From 69c563f45f0cd629343b885e80e9242547b6fa4d Mon Sep 17 00:00:00 2001
From: John Mazzitelli <mazz@redhat.com>
Date: Mon, 2 May 2022 16:44:23 -0400
Subject: [PATCH] abort if operator is not allowed to do it

---
 roles/default/kiali-deploy/tasks/main.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/roles/default/kiali-deploy/tasks/main.yml b/roles/default/kiali-deploy/tasks/main.yml
index 841c1dd4..79ebdd8d 100644
--- a/roles/default/kiali-deploy/tasks/main.yml
+++ b/roles/default/kiali-deploy/tasks/main.yml
@@ -143,6 +143,13 @@
   # restrict to 40 chars, not 63, because instance_name is a prefix and we need to prepend additional chars for some resource names (like "-service-account")
   - kiali_vars.deployment.instance_name is not regex('^(?![0-9]+$)(?!-)[a-z0-9-]{,40}(?<!-)$')
 
+- name: Only allow ad-hoc containers when appropriate
+  fail:
+    msg: "The operator is forbidden from installing additional containers into the Kiali pod."
+  when:
+  - kiali_vars.deployment.additional_pod_containers_yaml|length > 0
+  - lookup('env', 'ALLOW_AD_HOC_CONTAINERS') | default('false', True) != "true"
+
 - set_fact:
     status_environment: "{{ status_environment | default({}) | combine({item.0: item.1}) }}"
   loop: "{{ data[0] | zip(data[1]) | list }}"