From ed976da9130097dbbb08b76d300c1ed0d329ee52 Mon Sep 17 00:00:00 2001
From: Arun Maurya <amaurya@redhat.com>
Date: Fri, 31 Jul 2026 16:26:38 +0530
Subject: [PATCH 1/6] Add optional TLS scanner CI job for cert-manager-operator

Add a manually triggered tls-scanner presubmit on master that installs
the operator, deploys the CertManager operand, and runs tls-scanner-run
against the cert-manager namespaces.
---
 ...penshift-cert-manager-operator-master.yaml | 44 +++++++++
 ...rt-manager-operator-master-presubmits.yaml | 90 +++++++++++++++++++
 2 files changed, 134 insertions(+)

diff --git a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
index d7cd74a54c900..d149fdbec2f36 100644
--- a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
+++ b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
@@ -11,6 +11,10 @@ base_images:
     name: "4.19"
     namespace: origin
     tag: operator-sdk
+  tls-scanner-tool:
+    name: tls-scanner
+    namespace: tls-scanner
+    tag: tls-scanner-tool
   upi-installer:
     name: "4.22"
     namespace: ocp
@@ -424,6 +428,46 @@ tests:
         requests:
           cpu: 100m
     workflow: openshift-e2e-azure-manual-oidc-workload-identity
+- always_run: false
+  as: tls-scanner
+  optional: true
+  steps:
+    cluster_profile: openshift-org-aws
+    dependencies:
+      OO_BUNDLE: cert-manager-operator-bundle
+    env:
+      OO_INSTALL_MODE: AllNamespaces
+      OO_INSTALL_NAMESPACE: cert-manager-operator
+      OO_SECURITY_CONTEXT: restricted
+      SCAN_NAMESPACE: cert-manager-operator,cert-manager
+      SCANNER_CPU: "1"
+      SCANNER_MEMORY: 1Gi
+      TLS_13_ENABLE_TLS_ADHERENCE: "true"
+      TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents
+    test:
+    - as: deploy-operand
+      cli: latest
+      commands: |-
+        oc apply -f - <<EOF
+        apiVersion: operator.openshift.io/v1alpha1
+        kind: CertManager
+        metadata:
+          name: cluster
+        spec:
+          logLevel: Normal
+          managementState: Managed
+        EOF
+        echo "Waiting for cert-manager operand deployments..."
+        oc wait --for=condition=Available -n cert-manager deployment/cert-manager --timeout=5m
+        oc wait --for=condition=Available -n cert-manager deployment/cert-manager-webhook --timeout=5m
+        oc wait --for=condition=Available -n cert-manager deployment/cert-manager-cainjector --timeout=5m
+      from: src
+      resources:
+        requests:
+          cpu: 100m
+    - ref: tls-13
+    - ref: tls-scanner-run
+    workflow: optional-operators-ci-operator-sdk-aws
 zz_generated_metadata:
   branch: master
   org: openshift
diff --git a/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml
index 04e8fe2a11d0e..296e057a1a33c 100644
--- a/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml
+++ b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml
@@ -1382,6 +1382,96 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )images,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^master$
+    - ^master-
+    cluster: build10
+    context: ci/prow/tls-scanner
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - .ci-operator.yaml
+      - images/ci/Dockerfile
+      - images/ci/Dockerfile.coverage
+      - images/ci/certmanager.Dockerfile
+      - images/ci/istiocsr.Dockerfile
+      - images/ci/trustmanager.Dockerfile
+    labels:
+      ci-operator.openshift.io/cloud: aws
+      ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
+      ci.openshift.io/generator: prowgen
+      job-release: "4.22"
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-cert-manager-operator-master-tls-scanner
+    optional: true
+    rerun_command: /test tls-scanner
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=tls-scanner
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )tls-scanner,?($|\s.*)
   - agent: kubernetes
     always_run: true
     branches:

From ebebc7897b8ce7a9cb72bbe486f9c486e04334ce Mon Sep 17 00:00:00 2001
From: Arun Maurya <amaurya@redhat.com>
Date: Tue, 4 Aug 2026 13:21:59 +0530
Subject: [PATCH 2/6] Enable TrustManager before cert-manager-operator TLS
 scanner

Replace the redundant CertManager CR apply with enabling the TrustManager
feature gate via subscription, waiting for operator rollout, creating the
TrustManager CR, and waiting for the trust-manager deployment.
---
 ...penshift-cert-manager-operator-master.yaml | 51 ++++++++++++++++---
 1 file changed, 44 insertions(+), 7 deletions(-)

diff --git a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
index d149fdbec2f36..a514766273d50 100644
--- a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
+++ b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
@@ -448,19 +448,56 @@ tests:
     - as: deploy-operand
       cli: latest
       commands: |-
+        set -o errexit
+        set -o nounset
+        set -o pipefail
+
+        echo "Waiting for default cert-manager operand deployments..."
+        oc wait --for=condition=Available -n cert-manager deployment/cert-manager --timeout=5m
+        oc wait --for=condition=Available -n cert-manager deployment/cert-manager-webhook --timeout=5m
+        oc wait --for=condition=Available -n cert-manager deployment/cert-manager-cainjector --timeout=5m
+
+        echo "Enabling TrustManager feature gate via subscription..."
+        oc -n cert-manager-operator patch subscription cert-manager-operator \
+          --type='merge' \
+          -p '{"spec":{"config":{"env":[{"name":"UNSUPPORTED_ADDON_FEATURES","value":"TrustManager=true"}]}}}'
+
+        echo "Waiting for TrustManager feature gate on operator pod args and rollout..."
+        FOUND=false
+        for _ in $(seq 1 60); do
+          ARGS=$(oc -n cert-manager-operator get deploy/cert-manager-operator-controller-manager \
+            -o jsonpath='{.spec.template.spec.containers[0].args[*]}' 2>/dev/null || true)
+          if echo "${ARGS}" | grep -q -- '--unsupported-addon-features=TrustManager=true'; then
+            echo "Found TrustManager feature gate in operator args: ${ARGS}"
+            FOUND=true
+            break
+          fi
+          sleep 5
+        done
+        if [[ "${FOUND}" != "true" ]]; then
+          echo "Timed out waiting for --unsupported-addon-features=TrustManager=true on operator deployment"
+          exit 1
+        fi
+        oc -n cert-manager-operator rollout status deployment/cert-manager-operator-controller-manager --timeout=5m
+
+        echo "Creating TrustManager CR..."
         oc apply -f - <<EOF
         apiVersion: operator.openshift.io/v1alpha1
-        kind: CertManager
+        kind: TrustManager
         metadata:
           name: cluster
         spec:
-          logLevel: Normal
-          managementState: Managed
+          trustManagerConfig:
+            logLevel: 1
+            logFormat: text
+            trustNamespace: cert-manager
+            defaultCAPackage:
+              policy: Enabled
         EOF
-        echo "Waiting for cert-manager operand deployments..."
-        oc wait --for=condition=Available -n cert-manager deployment/cert-manager --timeout=5m
-        oc wait --for=condition=Available -n cert-manager deployment/cert-manager-webhook --timeout=5m
-        oc wait --for=condition=Available -n cert-manager deployment/cert-manager-cainjector --timeout=5m
+
+        echo "Waiting for trust-manager deployment..."
+        oc wait --for=create -n cert-manager deployment/trust-manager --timeout=5m
+        oc wait --for=condition=Available -n cert-manager deployment/trust-manager --timeout=5m
       from: src
       resources:
         requests:

From d2c7ad230a683c8f0a082c7c160abd5b26ee6910 Mon Sep 17 00:00:00 2001
From: Arun Maurya <amaurya@redhat.com>
Date: Tue, 4 Aug 2026 16:53:57 +0530
Subject: [PATCH 3/6] Wait for cert-manager namespace and deployments to be
 created

Add oc wait --for=create for the cert-manager namespace and operand
deployments before the existing Available checks in the TLS scanner job.
---
 .../openshift-cert-manager-operator-master.yaml               | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
index a514766273d50..87812ccd3da46 100644
--- a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
+++ b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
@@ -453,6 +453,10 @@ tests:
         set -o pipefail
 
         echo "Waiting for default cert-manager operand deployments..."
+        oc wait --for=create namespace/cert-manager --timeout=5m
+        oc wait --for=create -n cert-manager deployment/cert-manager --timeout=5m
+        oc wait --for=create -n cert-manager deployment/cert-manager-webhook --timeout=5m
+        oc wait --for=create -n cert-manager deployment/cert-manager-cainjector --timeout=5m
         oc wait --for=condition=Available -n cert-manager deployment/cert-manager --timeout=5m
         oc wait --for=condition=Available -n cert-manager deployment/cert-manager-webhook --timeout=5m
         oc wait --for=condition=Available -n cert-manager deployment/cert-manager-cainjector --timeout=5m

From 3aca361606ac5bbfade7de1d07df0525ec795048 Mon Sep 17 00:00:00 2001
From: Arun Maurya <amaurya@redhat.com>
Date: Wed, 5 Aug 2026 17:55:09 +0530
Subject: [PATCH 4/6] Discover cert-manager Subscription name before
 TrustManager patch

operator-sdk run bundle creates a versioned Subscription, so stop
hardcoding cert-manager-operator and patch the Subscription that exists.
---
 .../openshift-cert-manager-operator-master.yaml      | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
index 87812ccd3da46..96bb439f17db9 100644
--- a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
+++ b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
@@ -462,7 +462,17 @@ tests:
         oc wait --for=condition=Available -n cert-manager deployment/cert-manager-cainjector --timeout=5m
 
         echo "Enabling TrustManager feature gate via subscription..."
-        oc -n cert-manager-operator patch subscription cert-manager-operator \
+        # operator-sdk run bundle creates a versioned Subscription name
+        # (e.g. cert-manager-operator-v1-20-0-sub), not a fixed cert-manager-operator.
+        # Match e2e getCertManagerOperatorSubscription: list and patch the one present.
+        SUB=$(oc -n cert-manager-operator get subscriptions.operators.coreos.com -o jsonpath='{.items[0].metadata.name}')
+        if [[ -z "${SUB}" ]]; then
+          echo "No Subscription found in cert-manager-operator namespace"
+          oc -n cert-manager-operator get subscriptions.operators.coreos.com -o yaml || true
+          exit 1
+        fi
+        echo "Patching Subscription ${SUB}"
+        oc -n cert-manager-operator patch subscription "${SUB}" \
           --type='merge' \
           -p '{"spec":{"config":{"env":[{"name":"UNSUPPORTED_ADDON_FEATURES","value":"TrustManager=true"}]}}}'
 

From 0389fe4978e2eeafebcc807f6772e059bbbbd86b Mon Sep 17 00:00:00 2001
From: Arun Maurya <amaurya@redhat.com>
Date: Thu, 6 Aug 2026 11:26:22 +0530
Subject: [PATCH 5/6] Wait for TrustManager feature gate via deployment env

Match e2e: poll UNSUPPORTED_ADDON_FEATURES on the operator
deployment instead of a CLI arg that is never set by OLM.
---
 .../openshift-cert-manager-operator-master.yaml     | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
index 96bb439f17db9..3b70c0e569319 100644
--- a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
+++ b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
@@ -476,20 +476,21 @@ tests:
           --type='merge' \
           -p '{"spec":{"config":{"env":[{"name":"UNSUPPORTED_ADDON_FEATURES","value":"TrustManager=true"}]}}}'
 
-        echo "Waiting for TrustManager feature gate on operator pod args and rollout..."
+        echo "Waiting for TrustManager feature gate on operator deployment env and rollout..."
         FOUND=false
         for _ in $(seq 1 60); do
-          ARGS=$(oc -n cert-manager-operator get deploy/cert-manager-operator-controller-manager \
-            -o jsonpath='{.spec.template.spec.containers[0].args[*]}' 2>/dev/null || true)
-          if echo "${ARGS}" | grep -q -- '--unsupported-addon-features=TrustManager=true'; then
-            echo "Found TrustManager feature gate in operator args: ${ARGS}"
+          ENV_VAL=$(oc -n cert-manager-operator get deploy/cert-manager-operator-controller-manager \
+            -o jsonpath='{range .spec.template.spec.containers[0].env[?(@.name=="UNSUPPORTED_ADDON_FEATURES")]}{.value}{end}' 2>/dev/null || true)
+          if [[ "${ENV_VAL}" == "TrustManager=true" ]]; then
+            echo "Found UNSUPPORTED_ADDON_FEATURES=${ENV_VAL} on operator deployment"
             FOUND=true
             break
           fi
           sleep 5
         done
         if [[ "${FOUND}" != "true" ]]; then
-          echo "Timed out waiting for --unsupported-addon-features=TrustManager=true on operator deployment"
+          echo "Timed out waiting for UNSUPPORTED_ADDON_FEATURES=TrustManager=true on operator deployment"
+          oc -n cert-manager-operator get deploy/cert-manager-operator-controller-manager -o yaml || true
           exit 1
         fi
         oc -n cert-manager-operator rollout status deployment/cert-manager-operator-controller-manager --timeout=5m

From 7bf722c47e42c230d4c5bf1ddaa88f61029f7f1b Mon Sep 17 00:00:00 2001
From: Arun Maurya <amaurya@redhat.com>
Date: Thu, 6 Aug 2026 11:34:48 +0530
Subject: [PATCH 6/6] Align TrustManager enablement with e2e helpers

Preserve existing Subscription env when enabling the feature gate,
apply a minimal TrustManager CR without defaultCAPackage, and wait
for Ready before scanning.
---
 ...penshift-cert-manager-operator-master.yaml | 34 ++++++++++++-------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
index 3b70c0e569319..8e39e7f068fb4 100644
--- a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
+++ b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml
@@ -471,10 +471,9 @@ tests:
           oc -n cert-manager-operator get subscriptions.operators.coreos.com -o yaml || true
           exit 1
         fi
-        echo "Patching Subscription ${SUB}"
-        oc -n cert-manager-operator patch subscription "${SUB}" \
-          --type='merge' \
-          -p '{"spec":{"config":{"env":[{"name":"UNSUPPORTED_ADDON_FEATURES","value":"TrustManager=true"}]}}}'
+        echo "Patching Subscription ${SUB} (preserve existing env, match e2e patchSubscriptionWithEnvVars)"
+        PATCH=$(oc -n cert-manager-operator get "subscription/${SUB}" -o json | python3 -c 'import json,sys; sub=json.load(sys.stdin); cfg=(sub.get("spec") or {}).get("config") or {}; env=[e for e in (cfg.get("env") or []) if e.get("name")!="UNSUPPORTED_ADDON_FEATURES"]; env.append({"name":"UNSUPPORTED_ADDON_FEATURES","value":"TrustManager=true"}); print(json.dumps({"spec":{"config":{"env":env}}}))')
+        oc -n cert-manager-operator patch "subscription/${SUB}" --type=merge -p "${PATCH}"
 
         echo "Waiting for TrustManager feature gate on operator deployment env and rollout..."
         FOUND=false
@@ -495,22 +494,33 @@ tests:
         fi
         oc -n cert-manager-operator rollout status deployment/cert-manager-operator-controller-manager --timeout=5m
 
-        echo "Creating TrustManager CR..."
+        echo "Creating TrustManager CR (minimal, match e2e newTrustManagerCR)..."
         oc apply -f - <<EOF
         apiVersion: operator.openshift.io/v1alpha1
         kind: TrustManager
         metadata:
           name: cluster
         spec:
-          trustManagerConfig:
-            logLevel: 1
-            logFormat: text
-            trustNamespace: cert-manager
-            defaultCAPackage:
-              policy: Enabled
+          trustManagerConfig: {}
         EOF
 
-        echo "Waiting for trust-manager deployment..."
+        echo "Waiting for TrustManager Ready and trust-manager deployment..."
+        FOUND=false
+        for _ in $(seq 1 60); do
+          READY=$(oc get trustmanagers.operator.openshift.io cluster \
+            -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}' 2>/dev/null || true)
+          if [[ "${READY}" == "True" ]]; then
+            echo "TrustManager CR is Ready"
+            FOUND=true
+            break
+          fi
+          sleep 5
+        done
+        if [[ "${FOUND}" != "true" ]]; then
+          echo "Timed out waiting for TrustManager Ready=True"
+          oc get trustmanagers.operator.openshift.io cluster -o yaml || true
+          exit 1
+        fi
         oc wait --for=create -n cert-manager deployment/trust-manager --timeout=5m
         oc wait --for=condition=Available -n cert-manager deployment/trust-manager --timeout=5m
       from: src