NO-JIRA: add TLS scan jobs for HCO by nunnatsa · Pull Request #82659 · openshift/release

nunnatsa · 2026-07-30T09:11:19Z

Summary by CodeRabbit

Adds optional AWS and Azure TLS scan jobs to the HCO OpenShift CI configuration. Both jobs install HCO, run tls-scanner-run, and run tls-13. The AWS job uses spot instances and enables KVM emulation.

openshift-ci-robot · 2026-07-30T09:11:24Z

@nunnatsa: This pull request explicitly references no jira issue.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-07-30T09:11:54Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: nunnatsa

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~ci-operator/config/kubevirt/hyperconverged-cluster-operator/OWNERS~~ [nunnatsa]
~~ci-operator/jobs/kubevirt/hyperconverged-cluster-operator/OWNERS~~ [nunnatsa]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

coderabbitai · 2026-07-30T09:12:01Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 1fc1af26-b3b5-4ea8-a783-6f1a25ebf065

📥 Commits

Reviewing files that changed from the base of the PR and between f505da7 and 54c863d.

⛔ Files ignored due to path filters (1)

ci-operator/jobs/kubevirt/hyperconverged-cluster-operator/kubevirt-hyperconverged-cluster-operator-main-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (1)

ci-operator/config/kubevirt/hyperconverged-cluster-operator/kubevirt-hyperconverged-cluster-operator-main.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

ci-operator/config/kubevirt/hyperconverged-cluster-operator/kubevirt-hyperconverged-cluster-operator-main.yaml

Walkthrough

Adds the tls-scanner-tool image and optional Azure and AWS CI jobs for HCO TLS scanning. The jobs configure scanner variables, deploy the custom resource, and run scanner tests. The AWS job also enables spot instances and KVM emulation.

Changes

HCO TLS scanning

Layer / File(s)	Summary
Configure TLS scanner image `ci-operator/config/kubevirt/hyperconverged-cluster-operator/kubevirt-hyperconverged-cluster-operator-main.yaml`	Adds the `tls-scanner-tool` base image.
Add Azure and AWS scan jobs `ci-operator/config/kubevirt/hyperconverged-cluster-operator/kubevirt-hyperconverged-cluster-operator-main.yaml`	Adds optional, non-automatically-run Azure and AWS jobs. Both jobs configure TLS scanning, deploy the CR, and run `tls-13` and `tls-scanner-run`. The AWS job uses spot instances and KVM emulation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: rehearsals-ack

Suggested reviewers: avlitman

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Container-Privileges	❌ Error	The new jobs invoke tls-scanner-run, which creates a scanner Pod with hostNetwork:true, hostPID:true, privileged:true, and runAsUser:0 by default.	Run the scanner without hostNetwork, hostPID, privileged mode, or root, or document and explicitly justify the required security privileges.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding TLS scan jobs for HCO.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR adds only static CI test and step names; no Ginkgo title calls or dynamic pod, node, namespace, timestamp, UUID, or IP values appear.
Test Structure And Quality	✅ Passed	The PR changes only two YAML CI configuration files; no Ginkgo test code or It blocks were added or modified, so these requirements do not apply.
Microshift Test Compatibility	✅ Passed	The pull request changes only CI YAML and generated Prow job definitions; it adds no Ginkgo tests or test bodies that require MicroShift compatibility checks.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only CI YAML and generated presubmit configuration; it adds no Ginkgo e2e test declarations or multi-node test logic.
Topology-Aware Scheduling Compatibility	✅ Passed	The commit adds only TLS CI configuration and generated presubmit jobs; no affinity, topology spread, node selector, toleration, replica, or PDB scheduling constraint is introduced.
Ote Binary Stdout Contract	✅ Passed	PR changes only two YAML CI files; no main, init, TestMain, suite setup, or stdout-writing source code is added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR adds YAML CI jobs and generated Prow entries, not Ginkgo tests; the scanner targets cluster pods in kubevirt-hyperconverged and adds no hardcoded IPs or public endpoints.
No-Weak-Crypto	✅ Passed	The 57 added lines contain only TLS scanner image/job metadata; the diff has no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds no logging statements or credential values. It only invokes the existing TLS steps; added values are test namespaces, resource settings, and non-secret CI domains.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

nunnatsa · 2026-07-30T09:23:32Z

/pj-rehearse pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-aws pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-azure

openshift-merge-bot · 2026-07-30T09:23:35Z

@nunnatsa: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

nunnatsa · 2026-07-30T10:09:25Z

/pj-rehearse pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-azure

openshift-merge-bot · 2026-07-30T10:09:28Z

@nunnatsa: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

nunnatsa · 2026-08-02T10:01:07Z

/pj-rehearse pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-aws pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-azure

openshift-merge-bot · 2026-08-02T10:01:09Z

@nunnatsa: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

coderabbitai · 2026-08-06T05:27:53Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

nunnatsa · 2026-08-06T07:33:11Z

/pj-rehearse pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-aws pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-azure

openshift-merge-bot · 2026-08-06T07:33:14Z

@nunnatsa: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

nunnatsa · 2026-08-06T10:36:51Z

/pj-rehearse ack

openshift-merge-bot · 2026-08-06T10:36:53Z

@nunnatsa: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

orenc1 · 2026-08-06T11:20:57Z

+      SCAN_NAMESPACE: kubevirt-hyperconverged
+      SCANNER_CPU: "2"
+      SPOT_INSTANCES: "true"
+    test:


why there is no - ref: tls-13 step on the aws job?

coderabbitai · 2026-08-06T11:26:37Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

nunnatsa · 2026-08-06T11:27:32Z

/pj-rehearse pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-aws pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-azure

openshift-merge-bot · 2026-08-06T11:27:35Z

@nunnatsa: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

nunnatsa · 2026-08-09T05:42:17Z

/pj-rehearse pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-aws pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-azure

openshift-merge-bot · 2026-08-09T05:42:20Z

@nunnatsa: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-ci · 2026-08-09T08:05:24Z

@nunnatsa: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/kubevirt/hyperconverged-cluster-operator/main/hco-tls-scan-aws	`4ef4107`	link	unknown	`/pj-rehearse pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-aws`
ci/rehearse/kubevirt/hyperconverged-cluster-operator/main/hco-tls-scan-azure	`4ef4107`	link	unknown	`/pj-rehearse pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-azure`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Signed-off-by: Nahshon Unna Tsameret <nunnatsa@redhat.com>

coderabbitai · 2026-08-09T08:58:02Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

nunnatsa · 2026-08-09T08:58:28Z

/pj-rehearse pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-aws pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-azure

openshift-merge-bot · 2026-08-09T08:58:30Z

@nunnatsa: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-merge-bot · 2026-08-09T09:01:15Z

[REHEARSALNOTIFIER]
@nunnatsa: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-aws	kubevirt/hyperconverged-cluster-operator	presubmit	Presubmit changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-tls-scan-azure	kubevirt/hyperconverged-cluster-operator	presubmit	Presubmit changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-ci-index-hco-bundle	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-ci-index-hco-upgrade-operator-sdk-bundle	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-consecutive-operator-sdk-upgrades-aws	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-consecutive-operator-sdk-upgrades-azure	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-kv-smoke-azure	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-kv-smoke-gcp	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-operator-sdk-aws	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-operator-sdk-azure	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-operator-sdk-gcp	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-operator-sdk-sno-aws	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-operator-sdk-sno-azure	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-upgrade-operator-sdk-aws	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-upgrade-operator-sdk-azure	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-upgrade-operator-sdk-sno-aws	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-upgrade-operator-sdk-sno-azure	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-upgrade-prev-operator-sdk-aws	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-upgrade-prev-operator-sdk-azure	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-upgrade-prev-operator-sdk-sno-aws	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-upgrade-prev-operator-sdk-sno-azure	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
pull-ci-kubevirt-hyperconverged-cluster-operator-main-images	kubevirt/hyperconverged-cluster-operator	presubmit	Ci-operator config changed
periodic-ci-kubevirt-hyperconverged-cluster-operator-main-hco-e2e-deploy-nightly-main-aws	N/A	periodic	Ci-operator config changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 30, 2026

openshift-ci Bot requested review from avlitman and orenc1 July 30, 2026 09:11

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 30, 2026

This was referenced Jul 30, 2026

MCO-2451: Make tls-pqc-readiness a required presubmit test #82665

Merged

NE-2821: Add tls-scanner job for TLS1.3 on Gateway API #82586

Open

nunnatsa force-pushed the hco-tls-scan branch from 80f7c3f to a8758c8 Compare August 2, 2026 06:13

nunnatsa force-pushed the hco-tls-scan branch from a8758c8 to f120ff4 Compare August 6, 2026 05:27

openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Aug 6, 2026

orenc1 reviewed Aug 6, 2026

View reviewed changes

nunnatsa force-pushed the hco-tls-scan branch from f120ff4 to 4ef4107 Compare August 6, 2026 11:26

openshift-merge-bot Bot removed the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Aug 6, 2026

coderabbitai Bot mentioned this pull request Aug 6, 2026

Add TLS scanner for External Secrets Operator #82876

Open

coderabbitai Bot mentioned this pull request Aug 6, 2026

STOR-3001: Add TLS jobs for storage components under cluster storage operator #83039

Open

add TLS scan jobs for HCO

54c863d

Signed-off-by: Nahshon Unna Tsameret <nunnatsa@redhat.com>

nunnatsa force-pushed the hco-tls-scan branch from 4ef4107 to 54c863d Compare August 9, 2026 08:57

Uh oh!

Conversation

nunnatsa commented Jul 30, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Jul 30, 2026

Uh oh!

openshift-ci Bot commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Pre-merge checks failed

❌ Failed checks (1 error)

Uh oh!

nunnatsa commented Jul 30, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 30, 2026

Uh oh!

nunnatsa commented Jul 30, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 30, 2026

Uh oh!

nunnatsa commented Aug 2, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 2, 2026

Uh oh!

coderabbitai Bot commented Aug 6, 2026

Uh oh!

nunnatsa commented Aug 6, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 6, 2026

Uh oh!

nunnatsa commented Aug 6, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 6, 2026

Uh oh!

orenc1 Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

nunnatsa Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Aug 6, 2026

Uh oh!

nunnatsa commented Aug 6, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 6, 2026

Uh oh!

nunnatsa commented Aug 9, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 9, 2026

Uh oh!

openshift-ci Bot commented Aug 9, 2026

Uh oh!

coderabbitai Bot commented Aug 9, 2026

Uh oh!

nunnatsa commented Aug 9, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 9, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nunnatsa commented Jul 30, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading