Add TLS strict-adherence and PQC-readiness scanner jobs for ocp-release-operator-sdk and ansible-operator-plugins - #83172
Conversation
…tors Deploys the sample memcached operator built from the existing osdk-helm-e2e / ansible-operator-e2e images and runs the tls-13 / tls-scanner-run steps against it, mirroring the tls13-adherence and tls-pqc-readiness (+ periodic) pattern used by oadp-operator and other repos. Co-authored-by: Cursor <cursoragent@cursor.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (4)
📒 Files selected for processing (2)
WalkthroughThe change adds the ChangesTLS scanner validation
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant CI job
participant memcached molecule operator
participant TLS 1.3 workflow
participant TLS scanner workflow
CI job->>memcached molecule operator: Deploy operator
memcached molecule operator-->>CI job: Confirm availability
CI job->>TLS 1.3 workflow: Run adherence or PQC checks
CI job->>TLS scanner workflow: Run scanner workflow
Possibly related PRs
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: mytreya-rh The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
[REHEARSALNOTIFIER]
A total of 26 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse pull-ci-openshift-ansible-operator-plugins-main-tls13-adherence pull-ci-openshift-ansible-operator-plugins-main-tls-pqc-readiness pull-ci-openshift-ocp-release-operator-sdk-main-tls13-adherence pull-ci-openshift-ocp-release-operator-sdk-main-tls-pqc-readiness |
|
@mytreya-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@mytreya-rh: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Summary
Adds TLS 1.3 strict-adherence and post-quantum-cryptography (PQC) readiness scanner jobs for
openshift/ocp-release-operator-sdkandopenshift/ansible-operator-plugins, mirroring thetls13-adherence/tls-pqc-readiness(+-periodic) pattern already used byoadp-operator,machine-config-operator, and the CSI driver operators.For each repo, this adds 4 tests:
tls13-adherence(presubmit,optional: true,always_run: false— triggerable via/test tls13-adherence): sets the cluster TLS profile toModernwith strict TLS adherence (TLS_13_ENABLE_TLS_ADHERENCE: "true", policyStrictAllComponents), then scans the deployed sample operator's namespace.tls13-adherence-periodic(weekly cron): same as above, runs automatically.tls-pqc-readiness(presubmit,optional: true,always_run: false— triggerable via/test tls-pqc-readiness): scans the deployed sample operator's namespace withPQC_CHECK: "true"(checks TLS 1.3 + mlkem/mlkem25519 support).tls-pqc-readiness-periodic(weekly cron): same as above, runs automatically.Since neither repo ships an OLM bundle, each job first deploys the repo's own sample memcached operator (built from the existing
osdk-helm-e2e/ansible-operator-e2ee2e images, same as the existinge2e-helm/e2e-ansiblejobs) intomemcached-operator-system/memcached-molecule-operator-systemviamake deploy IMG=..., waits for the deployment to become available, and then runs thetls-13andtls-scanner-runstep-registry refs against that namespace.Both configs also gain a
base_images.tls-scanner-toolentry, required by thetls-scanner-runref'sPULL_SPEC_TLS_SCANNER_TOOLdependency.Test plan
make updateregeneratedci-operator/jobs/**presubmits/periodics for both repos with no unexpected diffs.make jobs(ci-operator-checkconfig+ci-operator-prowgen+sanitize-prow-jobs) completed with no errors, validating the new step-registry refs/workflow usage./test tls13-adherenceand/test tls-pqc-readinesson a PR against each repo to confirm the sample operator deploys and the scan runs end-to-end.Made with Cursor
Summary by CodeRabbit
openshift/ocp-release-operator-sdkandopenshift/ansible-operator-plugins.tls-scanner-toolas a base image dependency and configures TLS and PQC scanner settings.