From 4ef4107fb01829c605e2b3b46f0554ba5452fdc6 Mon Sep 17 00:00:00 2001 From: Nahshon Unna Tsameret Date: Thu, 30 Jul 2026 11:02:15 +0300 Subject: [PATCH] add TLS scan jobs for HCO Signed-off-by: Nahshon Unna Tsameret --- ...-hyperconverged-cluster-operator-main.yaml | 57 ++++++ ...rged-cluster-operator-main-presubmits.yaml | 176 ++++++++++++++++++ 2 files changed, 233 insertions(+) diff --git a/ci-operator/config/kubevirt/hyperconverged-cluster-operator/kubevirt-hyperconverged-cluster-operator-main.yaml b/ci-operator/config/kubevirt/hyperconverged-cluster-operator/kubevirt-hyperconverged-cluster-operator-main.yaml index ce99512909b76..0144f0cbbf932 100644 --- a/ci-operator/config/kubevirt/hyperconverged-cluster-operator/kubevirt-hyperconverged-cluster-operator-main.yaml +++ b/ci-operator/config/kubevirt/hyperconverged-cluster-operator/kubevirt-hyperconverged-cluster-operator-main.yaml @@ -19,6 +19,10 @@ base_images: name: hyperconverged-cluster-bundle namespace: ci tag: 1.18.0-unstable + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make install build_root: image_stream_tag: @@ -154,6 +158,32 @@ tests: cpu: 500m memory: 1Gi workflow: optional-operators-ci-operator-sdk-azure +- always_run: false + as: hco-tls-scan-azure + optional: true + steps: + cluster_profile: azure-virtualization + dependencies: + OO_BUNDLE: hco-bundle + env: + BASE_DOMAIN: cnv-devel.azure.devcluster.openshift.com + OO_INSTALL_NAMESPACE: kubevirt-hyperconverged + OO_INSTALL_TIMEOUT_MINUTES: "15" + PQC_CHECK: "true" + SCAN_NAMESPACE: kubevirt-hyperconverged + SCANNER_CPU: "2" + test: + - ref: tls-13 + - as: deploy-cr + commands: | + make deploy_cr + from: hco-oc-bin-image + resources: + requests: + cpu: 500m + memory: 1Gi + - ref: tls-scanner-run + workflow: optional-operators-ci-operator-sdk-azure - as: hco-e2e-operator-sdk-sno-azure optional: true run_if_changed: ^(api/.*|assets/.*|build/.*|ci-test-files/.*|config/.*|controllers/.*|cmd/.*|deploy/crds/.*|deploy/index-image/.*|hack/.*|pkg/.*|tests/.*|Makefile|go\.mod|go\.sum)$ @@ -493,6 +523,33 @@ tests: cpu: 500m memory: 1Gi workflow: optional-operators-ci-operator-sdk-aws +- always_run: false + as: hco-tls-scan-aws + optional: true + steps: + cluster_profile: aws-virtualization + dependencies: + OO_BUNDLE: hco-bundle + env: + BASE_DOMAIN: cnv-ci.syseng.devcluster.openshift.com + OO_INSTALL_NAMESPACE: kubevirt-hyperconverged + OO_INSTALL_TIMEOUT_MINUTES: "15" + PQC_CHECK: "true" + SCAN_NAMESPACE: kubevirt-hyperconverged + SCANNER_CPU: "2" + SPOT_INSTANCES: "true" + test: + - ref: tls-13 + - as: deploy-cr + commands: | + KVM_EMULATION=true make deploy_cr + from: hco-oc-bin-image + resources: + requests: + cpu: 500m + memory: 1Gi + - ref: tls-scanner-run + workflow: optional-operators-ci-operator-sdk-aws - as: hco-e2e-operator-sdk-gcp run_if_changed: ^(api/.*|assets/.*|build/.*|ci-test-files/.*|config/.*|controllers/.*|cmd/.*|deploy/crds/.*|deploy/index-image/.*|hack/.*|pkg/.*|tests/.*|Makefile|go\.mod|go\.sum)$ steps: diff --git a/ci-operator/jobs/kubevirt/hyperconverged-cluster-operator/kubevirt-hyperconverged-cluster-operator-main-presubmits.yaml b/ci-operator/jobs/kubevirt/hyperconverged-cluster-operator/kubevirt-hyperconverged-cluster-operator-main-presubmits.yaml index 0cf3526cd78d4..f7c682c7b72ad 100644 --- a/ci-operator/jobs/kubevirt/hyperconverged-cluster-operator/kubevirt-hyperconverged-cluster-operator-main-presubmits.yaml +++ b/ci-operator/jobs/kubevirt/hyperconverged-cluster-operator/kubevirt-hyperconverged-cluster-operator-main-presubmits.yaml @@ -1623,6 +1623,182 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )hco-e2e-upgrade-prev-operator-sdk-sno-azure,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/hco-tls-scan-aws + decorate: true + decoration_config: + sparse_checkout_files: + - build/Dockerfile.artifacts + - build/Dockerfile.functest.ci + - build/Dockerfile.okd + - build/Dockerfile.wh.okd + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: aws-virtualization + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-aws + optional: true + rerun_command: /test hco-tls-scan-aws + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=hco-tls-scan-aws + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )hco-tls-scan-aws,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build04 + context: ci/prow/hco-tls-scan-azure + decorate: true + decoration_config: + sparse_checkout_files: + - build/Dockerfile.artifacts + - build/Dockerfile.functest.ci + - build/Dockerfile.okd + - build/Dockerfile.wh.okd + labels: + ci-operator.openshift.io/cloud: azure4 + ci-operator.openshift.io/cloud-cluster-profile: azure-virtualization + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-azure + optional: true + rerun_command: /test hco-tls-scan-azure + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=hco-tls-scan-azure + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )hco-tls-scan-azure,?($|\s.*) - agent: kubernetes always_run: true branches: