From e114ea0c5d40194efe0e69df8f486d8859ab68c6 Mon Sep 17 00:00:00 2001 From: Roman Bednar Date: Thu, 30 Jul 2026 16:34:14 +0200 Subject: [PATCH] STOR-3001: Add TLS scanner job to local-storage-operator Adds an optional, manually-triggered TLS scanner presubmit job (tls-scanner-local-storage) to local-storage-operator across main, release-4.23, release-5.0, and release-5.1 branches. The job provisions an AWS cluster, installs the operator through OLM, and scans the openshift-local-storage namespace. --- ...openshift-local-storage-operator-main.yaml | 25 ++++++ ...t-local-storage-operator-release-4.23.yaml | 25 ++++++ ...ft-local-storage-operator-release-5.0.yaml | 25 ++++++ ...ft-local-storage-operator-release-5.1.yaml | 25 ++++++ ...ocal-storage-operator-main-presubmits.yaml | 87 +++++++++++++++++++ ...rage-operator-release-4.23-presubmits.yaml | 87 +++++++++++++++++++ ...orage-operator-release-5.0-presubmits.yaml | 87 +++++++++++++++++++ ...orage-operator-release-5.1-presubmits.yaml | 87 +++++++++++++++++++ 8 files changed, 448 insertions(+) diff --git a/ci-operator/config/openshift/local-storage-operator/openshift-local-storage-operator-main.yaml b/ci-operator/config/openshift/local-storage-operator/openshift-local-storage-operator-main.yaml index ea569f4840ba7..f994076dae4cf 100644 --- a/ci-operator/config/openshift/local-storage-operator/openshift-local-storage-operator-main.yaml +++ b/ci-operator/config/openshift/local-storage-operator/openshift-local-storage-operator-main.yaml @@ -7,6 +7,10 @@ base_images: name: tests-private namespace: ci tag: "4.22" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -94,6 +98,27 @@ tests: test: - ref: openshift-extended-test workflow: optional-operators-ci-aws +- always_run: false + as: tls-scanner-local-storage + optional: true + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_INDEX: ci-index-local-storage-operator-bundle + env: + OO_CHANNEL: preview + OO_INSTALL_NAMESPACE: openshift-local-storage + OO_PACKAGE: local-storage-operator + OO_TARGET_NAMESPACES: '!install' + SCAN_NAMESPACE: openshift-local-storage + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - ref: tls-scanner-run + workflow: optional-operators-ci-aws - as: verify-deps steps: test: diff --git a/ci-operator/config/openshift/local-storage-operator/openshift-local-storage-operator-release-4.23.yaml b/ci-operator/config/openshift/local-storage-operator/openshift-local-storage-operator-release-4.23.yaml index b014ab22ba4e2..76697c868170c 100644 --- a/ci-operator/config/openshift/local-storage-operator/openshift-local-storage-operator-release-4.23.yaml +++ b/ci-operator/config/openshift/local-storage-operator/openshift-local-storage-operator-release-4.23.yaml @@ -7,6 +7,10 @@ base_images: name: tests-private namespace: ci tag: "4.22" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -94,6 +98,27 @@ tests: test: - ref: openshift-extended-test workflow: optional-operators-ci-aws +- always_run: false + as: tls-scanner-local-storage + optional: true + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_INDEX: ci-index-local-storage-operator-bundle + env: + OO_CHANNEL: preview + OO_INSTALL_NAMESPACE: openshift-local-storage + OO_PACKAGE: local-storage-operator + OO_TARGET_NAMESPACES: '!install' + SCAN_NAMESPACE: openshift-local-storage + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - ref: tls-scanner-run + workflow: optional-operators-ci-aws - as: verify-deps steps: test: diff --git a/ci-operator/config/openshift/local-storage-operator/openshift-local-storage-operator-release-5.0.yaml b/ci-operator/config/openshift/local-storage-operator/openshift-local-storage-operator-release-5.0.yaml index 23149e969bcbb..f02368eb91fd2 100644 --- a/ci-operator/config/openshift/local-storage-operator/openshift-local-storage-operator-release-5.0.yaml +++ b/ci-operator/config/openshift/local-storage-operator/openshift-local-storage-operator-release-5.0.yaml @@ -7,6 +7,10 @@ base_images: name: tests-private namespace: ci tag: "4.22" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -95,6 +99,27 @@ tests: test: - ref: openshift-extended-test workflow: optional-operators-ci-aws +- always_run: false + as: tls-scanner-local-storage + optional: true + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_INDEX: ci-index-local-storage-operator-bundle + env: + OO_CHANNEL: preview + OO_INSTALL_NAMESPACE: openshift-local-storage + OO_PACKAGE: local-storage-operator + OO_TARGET_NAMESPACES: '!install' + SCAN_NAMESPACE: openshift-local-storage + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - ref: tls-scanner-run + workflow: optional-operators-ci-aws - as: verify-deps steps: test: diff --git a/ci-operator/config/openshift/local-storage-operator/openshift-local-storage-operator-release-5.1.yaml b/ci-operator/config/openshift/local-storage-operator/openshift-local-storage-operator-release-5.1.yaml index a5e043746a913..830bb098e9a36 100644 --- a/ci-operator/config/openshift/local-storage-operator/openshift-local-storage-operator-release-5.1.yaml +++ b/ci-operator/config/openshift/local-storage-operator/openshift-local-storage-operator-release-5.1.yaml @@ -7,6 +7,10 @@ base_images: name: tests-private namespace: ci tag: "4.22" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -94,6 +98,27 @@ tests: test: - ref: openshift-extended-test workflow: optional-operators-ci-aws +- always_run: false + as: tls-scanner-local-storage + optional: true + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_INDEX: ci-index-local-storage-operator-bundle + env: + OO_CHANNEL: preview + OO_INSTALL_NAMESPACE: openshift-local-storage + OO_PACKAGE: local-storage-operator + OO_TARGET_NAMESPACES: '!install' + SCAN_NAMESPACE: openshift-local-storage + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - ref: tls-scanner-run + workflow: optional-operators-ci-aws - as: verify-deps steps: test: diff --git a/ci-operator/jobs/openshift/local-storage-operator/openshift-local-storage-operator-main-presubmits.yaml b/ci-operator/jobs/openshift/local-storage-operator/openshift-local-storage-operator-main-presubmits.yaml index aeed372823fe7..6116f927258de 100644 --- a/ci-operator/jobs/openshift/local-storage-operator/openshift-local-storage-operator-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/local-storage-operator/openshift-local-storage-operator-main-presubmits.yaml @@ -377,6 +377,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )security,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/tls-scanner-local-storage + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile.diskmaker.rhel7 + - Dockerfile.mustgather + - Dockerfile.rhel7 + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-local-storage-operator-main-tls-scanner-local-storage + optional: true + rerun_command: /test tls-scanner-local-storage + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-local-storage + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-local-storage,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/local-storage-operator/openshift-local-storage-operator-release-4.23-presubmits.yaml b/ci-operator/jobs/openshift/local-storage-operator/openshift-local-storage-operator-release-4.23-presubmits.yaml index 975051f8859c6..2cf2adf04f0bf 100644 --- a/ci-operator/jobs/openshift/local-storage-operator/openshift-local-storage-operator-release-4.23-presubmits.yaml +++ b/ci-operator/jobs/openshift/local-storage-operator/openshift-local-storage-operator-release-4.23-presubmits.yaml @@ -377,6 +377,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )security,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-4\.23$ + - ^release-4\.23- + cluster: build09 + context: ci/prow/tls-scanner-local-storage + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile.diskmaker.rhel7 + - Dockerfile.mustgather + - Dockerfile.rhel7 + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-local-storage-operator-release-4.23-tls-scanner-local-storage + optional: true + rerun_command: /test tls-scanner-local-storage + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-local-storage + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-local-storage,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/local-storage-operator/openshift-local-storage-operator-release-5.0-presubmits.yaml b/ci-operator/jobs/openshift/local-storage-operator/openshift-local-storage-operator-release-5.0-presubmits.yaml index 16bedd681cfd4..3db1b82086739 100644 --- a/ci-operator/jobs/openshift/local-storage-operator/openshift-local-storage-operator-release-5.0-presubmits.yaml +++ b/ci-operator/jobs/openshift/local-storage-operator/openshift-local-storage-operator-release-5.0-presubmits.yaml @@ -376,6 +376,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )security,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-5\.0$ + - ^release-5\.0- + cluster: build07 + context: ci/prow/tls-scanner-local-storage + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile.diskmaker.rhel7 + - Dockerfile.mustgather + - Dockerfile.rhel7 + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-local-storage-operator-release-5.0-tls-scanner-local-storage + optional: true + rerun_command: /test tls-scanner-local-storage + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-local-storage + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-local-storage,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/local-storage-operator/openshift-local-storage-operator-release-5.1-presubmits.yaml b/ci-operator/jobs/openshift/local-storage-operator/openshift-local-storage-operator-release-5.1-presubmits.yaml index 868469bddf746..76335f1e383af 100644 --- a/ci-operator/jobs/openshift/local-storage-operator/openshift-local-storage-operator-release-5.1-presubmits.yaml +++ b/ci-operator/jobs/openshift/local-storage-operator/openshift-local-storage-operator-release-5.1-presubmits.yaml @@ -377,6 +377,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )security,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-5\.1$ + - ^release-5\.1- + cluster: build07 + context: ci/prow/tls-scanner-local-storage + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile.diskmaker.rhel7 + - Dockerfile.mustgather + - Dockerfile.rhel7 + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-local-storage-operator-release-5.1-tls-scanner-local-storage + optional: true + rerun_command: /test tls-scanner-local-storage + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-local-storage + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-local-storage,?($|\s.*) - agent: kubernetes always_run: true branches: