CMP-4147: Run tls-scanner on CO parallel jobs - #78651
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@rhmdnd: This pull request references CMP-4147 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
approved
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
WalkthroughAdds a ChangesCI Configuration Update
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Comment |
355b7c6 to
8d73bde
Compare
|
/pj-rehearse pull-ci-ComplianceAsCode-compliance-operator-master-e2e-aws-parallel |
|
@rhmdnd: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse |
|
@rhmdnd: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
8d73bde to
3722459
Compare
|
Need to bump node sizes so that the scanner will schedule. |
|
/pj-rehearse |
|
@rhmdnd: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
These rehearsals might be failing because we're attempting to run them on 4.17 clusters. The TLS consistency work is relatively new, and we should consider using newer versions of OCP for this (4.22+). |
3722459 to
28b6710
Compare
|
Rehearsals here should fail because the new test target hasn't landed, yet. |
|
/pj-rehearse pull-ci-ComplianceAsCode-compliance-operator-master-e2e-aws-deployment |
|
@rhmdnd: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/ComplianceAsCode/compliance-operator/ComplianceAsCode-compliance-operator-master.yaml`:
- Around line 130-157: The test step uses a mismatched CLI version ("cli:
latest") against the install override OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE:
release:latest-4-22; update the test step (the block starting with "- as: test"
/ "cli") to pin the CLI to the 4.22 release (e.g., "cli: 4.22" or the equivalent
release:latest-4-22 identifier) so the CLI version aligns with
OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE and avoids skew-related CI failures.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: d7a408a7-fa41-4780-8efc-6db5c198a9fa
📒 Files selected for processing (1)
ci-operator/config/ComplianceAsCode/compliance-operator/ComplianceAsCode-compliance-operator-master.yaml
The compliance operator already provisions an AWS cluster for CI on each PR. Let's add a new CI job that provisions the operator on a 4.22 cluster so we can test that it adheres to the OpenShift API server TLS settings.
28b6710 to
fd6f126
Compare
|
/pj-rehearse pull-ci-ComplianceAsCode-compliance-operator-master-e2e-aws-deployment |
|
@rhmdnd: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-ComplianceAsCode-compliance-operator-master-e2e-aws-deployment |
|
@rhmdnd: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@rhmdnd: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
openshift-ci
Bot
added
lgtm
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Adds tls-scanner-run as a test step to the opendatahub-operator-rhoai-e2e job to enforce TLS compliance scanning on deployed RHOAI components. Configuration: - Runs as final test step (blocks PR on failure, can be overridden) - PQC_CHECK: true (enable post-quantum crypto checks) - SCAN_NAMESPACE: redhat-ods-operator,redhat-ods-applications Follows the pattern from compliance-operator (PR openshift#78651). Reference: https://steps.ci.openshift.org/reference/tls-scanner-run Related: RHOAIENG-61076 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: rhmdnd, vickeybrown, Vincent056 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Adds tls-scanner-run as a test step to the opendatahub-operator-rhoai-e2e job to enforce TLS compliance scanning on deployed RHOAI components. Configuration: - tls-scanner-tool base image from OCP 4.22 - Runs as final test step (blocks PR on failure, can be overridden) - PQC_CHECK: true (enable post-quantum crypto checks) - SCAN_NAMESPACE: redhat-ods-operator,redhat-ods-applications Follows the pattern from compliance-operator (PR openshift#78651). Reference: https://steps.ci.openshift.org/reference/tls-scanner-run Related: RHOAIENG-61076 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Adds tls-scanner-run as a test step to the opendatahub-operator-rhoai-e2e job to enforce TLS compliance scanning on deployed RHOAI components. Configuration: - tls-scanner-tool base image from OCP 4.22 - Runs as final test step (blocks PR on failure, can be overridden) - PQC_CHECK: true (enable post-quantum crypto checks) - SCAN_NAMESPACE: redhat-ods-operator,redhat-ods-applications Follows the pattern from compliance-operator (PR openshift#78651). Reference: https://steps.ci.openshift.org/reference/tls-scanner-run Related: RHOAIENG-61076 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Adds tls-scanner-run as a test step to the opendatahub-operator-rhoai-e2e job to enforce TLS compliance scanning on deployed RHOAI components. Configuration: - tls-scanner-tool base image from OCP 4.22 - Runs as final test step (blocks PR on failure, can be overridden) - PQC_CHECK: true (enable post-quantum crypto checks) - SCAN_NAMESPACE: redhat-ods-operator,redhat-ods-applications Follows the pattern from compliance-operator (PR #78651). Reference: https://steps.ci.openshift.org/reference/tls-scanner-run Related: RHOAIENG-61076 Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
4 participants
The compliance operator already provisions an AWS cluster for CI on each
PR. Let's add the tls-scanner-run step here so that we're also scanning
all the available TLS endpoints in the openshift-compliance namespace to
ensure they're aligned with PQC and TLS consistency goals for OpenShift.
This updates the ComplianceAsCode/compliance-operator CI configuration in openshift/release to run the TLS scanner as part of the AWS e2e deployment job so TLS endpoints in the openshift-compliance namespace are scanned during CI.
Practical changes:
Notes from PR discussion: