From 13325f35c1f82b25f1a00cf110034d9062b995e1 Mon Sep 17 00:00:00 2001 From: Ricardo Pchevuzinske Katz Date: Thu, 30 Jul 2026 15:18:13 -0300 Subject: [PATCH 1/4] feat(tls-scanner): add COMPONENT_FILTER support to tls-scanner-run Namespaces can host multiple unrelated components (e.g. Gateway API pods sharing openshift-ingress with the non-adherent router-default pods). Expose the scanner's existing --component-filter flag via a new env var so jobs can scope scans to a single component's pods. --- .../hypershift-run/tls-scanner-hypershift-run-ref.yaml | 7 +++++++ .../tls/scanner/run/tls-scanner-run-commands.sh | 5 +++++ .../tls/scanner/run/tls-scanner-run-ref.yaml | 9 +++++++++ 3 files changed, 21 insertions(+) diff --git a/ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml b/ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml index 962465de31798..96795c35eecdc 100644 --- a/ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml +++ b/ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml @@ -12,6 +12,13 @@ ref: - name: SCAN_NAMESPACE default: "" documentation: "Comma-separated list of namespaces to scan. Empty means scan all namespaces." + - name: COMPONENT_FILTER + default: "" + documentation: |- + Comma-separated list of component names to scan, matched against each pod's + "app", "component", or "app.kubernetes.io/name" label (in that order). Empty + scans all pods in the selected namespace(s). Use this to exclude unrelated + workloads sharing a namespace with the component under test. - name: PQC_CHECK default: "false" documentation: "Set to 'true' to check post-quantum cryptography readiness (scanner will only check TLS 1.3 and mlkem/mlkem25519 support)." diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh index 5d26b101b2dff..162a77e74f2b8 100644 --- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh +++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh @@ -50,6 +50,11 @@ run_tls_scan() { SCANNER_ARGS="--all-pods" fi + if [[ -n "${COMPONENT_FILTER:-}" ]]; then + SCANNER_ARGS="${SCANNER_ARGS} --component-filter ${COMPONENT_FILTER}" + echo "Component filter: ${COMPONENT_FILTER}" + fi + # Enable post-quantum cryptography checks when requested by the step ref. if [[ "${PQC_CHECK:-false}" == "true" ]]; then SCANNER_ARGS="${SCANNER_ARGS} --pqc-check" diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml index d7d22f177e0aa..85ec02cab1c91 100644 --- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml +++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml @@ -7,6 +7,15 @@ ref: - name: SCAN_NAMESPACE default: "" documentation: "Comma-separated list of namespaces to scan. Empty means scan all namespaces." + - name: COMPONENT_FILTER + default: "" + documentation: |- + Comma-separated list of component names to scan, matched against each pod's + "app", "component", or "app.kubernetes.io/name" label (in that order). Empty + scans all pods in the selected namespace(s). Use this to exclude unrelated + workloads sharing a namespace with the component under test (e.g. Gateway + API pods sharing openshift-ingress with the non-adherent router-default + pods). - name: PQC_CHECK default: "false" documentation: "Set to 'true' to check post-quantum cryptography readiness (scanner will only check TLS 1.3 and mlkem/mlkem25519 support)." From bb01809e812a1e90d956023631cc9d4e9c385b0c Mon Sep 17 00:00:00 2001 From: Ricardo Pchevuzinske Katz Date: Thu, 30 Jul 2026 15:18:27 -0300 Subject: [PATCH 2/4] NE-2821: add tls-scanner-gatewayapi job Add an optional presubmit that provisions a TechPreview cluster, enables TLSAdherence, stands up a Gateway with a TLS listener, and scans it with tls-scanner to validate NE-2796 (OpenShift TLS profiles in Istio/Gateway API installation). Added to master and the release-4.23, release-5.0, and release-5.1 branches. --- ...shift-cluster-ingress-operator-master.yaml | 32 +++++++ ...cluster-ingress-operator-release-4.23.yaml | 32 +++++++ ...-cluster-ingress-operator-release-5.0.yaml | 32 +++++++ ...-cluster-ingress-operator-release-5.1.yaml | 32 +++++++ ...er-ingress-operator-master-presubmits.yaml | 87 +++++++++++++++++++ ...ress-operator-release-4.23-presubmits.yaml | 87 +++++++++++++++++++ ...gress-operator-release-5.0-presubmits.yaml | 87 +++++++++++++++++++ ...gress-operator-release-5.1-presubmits.yaml | 87 +++++++++++++++++++ 8 files changed, 476 insertions(+) diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml index 6ae72b658810a..5fd2ea3a1c8fc 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml @@ -11,6 +11,10 @@ base_images: name: hypershift-tests namespace: hypershift tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -307,6 +311,34 @@ tests: requests: cpu: 100m workflow: ingress-vsphere-static-metallb +- always_run: false + as: tls-scanner-gatewayapi + optional: true + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + steps: + cluster_profile: openshift-org-aws + env: + COMPONENT_FILTER: tls-scanner-gatewayapi + FEATURE_SET: TechPreviewNoUpgrade + GATEWAY_NAME: tls-scanner-gatewayapi + SCAN_NAMESPACE: openshift-ingress + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - as: setup-gateway + cli: latest + commands: make generate gatewayapi-tls-scanner-setup + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m + - ref: tls-scanner-run + workflow: ipi-aws - always_run: false as: e2e-aws-ovn-techpreview optional: true diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml index 371625589410d..ece96e941b478 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml @@ -11,6 +11,10 @@ base_images: name: hypershift-tests namespace: hypershift tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -280,6 +284,34 @@ tests: requests: cpu: 100m workflow: ingress-vsphere-static-metallb +- always_run: false + as: tls-scanner-gatewayapi + optional: true + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + steps: + cluster_profile: openshift-org-aws + env: + COMPONENT_FILTER: tls-scanner-gatewayapi + FEATURE_SET: TechPreviewNoUpgrade + GATEWAY_NAME: tls-scanner-gatewayapi + SCAN_NAMESPACE: openshift-ingress + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - as: setup-gateway + cli: latest + commands: make generate gatewayapi-tls-scanner-setup + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m + - ref: tls-scanner-run + workflow: ipi-aws - always_run: false as: e2e-aws-ovn-techpreview optional: true diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml index 20f4b5b8c6416..defd9ad1d8492 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml @@ -11,6 +11,10 @@ base_images: name: hypershift-tests namespace: hypershift tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -281,6 +285,34 @@ tests: requests: cpu: 100m workflow: ingress-vsphere-static-metallb +- always_run: false + as: tls-scanner-gatewayapi + optional: true + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + steps: + cluster_profile: openshift-org-aws + env: + COMPONENT_FILTER: tls-scanner-gatewayapi + FEATURE_SET: TechPreviewNoUpgrade + GATEWAY_NAME: tls-scanner-gatewayapi + SCAN_NAMESPACE: openshift-ingress + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - as: setup-gateway + cli: latest + commands: make generate gatewayapi-tls-scanner-setup + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m + - ref: tls-scanner-run + workflow: ipi-aws - always_run: false as: e2e-aws-ovn-techpreview optional: true diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml index 8aa82e44c6d06..ade81dab618a2 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml @@ -11,6 +11,10 @@ base_images: name: hypershift-tests namespace: hypershift tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -280,6 +284,34 @@ tests: requests: cpu: 100m workflow: ingress-vsphere-static-metallb +- always_run: false + as: tls-scanner-gatewayapi + optional: true + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + steps: + cluster_profile: openshift-org-aws + env: + COMPONENT_FILTER: tls-scanner-gatewayapi + FEATURE_SET: TechPreviewNoUpgrade + GATEWAY_NAME: tls-scanner-gatewayapi + SCAN_NAMESPACE: openshift-ingress + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - as: setup-gateway + cli: latest + commands: make generate gatewayapi-tls-scanner-setup + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m + - ref: tls-scanner-run + workflow: ipi-aws - always_run: false as: e2e-aws-ovn-techpreview optional: true diff --git a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml index 677c451dfb846..e0b35ceb5ec5e 100644 --- a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml +++ b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml @@ -2944,6 +2944,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )okd-scos-images,?($|\s.*) + - agent: kubernetes + always_run: false + annotations: + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + branches: + - ^master$ + - ^master- + cluster: build03 + context: ci/prow/tls-scanner-gatewayapi + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cluster-ingress-operator-master-tls-scanner-gatewayapi + optional: true + rerun_command: /test tls-scanner-gatewayapi + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-gatewayapi + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-gatewayapi,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yaml b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yaml index c009ed8431cae..c059a2305cb65 100644 --- a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yaml +++ b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yaml @@ -2372,6 +2372,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )images,?($|\s.*) + - agent: kubernetes + always_run: false + annotations: + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + branches: + - ^release-4\.23$ + - ^release-4\.23- + cluster: build11 + context: ci/prow/tls-scanner-gatewayapi + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cluster-ingress-operator-release-4.23-tls-scanner-gatewayapi + optional: true + rerun_command: /test tls-scanner-gatewayapi + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-gatewayapi + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-gatewayapi,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0-presubmits.yaml b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0-presubmits.yaml index a3766c0678068..e74cb6643b8a0 100644 --- a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0-presubmits.yaml +++ b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0-presubmits.yaml @@ -2371,6 +2371,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )images,?($|\s.*) + - agent: kubernetes + always_run: false + annotations: + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + branches: + - ^release-5\.0$ + - ^release-5\.0- + cluster: build10 + context: ci/prow/tls-scanner-gatewayapi + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cluster-ingress-operator-release-5.0-tls-scanner-gatewayapi + optional: true + rerun_command: /test tls-scanner-gatewayapi + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-gatewayapi + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-gatewayapi,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1-presubmits.yaml b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1-presubmits.yaml index a9adcc7271eb4..6822712fed63f 100644 --- a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1-presubmits.yaml +++ b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1-presubmits.yaml @@ -2372,6 +2372,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )images,?($|\s.*) + - agent: kubernetes + always_run: false + annotations: + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + branches: + - ^release-5\.1$ + - ^release-5\.1- + cluster: build10 + context: ci/prow/tls-scanner-gatewayapi + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cluster-ingress-operator-release-5.1-tls-scanner-gatewayapi + optional: true + rerun_command: /test tls-scanner-gatewayapi + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-gatewayapi + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-gatewayapi,?($|\s.*) - agent: kubernetes always_run: true branches: From 25b2262e42f9d50422e25e9d6d3da099132fa4b5 Mon Sep 17 00:00:00 2001 From: Ricardo Pchevuzinske Katz Date: Fri, 31 Jul 2026 11:34:35 -0300 Subject: [PATCH 3/4] remove hostname from listener to be able to test it --- .../openshift-cluster-ingress-operator-master.yaml | 10 ++++++++++ ...penshift-cluster-ingress-operator-release-4.23.yaml | 10 ++++++++++ ...openshift-cluster-ingress-operator-release-5.0.yaml | 10 ++++++++++ ...openshift-cluster-ingress-operator-release-5.1.yaml | 10 ++++++++++ 4 files changed, 40 insertions(+) diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml index 5fd2ea3a1c8fc..665f548661c46 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml @@ -337,6 +337,16 @@ tests: resources: requests: cpu: 100m + - as: patch-gateway + cli: latest + commands: oc patch gateway ${GATEWAY_NAME} -n openshift-ingress --type=json + -p '[{"op":"remove","path":"/spec/listeners/0/hostname"}]' + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m - ref: tls-scanner-run workflow: ipi-aws - always_run: false diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml index ece96e941b478..f3ccb30959de4 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml @@ -310,6 +310,16 @@ tests: resources: requests: cpu: 100m + - as: patch-gateway + cli: latest + commands: oc patch gateway ${GATEWAY_NAME} -n openshift-ingress --type=json + -p '[{"op":"remove","path":"/spec/listeners/0/hostname"}]' + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m - ref: tls-scanner-run workflow: ipi-aws - always_run: false diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml index defd9ad1d8492..dec872ef96b4c 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml @@ -311,6 +311,16 @@ tests: resources: requests: cpu: 100m + - as: patch-gateway + cli: latest + commands: oc patch gateway ${GATEWAY_NAME} -n openshift-ingress --type=json + -p '[{"op":"remove","path":"/spec/listeners/0/hostname"}]' + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m - ref: tls-scanner-run workflow: ipi-aws - always_run: false diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml index ade81dab618a2..cdad0ff0be3e0 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml @@ -310,6 +310,16 @@ tests: resources: requests: cpu: 100m + - as: patch-gateway + cli: latest + commands: oc patch gateway ${GATEWAY_NAME} -n openshift-ingress --type=json + -p '[{"op":"remove","path":"/spec/listeners/0/hostname"}]' + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m - ref: tls-scanner-run workflow: ipi-aws - always_run: false From 6124fd2c6b81b74316c8e6a2ffa928406900840f Mon Sep 17 00:00:00 2001 From: Ricardo Pchevuzinske Katz Date: Fri, 31 Jul 2026 14:10:57 -0300 Subject: [PATCH 4/4] Execute intermediate and then modern steps --- ...shift-cluster-ingress-operator-master.yaml | 7 +- ...cluster-ingress-operator-release-4.23.yaml | 7 +- ...-cluster-ingress-operator-release-5.0.yaml | 7 +- ...-cluster-ingress-operator-release-5.1.yaml | 7 +- ...er-ingress-operator-master-presubmits.yaml | 10 +-- ...ress-operator-release-4.23-presubmits.yaml | 10 +-- ...gress-operator-release-5.0-presubmits.yaml | 10 +-- ...gress-operator-release-5.1-presubmits.yaml | 10 +-- .../step-registry/tls/scanner/recheck/OWNERS | 9 +++ .../recheck/tls-scanner-recheck-commands.sh | 1 + .../tls-scanner-recheck-ref.metadata.json | 15 +++++ .../recheck/tls-scanner-recheck-ref.yaml | 64 +++++++++++++++++++ 12 files changed, 125 insertions(+), 32 deletions(-) create mode 100644 ci-operator/step-registry/tls/scanner/recheck/OWNERS create mode 120000 ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-commands.sh create mode 100644 ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-ref.metadata.json create mode 100644 ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-ref.yaml diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml index 665f548661c46..50ca2570dc0e2 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml @@ -312,7 +312,7 @@ tests: cpu: 100m workflow: ingress-vsphere-static-metallb - always_run: false - as: tls-scanner-gatewayapi + as: tls-scanner-aws-gatewayapi optional: true pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ steps: @@ -327,7 +327,6 @@ tests: TLS_13_ENABLE_TLS_ADHERENCE: "true" TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: - - ref: tls-13 - as: setup-gateway cli: latest commands: make generate gatewayapi-tls-scanner-setup @@ -348,7 +347,9 @@ tests: requests: cpu: 100m - ref: tls-scanner-run - workflow: ipi-aws + - ref: tls-13 + - ref: tls-scanner-recheck + workflow: openshift-e2e-aws-ovn - always_run: false as: e2e-aws-ovn-techpreview optional: true diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml index f3ccb30959de4..0cbf362ac90ba 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml @@ -285,7 +285,7 @@ tests: cpu: 100m workflow: ingress-vsphere-static-metallb - always_run: false - as: tls-scanner-gatewayapi + as: tls-scanner-aws-gatewayapi optional: true pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ steps: @@ -300,7 +300,6 @@ tests: TLS_13_ENABLE_TLS_ADHERENCE: "true" TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: - - ref: tls-13 - as: setup-gateway cli: latest commands: make generate gatewayapi-tls-scanner-setup @@ -321,7 +320,9 @@ tests: requests: cpu: 100m - ref: tls-scanner-run - workflow: ipi-aws + - ref: tls-13 + - ref: tls-scanner-recheck + workflow: openshift-e2e-aws-ovn - always_run: false as: e2e-aws-ovn-techpreview optional: true diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml index dec872ef96b4c..a3c7e232c19ac 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml @@ -286,7 +286,7 @@ tests: cpu: 100m workflow: ingress-vsphere-static-metallb - always_run: false - as: tls-scanner-gatewayapi + as: tls-scanner-aws-gatewayapi optional: true pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ steps: @@ -301,7 +301,6 @@ tests: TLS_13_ENABLE_TLS_ADHERENCE: "true" TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: - - ref: tls-13 - as: setup-gateway cli: latest commands: make generate gatewayapi-tls-scanner-setup @@ -322,7 +321,9 @@ tests: requests: cpu: 100m - ref: tls-scanner-run - workflow: ipi-aws + - ref: tls-13 + - ref: tls-scanner-recheck + workflow: openshift-e2e-aws-ovn - always_run: false as: e2e-aws-ovn-techpreview optional: true diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml index cdad0ff0be3e0..3fa222cb45608 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml @@ -285,7 +285,7 @@ tests: cpu: 100m workflow: ingress-vsphere-static-metallb - always_run: false - as: tls-scanner-gatewayapi + as: tls-scanner-aws-gatewayapi optional: true pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ steps: @@ -300,7 +300,6 @@ tests: TLS_13_ENABLE_TLS_ADHERENCE: "true" TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: - - ref: tls-13 - as: setup-gateway cli: latest commands: make generate gatewayapi-tls-scanner-setup @@ -321,7 +320,9 @@ tests: requests: cpu: 100m - ref: tls-scanner-run - workflow: ipi-aws + - ref: tls-13 + - ref: tls-scanner-recheck + workflow: openshift-e2e-aws-ovn - always_run: false as: e2e-aws-ovn-techpreview optional: true diff --git a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml index e0b35ceb5ec5e..f06e5c73cc22a 100644 --- a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml +++ b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml @@ -2952,7 +2952,7 @@ presubmits: - ^master$ - ^master- cluster: build03 - context: ci/prow/tls-scanner-gatewayapi + context: ci/prow/tls-scanner-aws-gatewayapi decorate: true decoration_config: sparse_checkout_files: @@ -2963,9 +2963,9 @@ presubmits: ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws ci.openshift.io/generator: prowgen pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-openshift-cluster-ingress-operator-master-tls-scanner-gatewayapi + name: pull-ci-openshift-cluster-ingress-operator-master-tls-scanner-aws-gatewayapi optional: true - rerun_command: /test tls-scanner-gatewayapi + rerun_command: /test tls-scanner-aws-gatewayapi spec: containers: - args: @@ -2974,7 +2974,7 @@ presubmits: - --lease-server-credentials-file=/etc/boskos/credentials - --report-credentials-file=/etc/report/credentials - --secret-dir=/secrets/ci-pull-credentials - - --target=tls-scanner-gatewayapi + - --target=tls-scanner-aws-gatewayapi command: - ci-operator env: @@ -3030,7 +3030,7 @@ presubmits: - name: result-aggregator secret: secretName: result-aggregator - trigger: (?m)^/test( | .* )tls-scanner-gatewayapi,?($|\s.*) + trigger: (?m)^/test( | .* )tls-scanner-aws-gatewayapi,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yaml b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yaml index c059a2305cb65..04d78a3b0fe55 100644 --- a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yaml +++ b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yaml @@ -2380,7 +2380,7 @@ presubmits: - ^release-4\.23$ - ^release-4\.23- cluster: build11 - context: ci/prow/tls-scanner-gatewayapi + context: ci/prow/tls-scanner-aws-gatewayapi decorate: true decoration_config: sparse_checkout_files: @@ -2391,9 +2391,9 @@ presubmits: ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws ci.openshift.io/generator: prowgen pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-openshift-cluster-ingress-operator-release-4.23-tls-scanner-gatewayapi + name: pull-ci-openshift-cluster-ingress-operator-release-4.23-tls-scanner-aws-gatewayapi optional: true - rerun_command: /test tls-scanner-gatewayapi + rerun_command: /test tls-scanner-aws-gatewayapi spec: containers: - args: @@ -2402,7 +2402,7 @@ presubmits: - --lease-server-credentials-file=/etc/boskos/credentials - --report-credentials-file=/etc/report/credentials - --secret-dir=/secrets/ci-pull-credentials - - --target=tls-scanner-gatewayapi + - --target=tls-scanner-aws-gatewayapi command: - ci-operator env: @@ -2458,7 +2458,7 @@ presubmits: - name: result-aggregator secret: secretName: result-aggregator - trigger: (?m)^/test( | .* )tls-scanner-gatewayapi,?($|\s.*) + trigger: (?m)^/test( | .* )tls-scanner-aws-gatewayapi,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0-presubmits.yaml b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0-presubmits.yaml index e74cb6643b8a0..1fd5cf35008db 100644 --- a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0-presubmits.yaml +++ b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0-presubmits.yaml @@ -2379,7 +2379,7 @@ presubmits: - ^release-5\.0$ - ^release-5\.0- cluster: build10 - context: ci/prow/tls-scanner-gatewayapi + context: ci/prow/tls-scanner-aws-gatewayapi decorate: true decoration_config: sparse_checkout_files: @@ -2390,9 +2390,9 @@ presubmits: ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws ci.openshift.io/generator: prowgen pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-openshift-cluster-ingress-operator-release-5.0-tls-scanner-gatewayapi + name: pull-ci-openshift-cluster-ingress-operator-release-5.0-tls-scanner-aws-gatewayapi optional: true - rerun_command: /test tls-scanner-gatewayapi + rerun_command: /test tls-scanner-aws-gatewayapi spec: containers: - args: @@ -2401,7 +2401,7 @@ presubmits: - --lease-server-credentials-file=/etc/boskos/credentials - --report-credentials-file=/etc/report/credentials - --secret-dir=/secrets/ci-pull-credentials - - --target=tls-scanner-gatewayapi + - --target=tls-scanner-aws-gatewayapi command: - ci-operator env: @@ -2457,7 +2457,7 @@ presubmits: - name: result-aggregator secret: secretName: result-aggregator - trigger: (?m)^/test( | .* )tls-scanner-gatewayapi,?($|\s.*) + trigger: (?m)^/test( | .* )tls-scanner-aws-gatewayapi,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1-presubmits.yaml b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1-presubmits.yaml index 6822712fed63f..b2d032be51036 100644 --- a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1-presubmits.yaml +++ b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1-presubmits.yaml @@ -2380,7 +2380,7 @@ presubmits: - ^release-5\.1$ - ^release-5\.1- cluster: build10 - context: ci/prow/tls-scanner-gatewayapi + context: ci/prow/tls-scanner-aws-gatewayapi decorate: true decoration_config: sparse_checkout_files: @@ -2391,9 +2391,9 @@ presubmits: ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws ci.openshift.io/generator: prowgen pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-openshift-cluster-ingress-operator-release-5.1-tls-scanner-gatewayapi + name: pull-ci-openshift-cluster-ingress-operator-release-5.1-tls-scanner-aws-gatewayapi optional: true - rerun_command: /test tls-scanner-gatewayapi + rerun_command: /test tls-scanner-aws-gatewayapi spec: containers: - args: @@ -2402,7 +2402,7 @@ presubmits: - --lease-server-credentials-file=/etc/boskos/credentials - --report-credentials-file=/etc/report/credentials - --secret-dir=/secrets/ci-pull-credentials - - --target=tls-scanner-gatewayapi + - --target=tls-scanner-aws-gatewayapi command: - ci-operator env: @@ -2458,7 +2458,7 @@ presubmits: - name: result-aggregator secret: secretName: result-aggregator - trigger: (?m)^/test( | .* )tls-scanner-gatewayapi,?($|\s.*) + trigger: (?m)^/test( | .* )tls-scanner-aws-gatewayapi,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/step-registry/tls/scanner/recheck/OWNERS b/ci-operator/step-registry/tls/scanner/recheck/OWNERS new file mode 100644 index 0000000000000..0c3a02e9e68c6 --- /dev/null +++ b/ci-operator/step-registry/tls/scanner/recheck/OWNERS @@ -0,0 +1,9 @@ +approvers: + - richardsonnick + - rhmdnd + - smith-xyz +reviewers: + - richardsonnick + - rhmdnd + - smith-xyz + diff --git a/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-commands.sh b/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-commands.sh new file mode 120000 index 0000000000000..13743a4edb908 --- /dev/null +++ b/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-commands.sh @@ -0,0 +1 @@ +../run/tls-scanner-run-commands.sh \ No newline at end of file diff --git a/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-ref.metadata.json b/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-ref.metadata.json new file mode 100644 index 0000000000000..40eec7a1438d7 --- /dev/null +++ b/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-ref.metadata.json @@ -0,0 +1,15 @@ +{ + "path": "tls/scanner/recheck/tls-scanner-recheck-ref.yaml", + "owners": { + "approvers": [ + "richardsonnick", + "rhmdnd", + "smith-xyz" + ], + "reviewers": [ + "richardsonnick", + "rhmdnd", + "smith-xyz" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-ref.yaml b/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-ref.yaml new file mode 100644 index 0000000000000..2ba6939567f10 --- /dev/null +++ b/ci-operator/step-registry/tls/scanner/recheck/tls-scanner-recheck-ref.yaml @@ -0,0 +1,64 @@ +ref: + as: tls-scanner-recheck + from: cli + cli: latest + commands: tls-scanner-recheck-commands.sh + env: + - name: SCAN_NAMESPACE + default: "" + documentation: "Comma-separated list of namespaces to scan. Empty means scan all namespaces." + - name: COMPONENT_FILTER + default: "" + documentation: |- + Comma-separated list of component names to scan, matched against each pod's + "app", "component", or "app.kubernetes.io/name" label (in that order). Empty + scans all pods in the selected namespace(s). Use this to exclude unrelated + workloads sharing a namespace with the component under test (e.g. Gateway + API pods sharing openshift-ingress with the non-adherent router-default + pods). + - name: PQC_CHECK + default: "false" + documentation: "Set to 'true' to check post-quantum cryptography readiness (scanner will only check TLS 1.3 and mlkem/mlkem25519 support)." + - name: SCAN_LIMIT_IPS + default: "" + documentation: "Max IPs to scan (empty/0 = no limit). Bounds actual TLS scans after full endpoint discovery." + - name: SCANNER_CPU + default: "4" + documentation: "CPU request/limit for the scanner pod." + - name: SCANNER_MEMORY + default: "4Gi" + documentation: "Memory request/limit for the scanner pod." + - name: TLS_SCANNER_CLUSTER_LABEL + default: "" + documentation: |- + HyperShift scan target label. Set to "management" to scan the shared + management cluster hosted control plane namespace, or "guest" to scan the + hosted cluster. Empty uses the step KUBECONFIG and scans all namespaces. + - name: TLS_PROFILE_TYPE + default: "" + documentation: |- + Expected cluster TLS profile type for compliance checks (Old, Intermediate, + Modern). When set, passes --tls-profile-type to tls-scanner instead of + reading APIServer/cluster from the API. Required for HyperShift hosted + control planes where the guest APIServer CR may not mirror HostedCluster + configuration. + dependencies: + - env: RELEASE_IMAGE_LATEST + name: release:latest + - env: OPENSHIFT_UPGRADE_RELEASE_IMAGE_OVERRIDE + name: release:latest + - env: OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE + name: release:latest + - env: PULL_SPEC_TLS_SCANNER_TOOL + name: tls-scanner-tool + resources: + requests: + cpu: 100m + memory: 200Mi + timeout: 4h0m0s + grace_period: 5m0s + documentation: |- + Alias of tls-scanner-run for use when a job needs to scan twice in the same + multi-stage test (e.g. before and after a TLS profile change). ci-operator + requires unique step names so a second ref that shares the same commands + script via symlink is necessary.