diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml index 6ae72b658810a..50ca2570dc0e2 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml @@ -11,6 +11,10 @@ base_images: name: hypershift-tests namespace: hypershift tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -307,6 +311,45 @@ tests: requests: cpu: 100m workflow: ingress-vsphere-static-metallb +- always_run: false + as: tls-scanner-aws-gatewayapi + optional: true + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + steps: + cluster_profile: openshift-org-aws + env: + COMPONENT_FILTER: tls-scanner-gatewayapi + FEATURE_SET: TechPreviewNoUpgrade + GATEWAY_NAME: tls-scanner-gatewayapi + SCAN_NAMESPACE: openshift-ingress + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: setup-gateway + cli: latest + commands: make generate gatewayapi-tls-scanner-setup + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m + - as: patch-gateway + cli: latest + commands: oc patch gateway ${GATEWAY_NAME} -n openshift-ingress --type=json + -p '[{"op":"remove","path":"/spec/listeners/0/hostname"}]' + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m + - ref: tls-scanner-run + - ref: tls-13 + - ref: tls-scanner-recheck + workflow: openshift-e2e-aws-ovn - always_run: false as: e2e-aws-ovn-techpreview optional: true diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml index 371625589410d..0cbf362ac90ba 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml @@ -11,6 +11,10 @@ base_images: name: hypershift-tests namespace: hypershift tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -280,6 +284,45 @@ tests: requests: cpu: 100m workflow: ingress-vsphere-static-metallb +- always_run: false + as: tls-scanner-aws-gatewayapi + optional: true + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + steps: + cluster_profile: openshift-org-aws + env: + COMPONENT_FILTER: tls-scanner-gatewayapi + FEATURE_SET: TechPreviewNoUpgrade + GATEWAY_NAME: tls-scanner-gatewayapi + SCAN_NAMESPACE: openshift-ingress + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: setup-gateway + cli: latest + commands: make generate gatewayapi-tls-scanner-setup + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m + - as: patch-gateway + cli: latest + commands: oc patch gateway ${GATEWAY_NAME} -n openshift-ingress --type=json + -p '[{"op":"remove","path":"/spec/listeners/0/hostname"}]' + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m + - ref: tls-scanner-run + - ref: tls-13 + - ref: tls-scanner-recheck + workflow: openshift-e2e-aws-ovn - always_run: false as: e2e-aws-ovn-techpreview optional: true diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml index 20f4b5b8c6416..a3c7e232c19ac 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml @@ -11,6 +11,10 @@ base_images: name: hypershift-tests namespace: hypershift tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -281,6 +285,45 @@ tests: requests: cpu: 100m workflow: ingress-vsphere-static-metallb +- always_run: false + as: tls-scanner-aws-gatewayapi + optional: true + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + steps: + cluster_profile: openshift-org-aws + env: + COMPONENT_FILTER: tls-scanner-gatewayapi + FEATURE_SET: TechPreviewNoUpgrade + GATEWAY_NAME: tls-scanner-gatewayapi + SCAN_NAMESPACE: openshift-ingress + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: setup-gateway + cli: latest + commands: make generate gatewayapi-tls-scanner-setup + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m + - as: patch-gateway + cli: latest + commands: oc patch gateway ${GATEWAY_NAME} -n openshift-ingress --type=json + -p '[{"op":"remove","path":"/spec/listeners/0/hostname"}]' + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m + - ref: tls-scanner-run + - ref: tls-13 + - ref: tls-scanner-recheck + workflow: openshift-e2e-aws-ovn - always_run: false as: e2e-aws-ovn-techpreview optional: true diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml index 8aa82e44c6d06..3fa222cb45608 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml @@ -11,6 +11,10 @@ base_images: name: hypershift-tests namespace: hypershift tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -280,6 +284,45 @@ tests: requests: cpu: 100m workflow: ingress-vsphere-static-metallb +- always_run: false + as: tls-scanner-aws-gatewayapi + optional: true + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + steps: + cluster_profile: openshift-org-aws + env: + COMPONENT_FILTER: tls-scanner-gatewayapi + FEATURE_SET: TechPreviewNoUpgrade + GATEWAY_NAME: tls-scanner-gatewayapi + SCAN_NAMESPACE: openshift-ingress + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: setup-gateway + cli: latest + commands: make generate gatewayapi-tls-scanner-setup + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m + - as: patch-gateway + cli: latest + commands: oc patch gateway ${GATEWAY_NAME} -n openshift-ingress --type=json + -p '[{"op":"remove","path":"/spec/listeners/0/hostname"}]' + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m + - ref: tls-scanner-run + - ref: tls-13 + - ref: tls-scanner-recheck + workflow: openshift-e2e-aws-ovn - always_run: false as: e2e-aws-ovn-techpreview optional: true diff --git a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml index 677c451dfb846..f06e5c73cc22a 100644 --- a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml +++ b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml @@ -2944,6 +2944,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )okd-scos-images,?($|\s.*) + - agent: kubernetes + always_run: false + annotations: + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + branches: + - ^master$ + - ^master- + cluster: build03 + context: ci/prow/tls-scanner-aws-gatewayapi + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cluster-ingress-operator-master-tls-scanner-aws-gatewayapi + optional: true + rerun_command: /test tls-scanner-aws-gatewayapi + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-aws-gatewayapi + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-aws-gatewayapi,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yaml b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yaml index c009ed8431cae..04d78a3b0fe55 100644 --- a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yaml +++ b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yaml @@ -2372,6 +2372,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )images,?($|\s.*) + - agent: kubernetes + always_run: false + annotations: + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + branches: + - ^release-4\.23$ + - ^release-4\.23- + cluster: build11 + context: ci/prow/tls-scanner-aws-gatewayapi + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cluster-ingress-operator-release-4.23-tls-scanner-aws-gatewayapi + optional: true + rerun_command: /test tls-scanner-aws-gatewayapi + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-aws-gatewayapi + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-aws-gatewayapi,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0-presubmits.yaml b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0-presubmits.yaml index a3766c0678068..1fd5cf35008db 100644 --- a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0-presubmits.yaml +++ b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0-presubmits.yaml @@ -2371,6 +2371,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )images,?($|\s.*) + - agent: kubernetes + always_run: false + annotations: + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + branches: + - ^release-5\.0$ + - ^release-5\.0- + cluster: build10 + context: ci/prow/tls-scanner-aws-gatewayapi + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cluster-ingress-operator-release-5.0-tls-scanner-aws-gatewayapi + optional: true + rerun_command: /test tls-scanner-aws-gatewayapi + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-aws-gatewayapi + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-aws-gatewayapi,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1-presubmits.yaml b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1-presubmits.yaml index a9adcc7271eb4..b2d032be51036 100644 --- a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1-presubmits.yaml +++ b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1-presubmits.yaml @@ -2372,6 +2372,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )images,?($|\s.*) + - agent: kubernetes + always_run: false + annotations: + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + branches: + - ^release-5\.1$ + - ^release-5\.1- + cluster: build10 + context: ci/prow/tls-scanner-aws-gatewayapi + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cluster-ingress-operator-release-5.1-tls-scanner-aws-gatewayapi + optional: true + rerun_command: /test tls-scanner-aws-gatewayapi + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-aws-gatewayapi + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-aws-gatewayapi,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml b/ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml index 962465de31798..96795c35eecdc 100644 --- a/ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml +++ b/ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml @@ -12,6 +12,13 @@ ref: - name: SCAN_NAMESPACE default: "" documentation: "Comma-separated list of namespaces to scan. Empty means scan all namespaces." + - name: COMPONENT_FILTER + default: "" + documentation: |- + Comma-separated list of component names to scan, matched against each pod's + "app", "component", or "app.kubernetes.io/name" label (in that order). Empty + scans all pods in the selected namespace(s). Use this to exclude unrelated + workloads sharing a namespace with the component under test. - name: PQC_CHECK default: "false" documentation: "Set to 'true' to check post-quantum cryptography readiness (scanner will only check TLS 1.3 and mlkem/mlkem25519 support)." diff --git a/ci-operator/step-registry/tls/scanner/recheck/OWNERS b/ci-operator/step-registry/tls/scanner/recheck/OWNERS new file mode 100644 index 0000000000000..0c3a02e9e68c6 --- /dev/null +++ b/ci-operator/step-registry/tls/scanner/recheck/OWNERS @@ -0,0 +1,9 @@ +approvers: + - richardsonnick + - rhmdnd + - smith-xyz +reviewers: + - richardsonnick + - rhmdnd + - smith-xyz + diff --git a/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-commands.sh b/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-commands.sh new file mode 120000 index 0000000000000..13743a4edb908 --- /dev/null +++ b/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-commands.sh @@ -0,0 +1 @@ +../run/tls-scanner-run-commands.sh \ No newline at end of file diff --git a/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-ref.metadata.json b/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-ref.metadata.json new file mode 100644 index 0000000000000..40eec7a1438d7 --- /dev/null +++ b/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-ref.metadata.json @@ -0,0 +1,15 @@ +{ + "path": "tls/scanner/recheck/tls-scanner-recheck-ref.yaml", + "owners": { + "approvers": [ + "richardsonnick", + "rhmdnd", + "smith-xyz" + ], + "reviewers": [ + "richardsonnick", + "rhmdnd", + "smith-xyz" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-ref.yaml b/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-ref.yaml new file mode 100644 index 0000000000000..2ba6939567f10 --- /dev/null +++ b/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-ref.yaml @@ -0,0 +1,64 @@ +ref: + as: tls-scanner-recheck + from: cli + cli: latest + commands: tls-scanner-recheck-commands.sh + env: + - name: SCAN_NAMESPACE + default: "" + documentation: "Comma-separated list of namespaces to scan. Empty means scan all namespaces." + - name: COMPONENT_FILTER + default: "" + documentation: |- + Comma-separated list of component names to scan, matched against each pod's + "app", "component", or "app.kubernetes.io/name" label (in that order). Empty + scans all pods in the selected namespace(s). Use this to exclude unrelated + workloads sharing a namespace with the component under test (e.g. Gateway + API pods sharing openshift-ingress with the non-adherent router-default + pods). + - name: PQC_CHECK + default: "false" + documentation: "Set to 'true' to check post-quantum cryptography readiness (scanner will only check TLS 1.3 and mlkem/mlkem25519 support)." + - name: SCAN_LIMIT_IPS + default: "" + documentation: "Max IPs to scan (empty/0 = no limit). Bounds actual TLS scans after full endpoint discovery." + - name: SCANNER_CPU + default: "4" + documentation: "CPU request/limit for the scanner pod." + - name: SCANNER_MEMORY + default: "4Gi" + documentation: "Memory request/limit for the scanner pod." + - name: TLS_SCANNER_CLUSTER_LABEL + default: "" + documentation: |- + HyperShift scan target label. Set to "management" to scan the shared + management cluster hosted control plane namespace, or "guest" to scan the + hosted cluster. Empty uses the step KUBECONFIG and scans all namespaces. + - name: TLS_PROFILE_TYPE + default: "" + documentation: |- + Expected cluster TLS profile type for compliance checks (Old, Intermediate, + Modern). When set, passes --tls-profile-type to tls-scanner instead of + reading APIServer/cluster from the API. Required for HyperShift hosted + control planes where the guest APIServer CR may not mirror HostedCluster + configuration. + dependencies: + - env: RELEASE_IMAGE_LATEST + name: release:latest + - env: OPENSHIFT_UPGRADE_RELEASE_IMAGE_OVERRIDE + name: release:latest + - env: OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE + name: release:latest + - env: PULL_SPEC_TLS_SCANNER_TOOL + name: tls-scanner-tool + resources: + requests: + cpu: 100m + memory: 200Mi + timeout: 4h0m0s + grace_period: 5m0s + documentation: |- + Alias of tls-scanner-run for use when a job needs to scan twice in the same + multi-stage test (e.g. before and after a TLS profile change). ci-operator + requires unique step names so a second ref that shares the same commands + script via symlink is necessary. diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh index 5d26b101b2dff..162a77e74f2b8 100644 --- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh +++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh @@ -50,6 +50,11 @@ run_tls_scan() { SCANNER_ARGS="--all-pods" fi + if [[ -n "${COMPONENT_FILTER:-}" ]]; then + SCANNER_ARGS="${SCANNER_ARGS} --component-filter ${COMPONENT_FILTER}" + echo "Component filter: ${COMPONENT_FILTER}" + fi + # Enable post-quantum cryptography checks when requested by the step ref. if [[ "${PQC_CHECK:-false}" == "true" ]]; then SCANNER_ARGS="${SCANNER_ARGS} --pqc-check" diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml index d7d22f177e0aa..85ec02cab1c91 100644 --- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml +++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml @@ -7,6 +7,15 @@ ref: - name: SCAN_NAMESPACE default: "" documentation: "Comma-separated list of namespaces to scan. Empty means scan all namespaces." + - name: COMPONENT_FILTER + default: "" + documentation: |- + Comma-separated list of component names to scan, matched against each pod's + "app", "component", or "app.kubernetes.io/name" label (in that order). Empty + scans all pods in the selected namespace(s). Use this to exclude unrelated + workloads sharing a namespace with the component under test (e.g. Gateway + API pods sharing openshift-ingress with the non-adherent router-default + pods). - name: PQC_CHECK default: "false" documentation: "Set to 'true' to check post-quantum cryptography readiness (scanner will only check TLS 1.3 and mlkem/mlkem25519 support)."