRY_PASSWORD: registrypassword1
+      LOCAL_REGISTRY_URI: registry.localhost
+      LOCAL_REGISTRY_IMAGES: "quay.io/openshift/origin-cli:4.15" # space separated
+    steps:
+    - name: Checkout 🛎️
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      with:
+        fetch-depth: 0
+    
+    # set up kind cluster (using re-usable local composite action)
+    - name: Setup Kind Cluster for Helm Chart Testing 🧰
+      uses: ./.github/actions/setup-kind-cluster-for-helm-chart-testing
+      with:
+        local-registry-enabled: true
+        local-registry-user: ${{ env.LOCAL_REGISTRY_USER }}
+        local-registry-password: ${{ env.LOCAL_REGISTRY_PASSWORD }}
+        local-registry-uri: ${{ env.LOCAL_REGISTRY_URI }}
+        local-registry-images: "quay.io/openshift/origin-cli:4.15" # space separated
+
+    # create test namespace
+    - name: Setup kind cluster - create test namespace 🧰
+      run: |
+        kubectl create namespace ${TEST_NAMESPACE}
 
+    # create pull secret for pulling images
+    - name: Setup kind cluster - create pull secret for private registry 🧰
+      run: |
+        kubectl create secret docker-registry local-registry-pullsecret \
+          --namespace ${TEST_NAMESPACE} \
+          --docker-username="${LOCAL_REGISTRY_USER}" \
+          --docker-password="${LOCAL_REGISTRY_PASSWORD}" \
+          --docker-server=${LOCAL_REGISTRY_URI}
+
+    # NOTE: can't use chart-testing because `ct` does not allow for a fixed release so you can't run two different tests that affect the same resources
+    - name: Run integration tests 🧪
+      timeout-minutes: 10
+      run: |
         echo "##########################################################################################################"
-        echo "# Upgrade argo to newer version requiring many intermediate updates along the way                        #"
+        echo "# Install operator using approver job image from private authenticated registry                          #"
         echo "##########################################################################################################"
-        helm upgrade --install operators-installer-integration-test charts/operators-installer \
-          --namespace operators-installer-integration-test \
+        helm upgrade --install approver-from-authed-registry charts/operators-installer \
+          --namespace ${TEST_NAMESPACE} \
           --wait \
-          --values charts/operators-installer/_integration-tests/test-install-operator-1-automatic-intermediate-manual-upgrades-values.yaml \
-          --debug --timeout 35m0s
+          --values charts/operators-installer/_integration-tests/test-install-operator-with-approver-image-from-private-registry.yaml \
+          --debug --timeout 9m0s
diff --git a/.github/workflows/install-unit-test.yaml b/.github/workflows/install-unit-test.yaml
index 777bc472..b366cff5 100644
--- a/.github/workflows/install-unit-test.yaml
+++ b/.github/workflows/install-unit-test.yaml
@@ -17,31 +17,12 @@ concurrency:
 jobs:
   install-test:
     runs-on: ubuntu-latest
-    env:
-      # renovate: datasource=github-releases depName=helm/helm
-      HELM_VERSION: v3.16.3
-      # renovate: datasource=github-tags depName=python/cpython
-      PYTHON_VERSION: v3.13.0
-      # renovate: datasource=github-releases depName=kubernetes-sigs/kind
-      KIND_VERSION: v0.25.0
-      # renovate: datasource=github-releases depName=operator-framework/operator-lifecycle-manager
-      OLM_VERSION: v0.30.0
     steps:
     - name: Checkout 🛎️
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         fetch-depth: 0
 
-    - name: Setup Helm 🧰
-      uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4
-      with:
-        version: ${{ env.HELM_VERSION }}
-
-    - name: Setup Python 🐍
-      uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
-      with:
-        python-version: ${{ env.PYTHON_VERSION }}
-
     - name: Setup chart-testing 🧰
       uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
     
@@ -53,44 +34,10 @@ jobs:
         if [[ -n "$changed" ]]; then
           echo "changed=true" >> $GITHUB_OUTPUT
         fi
-
-    - name: Setup kind cluster 🧰
-      uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
-      with:
-        version: ${{ env.KIND_VERSION }}
-      if: steps.changed-charts.outputs.changed == 'true'
-
-    # for helm charts we are testing that require installing operators 
-    - name: Setup kind cluster - Install OLM 🧰
-      run: |
-        curl -L https://github.com/operator-framework/operator-lifecycle-manager/releases/download/${OLM_VERSION}/install.sh -o install.sh
-        chmod +x install.sh
-        ./install.sh ${OLM_VERSION}
-      if: steps.changed-charts.outputs.changed == 'true'
-
-    # for helm charts we are testing that require ingress
-    - name: Setup kind cluster - Install ingress controller 🧰
-      run: |
-        helm repo add haproxy-ingress https://haproxy-ingress.github.io/charts
-        helm install haproxy-ingress haproxy-ingress/haproxy-ingress \
-            --create-namespace --namespace=ingress-controller \
-            --set controller.hostNetwork=true
-        kubectl apply -f - <<EOF
-        apiVersion: networking.k8s.io/v1
-        kind: IngressClass
-        metadata:
-          name: haproxy
-          annotations:
-            ingressclass.kubernetes.io/is-default-class: 'true'
-        spec:
-          controller: haproxy-ingress.github.io/controller
-        EOF
-      if: steps.changed-charts.outputs.changed == 'true'
     
-    # for helm charts we are testing that require/expect certain default namespaces from Red Hat OpenShift
-    - name: Setup kind cluster - create expected namespaces 🧰
-      run: |
-        kubectl create namespace openshift-operators
+    # set up kind cluster (using re-usable local composite action)
+    - name: Setup Kind Cluster for Helm Chart Testing 🧰
+      uses: ./.github/actions/setup-kind-cluster-for-helm-chart-testing
       if: steps.changed-charts.outputs.changed == 'true'
 
     - name: Run unit tests 🧪
diff --git a/charts/operators-installer/_integration-tests/kind-config.yaml b/_test/kind-config.yaml
similarity index 54%
rename from charts/operators-installer/_integration-tests/kind-config.yaml
rename to _test/kind-config.yaml
index a98c1a92..a45aa5d2 100644
--- a/charts/operators-installer/_integration-tests/kind-config.yaml
+++ b/_test/kind-config.yaml
@@ -10,3 +10,8 @@ nodes:
     hostPort: 80
     protocol: TCP
 
+# SOURCE: https://kind.sigs.k8s.io/docs/user/local-registry/
+containerdConfigPatches:
+- |-
+  [plugins."io.containerd.grpc.v1.cri".registry]
+    config_path = "/etc/containerd/certs.d"
diff --git a/charts/operators-installer/_integration-tests/private-registry/Chart.yaml b/_test/private-registry/Chart.yaml
similarity index 100%
rename from charts/operators-installer/_integration-tests/private-registry/Chart.yaml
rename to _test/private-registry/Chart.yaml
diff --git a/_test/private-registry/README.md b/_test/private-registry/README.md
new file mode 100644
index 00000000..ddcc6376
--- /dev/null
+++ b/_test/private-registry/README.md
@@ -0,0 +1,4 @@
+# private-registry
+Creates a private local registry with basic auth.
+
+Ideally would just use the built in private registry with the 'kind' github action, but it does not currently (as of Jan 15, 2025) support configuring basic auth which is needed for some of our testing.
diff --git a/_test/private-registry/templates/ConfigMap_local-registry.yaml b/_test/private-registry/templates/ConfigMap_local-registry.yaml
new file mode 100644
index 00000000..003ef093
--- /dev/null
+++ b/_test/private-registry/templates/ConfigMap_local-registry.yaml
@@ -0,0 +1,11 @@
+---
+# SOURCE: https://kind.sigs.k8s.io/docs/user/local-registry/
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: local-registry-hosting
+  namespace: kube-public
+data:
+  localRegistryHosting.v1: |
+    host: "{{ .Values.registryIngressHost }}"
+    help: "https://kind.sigs.k8s.io/docs/user/local-registry/"
diff --git a/charts/operators-installer/_integration-tests/private-registry/templates/Deployment_registry.yaml b/_test/private-registry/templates/Deployment_registry.yaml
similarity index 100%
rename from charts/operators-installer/_integration-tests/private-registry/templates/Deployment_registry.yaml
rename to _test/private-registry/templates/Deployment_registry.yaml
diff --git a/charts/operators-installer/_integration-tests/private-registry/templates/Ingress.yaml b/_test/private-registry/templates/Ingress.yaml
similarity index 86%
rename from charts/operators-installer/_integration-tests/private-registry/templates/Ingress.yaml
rename to _test/private-registry/templates/Ingress.yaml
index 1fe0a0ed..307570b7 100644
--- a/charts/operators-installer/_integration-tests/private-registry/templates/Ingress.yaml
+++ b/_test/private-registry/templates/Ingress.yaml
@@ -5,7 +5,7 @@ metadata:
   namespace: registry
 spec:
   rules:
-  - host: registry.localhost
+  - host: {{ .Values.registryIngressHost }}
     http:
       paths:
       - path: /
diff --git a/charts/operators-installer/_integration-tests/private-registry/templates/PersistentVolumeClaim.yaml b/_test/private-registry/templates/PersistentVolumeClaim.yaml
similarity index 100%
rename from charts/operators-installer/_integration-tests/private-registry/templates/PersistentVolumeClaim.yaml
rename to _test/private-registry/templates/PersistentVolumeClaim.yaml
diff --git a/charts/operators-installer/_integration-tests/private-registry/templates/Secret_htpasswd.yaml b/_test/private-registry/templates/Secret_htpasswd.yaml
similarity index 100%
rename from charts/operators-installer/_integration-tests/private-registry/templates/Secret_htpasswd.yaml
rename to _test/private-registry/templates/Secret_htpasswd.yaml
diff --git a/charts/operators-installer/_integration-tests/private-registry/templates/Service.yaml b/_test/private-registry/templates/Service.yaml
similarity index 100%
rename from charts/operators-installer/_integration-tests/private-registry/templates/Service.yaml
rename to _test/private-registry/templates/Service.yaml
diff --git a/charts/operators-installer/_integration-tests/private-registry/templates/values.yaml b/_test/private-registry/templates/values.yaml
similarity index 100%
rename from charts/operators-installer/_integration-tests/private-registry/templates/values.yaml
rename to _test/private-registry/templates/values.yaml
diff --git a/_test/private-registry/values.yaml b/_test/private-registry/values.yaml
new file mode 100644
index 00000000..67b12ec2
--- /dev/null
+++ b/_test/private-registry/values.yaml
@@ -0,0 +1,3 @@
+registryUser:
+registryPassword:
+registryIngressHost: registry.localhost
diff --git a/charts/operators-installer/_integration-tests/private-registry/values.yaml b/charts/operators-installer/_integration-tests/private-registry/values.yaml
deleted file mode 100644
index f3539e4d..00000000
--- a/charts/operators-installer/_integration-tests/private-registry/values.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-registryUser:
-registryPassword:
-
diff --git a/charts/operators-installer/_integration-tests/test-install-operator-1-automatic-intermediate-manual-upgrades-values.yaml b/charts/operators-installer/_integration-tests/test-install-operator-1-automatic-intermediate-manual-upgrades-values.yaml
index 83d89f0a..bc6c55b0 100644
--- a/charts/operators-installer/_integration-tests/test-install-operator-1-automatic-intermediate-manual-upgrades-values.yaml
+++ b/charts/operators-installer/_integration-tests/test-install-operator-1-automatic-intermediate-manual-upgrades-values.yaml
@@ -1,8 +1,6 @@
 approveManualInstallPlanViaHook: true
 
-# use pull secret to pull image from local private registry
-installPlanApproverAndVerifyJobsImage: registry.localhost/origin-cli
-installPlanApproverAndVerifyJobsImagePullSecret: local-registry-pullsecret
+installPlanApproverAndVerifyJobsImage: quay.io/openshift/origin-cli:4.15
 
 operatorGroups:
 - name: argocd-operator
diff --git a/charts/operators-installer/_integration-tests/test-install-operator-with-approver-image-from-private-registry.yaml b/charts/operators-installer/_integration-tests/test-install-operator-with-approver-image-from-private-registry.yaml
new file mode 100644
index 00000000..468cf2f6
--- /dev/null
+++ b/charts/operators-installer/_integration-tests/test-install-operator-with-approver-image-from-private-registry.yaml
@@ -0,0 +1,23 @@
+approveManualInstallPlanViaHook: true
+
+# use pull secret to pull image from local private registry
+installPlanApproverAndVerifyJobsImage: registry.localhost/origin-cli:4.15
+installPlanApproverAndVerifyJobsImagePullSecret: local-registry-pullsecret
+
+operatorGroups:
+- name: external-secrets-operator
+  createNamespace: false
+  targetOwnNamespace: false
+  otherTargetNamespaces:
+
+operators:
+- channel: stable
+  installPlanApproval: Manual
+  name: external-secrets-operator
+  source: operatorhubio-catalog
+  sourceNamespace: olm
+  csv: external-secrets-operator.v0.8.1
+  namespace: external-secrets-operator
+  installPlanVerifierActiveDeadlineSeconds: 1200
+commonLabels:
+  test-label: xyz123
\ No newline at end of file
diff --git a/charts/operators-installer/ci/test-install-old-operator-approve-not-via-helm-hook-values.yaml b/charts/operators-installer/ci/test-install-old-operator-approve-not-via-helm-hook-values.yaml
index 98b19db7..c32bc420 100644
--- a/charts/operators-installer/ci/test-install-old-operator-approve-not-via-helm-hook-values.yaml
+++ b/charts/operators-installer/ci/test-install-old-operator-approve-not-via-helm-hook-values.yaml
@@ -3,7 +3,7 @@ approveManualInstallPlanViaHook: false
 installPlanApproverAndVerifyJobsImage: quay.io/openshift/origin-cli:4.15
 
 operatorGroups:
-- name: external-secrets-operator-2
+- name: external-secrets-operator
   createNamespace: true
   targetOwnNamespace: false
   otherTargetNamespaces:
@@ -15,7 +15,7 @@ operators:
   source: operatorhubio-catalog
   sourceNamespace: olm
   csv: external-secrets-operator.v0.8.1
-  namespace: external-secrets-operator-2
+  namespace: external-secrets-operator
   installPlanVerifierActiveDeadlineSeconds: 1200
 commonLabels:
   test-label: xyz123