Skip to content

NE-2821: Add tls-scanner job for TLS1.3 on Gateway API #82586

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rikatz wants to merge 4 commits into
base: main
Choose a base branch
from
Open

NE-2821: Add tls-scanner job for TLS1.3 on Gateway API #82586

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
13325f3
feat(tls-scanner): add COMPONENT_FILTER support to tls-scanner-run
rikatz Jul 30, 2026
bb01809
NE-2821: add tls-scanner-gatewayapi job
rikatz Jul 30, 2026
25b2262
remove hostname from listener to be able to test it
rikatz Jul 31, 2026
6124fd2
Execute intermediate and then modern steps
rikatz Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions .../config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,10 @@ base_images:
name: hypershift-tests
namespace: hypershift
tag: latest
tls-scanner-tool:
name: tls-scanner
namespace: tls-scanner
tag: tls-scanner-tool
build_root:
from_repository: true
images:
Expand Down Expand Up @@ -307,6 +311,45 @@ tests:
requests:
cpu: 100m
workflow: ingress-vsphere-static-metallb
- always_run: false

@gcs278 gcs278 Jul 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Future follow up: Might be good to eventually have a intermediate test for completeness. We are only testing modern via the tls-13 step, but intermediate is untested.

@rikatz rikatz Jul 31, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, but this will need to be a different pipeline. I asked claude to check it, but we cannot alias two similar steps

@rikatz rikatz Jul 31, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok, I am doing some fancy workaround to run the tls scanner re-check

as: tls-scanner-aws-gatewayapi
optional: true
pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
steps:
cluster_profile: openshift-org-aws
env:
COMPONENT_FILTER: tls-scanner-gatewayapi
FEATURE_SET: TechPreviewNoUpgrade
GATEWAY_NAME: tls-scanner-gatewayapi
SCAN_NAMESPACE: openshift-ingress
SCANNER_CPU: "1"
SCANNER_MEMORY: 1Gi
TLS_13_ENABLE_TLS_ADHERENCE: "true"
TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents
test:
- as: setup-gateway
cli: latest
commands: make generate gatewayapi-tls-scanner-setup
env:
- name: GATEWAY_NAME
from: src
resources:
requests:
cpu: 100m
- as: patch-gateway
cli: latest
commands: oc patch gateway ${GATEWAY_NAME} -n openshift-ingress --type=json
-p '[{"op":"remove","path":"/spec/listeners/0/hostname"}]'
env:
- name: GATEWAY_NAME
from: src
resources:
requests:
cpu: 100m
- ref: tls-scanner-run
- ref: tls-13
- ref: tls-scanner-recheck
workflow: openshift-e2e-aws-ovn
- always_run: false
as: e2e-aws-ovn-techpreview
optional: true
Expand Down
43 changes: 43 additions & 0 deletions ...g/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,10 @@ base_images:
name: hypershift-tests
namespace: hypershift
tag: latest
tls-scanner-tool:
name: tls-scanner
namespace: tls-scanner
tag: tls-scanner-tool
build_root:
from_repository: true
images:
Expand Down Expand Up @@ -280,6 +284,45 @@ tests:
requests:
cpu: 100m
workflow: ingress-vsphere-static-metallb
- always_run: false
as: tls-scanner-aws-gatewayapi
optional: true
pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
steps:
cluster_profile: openshift-org-aws
env:
COMPONENT_FILTER: tls-scanner-gatewayapi
FEATURE_SET: TechPreviewNoUpgrade
GATEWAY_NAME: tls-scanner-gatewayapi
SCAN_NAMESPACE: openshift-ingress
SCANNER_CPU: "1"
SCANNER_MEMORY: 1Gi
TLS_13_ENABLE_TLS_ADHERENCE: "true"
TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents
test:
- as: setup-gateway
cli: latest
commands: make generate gatewayapi-tls-scanner-setup
env:
- name: GATEWAY_NAME
from: src
resources:
requests:
cpu: 100m
- as: patch-gateway
cli: latest
commands: oc patch gateway ${GATEWAY_NAME} -n openshift-ingress --type=json
-p '[{"op":"remove","path":"/spec/listeners/0/hostname"}]'
env:
- name: GATEWAY_NAME
from: src
resources:
requests:
cpu: 100m
- ref: tls-scanner-run
- ref: tls-13
- ref: tls-scanner-recheck
workflow: openshift-e2e-aws-ovn
- always_run: false
as: e2e-aws-ovn-techpreview
optional: true
Expand Down
43 changes: 43 additions & 0 deletions ...ig/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,10 @@ base_images:
name: hypershift-tests
namespace: hypershift
tag: latest
tls-scanner-tool:
name: tls-scanner
namespace: tls-scanner
tag: tls-scanner-tool
build_root:
from_repository: true
images:
Expand Down Expand Up @@ -281,6 +285,45 @@ tests:
requests:
cpu: 100m
workflow: ingress-vsphere-static-metallb
- always_run: false
as: tls-scanner-aws-gatewayapi
optional: true
pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
steps:
cluster_profile: openshift-org-aws
env:
COMPONENT_FILTER: tls-scanner-gatewayapi
FEATURE_SET: TechPreviewNoUpgrade
GATEWAY_NAME: tls-scanner-gatewayapi
SCAN_NAMESPACE: openshift-ingress
SCANNER_CPU: "1"
SCANNER_MEMORY: 1Gi
TLS_13_ENABLE_TLS_ADHERENCE: "true"
TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents
test:
- as: setup-gateway
cli: latest
commands: make generate gatewayapi-tls-scanner-setup
env:
- name: GATEWAY_NAME
from: src
resources:
requests:
cpu: 100m
- as: patch-gateway
cli: latest
commands: oc patch gateway ${GATEWAY_NAME} -n openshift-ingress --type=json
-p '[{"op":"remove","path":"/spec/listeners/0/hostname"}]'
env:
- name: GATEWAY_NAME
from: src
resources:
requests:
cpu: 100m
- ref: tls-scanner-run
- ref: tls-13
- ref: tls-scanner-recheck
workflow: openshift-e2e-aws-ovn
- always_run: false
as: e2e-aws-ovn-techpreview
optional: true
Expand Down
43 changes: 43 additions & 0 deletions ...ig/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,10 @@ base_images:
name: hypershift-tests
namespace: hypershift
tag: latest
tls-scanner-tool:
name: tls-scanner
namespace: tls-scanner
tag: tls-scanner-tool
build_root:
from_repository: true
images:
Expand Down Expand Up @@ -280,6 +284,45 @@ tests:
requests:
cpu: 100m
workflow: ingress-vsphere-static-metallb
- always_run: false
as: tls-scanner-aws-gatewayapi
optional: true
pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
steps:
cluster_profile: openshift-org-aws
env:
COMPONENT_FILTER: tls-scanner-gatewayapi
FEATURE_SET: TechPreviewNoUpgrade
GATEWAY_NAME: tls-scanner-gatewayapi
SCAN_NAMESPACE: openshift-ingress
SCANNER_CPU: "1"
SCANNER_MEMORY: 1Gi
TLS_13_ENABLE_TLS_ADHERENCE: "true"
TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents
test:
- as: setup-gateway
cli: latest
commands: make generate gatewayapi-tls-scanner-setup
env:
- name: GATEWAY_NAME
from: src
resources:
requests:
cpu: 100m
- as: patch-gateway
cli: latest
commands: oc patch gateway ${GATEWAY_NAME} -n openshift-ingress --type=json
-p '[{"op":"remove","path":"/spec/listeners/0/hostname"}]'
env:
- name: GATEWAY_NAME
from: src
resources:
requests:
cpu: 100m
- ref: tls-scanner-run
- ref: tls-13
- ref: tls-scanner-recheck
workflow: openshift-e2e-aws-ovn
- always_run: false
as: e2e-aws-ovn-techpreview
optional: true
Expand Down
87 changes: 87 additions & 0 deletions ...nshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2944,6 +2944,93 @@ presubmits:
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )okd-scos-images,?($|\s.*)
- agent: kubernetes
always_run: false
annotations:
pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
branches:
- ^master$
- ^master-
cluster: build03
context: ci/prow/tls-scanner-aws-gatewayapi
decorate: true
decoration_config:
sparse_checkout_files:
- .ci-operator.yaml
- Dockerfile
labels:
ci-operator.openshift.io/cloud: aws
ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
name: pull-ci-openshift-cluster-ingress-operator-master-tls-scanner-aws-gatewayapi
optional: true
rerun_command: /test tls-scanner-aws-gatewayapi
spec:
containers:
- args:
- --gcs-upload-secret=/secrets/gcs/service-account.json
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
- --lease-server-credentials-file=/etc/boskos/credentials
- --report-credentials-file=/etc/report/credentials
- --secret-dir=/secrets/ci-pull-credentials
- --target=tls-scanner-aws-gatewayapi
command:
- ci-operator
env:
- name: HTTP_SERVER_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
imagePullPolicy: Always
name: ""
ports:
- containerPort: 8080
name: http
resources:
requests:
cpu: 10m
volumeMounts:
- mountPath: /etc/boskos
name: boskos
readOnly: true
- mountPath: /secrets/ci-pull-credentials
name: ci-pull-credentials
readOnly: true
- mountPath: /secrets/gcs
name: gcs-credentials
readOnly: true
- mountPath: /secrets/manifest-tool
name: manifest-tool-local-pusher
readOnly: true
- mountPath: /etc/pull-secret
name: pull-secret
readOnly: true
- mountPath: /etc/report
name: result-aggregator
readOnly: true
serviceAccountName: ci-operator
volumes:
- name: boskos
secret:
items:
- key: credentials
path: credentials
secretName: boskos-credentials
- name: ci-pull-credentials
secret:
secretName: ci-pull-credentials
- name: manifest-tool-local-pusher
secret:
secretName: manifest-tool-local-pusher
- name: pull-secret
secret:
secretName: registry-pull-credentials
- name: result-aggregator
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )tls-scanner-aws-gatewayapi,?($|\s.*)
- agent: kubernetes
always_run: true
branches:
Expand Down
Loading