Skip to content

MetalLB operator: add tls-scanner job #82125

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
oribon wants to merge 1 commit into
base: main
Choose a base branch
from
Open

MetalLB operator: add tls-scanner job #82125

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 69 additions & 0 deletions ci-operator/config/openshift/metallb-operator/openshift-metallb-operator-main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,10 @@ base_images:
name: "5.0"
namespace: ocp
tag: metallb-frr
tls-scanner-tool:
name: "5.0"
namespace: ocp
tag: tls-scanner-tool
build_root:
from_repository: true
images:
Expand Down Expand Up @@ -99,6 +103,71 @@ tests:
cpu: 100m
memory: 200Mi
workflow: generic-claim
- always_run: false
as: tls-scanner
cluster_claim:
architecture: amd64
cloud: aws
owner: openshift-ci
product: ocp
timeout: 1h0m0s
version: "4.22"
optional: true
steps:
Comment on lines +106 to +116

@coderabbitai coderabbitai Bot Jul 19, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Duplicate optional key in the same mapping.

optional: true is declared twice (Line 108 and Line 116) as sibling keys of the same tls-scanner test object. This is an invalid YAML mapping and is flagged by yamllint's key-duplicates check, which will likely fail CI validation/regeneration.

🐛 Proposed fix 
     version: "4.22"
-  optional: true
   steps:
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- always_run: false
as: tls-scanner
optional: true
cluster_claim:
architecture: amd64
cloud: aws
owner: openshift-ci
product: ocp
timeout: 1h0m0s
version: "4.22"
optional: true
steps:
- always_run: false
as: tls-scanner
optional: true
cluster_claim:
architecture: amd64
cloud: aws
owner: openshift-ci
product: ocp
timeout: 1h0m0s
version: "4.22"
steps:
🧰 Tools
🪛 YAMLlint (1.37.1)

[error] 116-116: duplication of key "optional" in mapping

(key-duplicates)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/openshift/metallb-operator/openshift-metallb-operator-main.yaml`
around lines 106 - 117, Remove the duplicate optional field from the tls-scanner
test mapping, retaining a single optional: true entry alongside the existing
cluster_claim and steps configuration.

Source: Linters/SAST tools

env:
SCAN_NAMESPACE: openshift-metallb-operator,openshift-frr-k8s
SCANNER_CPU: "1"
SCANNER_MEMORY: 1Gi
test:
- as: install
cli: latest
commands: |
oc create namespace openshift-metallb-operator
oc label --overwrite ns openshift-metallb-operator pod-security.kubernetes.io/enforce=privileged
make operator-sdk
./_cache/operator-sdk run bundle -n openshift-metallb-operator "$OO_BUNDLE"
oc wait --for condition=Available -n openshift-metallb-operator deployment metallb-operator-controller-manager
oc wait --for condition=Available -n openshift-metallb-operator deployment metallb-operator-webhook-server
dependencies:
- env: OO_BUNDLE
name: operatorbundle
from: src
resources:
requests:
cpu: 100m
memory: 200Mi
- as: deploy
cli: latest
commands: |
cat <<EOF | oc apply -f -
apiVersion: metallb.io/v1beta1
kind: MetalLB
metadata:
name: metallb
namespace: openshift-metallb-operator
EOF
echo "Waiting for MetalLB controller deployment to be available..."
oc wait --for=create -n openshift-metallb-operator deployment/controller --timeout=5m
oc wait --for=condition=Available -n openshift-metallb-operator deployment/controller --timeout=5m
echo "Waiting for MetalLB speaker daemonset to be available..."
oc wait --for=create -n openshift-metallb-operator daemonset/speaker --timeout=5m
oc rollout status -n openshift-metallb-operator daemonset/speaker --timeout=5m
echo "Waiting for openshift-frr-k8s namespace..."
oc wait --for=create namespace/openshift-frr-k8s --timeout=5m
echo "Waiting for frr-k8s-statuscleaner deployment to be available..."
oc wait --for=create -n openshift-frr-k8s deployment/frr-k8s-statuscleaner --timeout=5m
oc wait --for=condition=Available -n openshift-frr-k8s deployment/frr-k8s-statuscleaner --timeout=5m
echo "Waiting for frr-k8s daemonset to be available..."
oc wait --for=create -n openshift-frr-k8s daemonset/frr-k8s --timeout=5m
oc rollout status -n openshift-frr-k8s daemonset/frr-k8s --timeout=5m
echo "All MetalLB components deployed."
from: src
resources:
requests:
cpu: 100m
memory: 200Mi
- ref: tls-scanner-run
workflow: generic-claim
- as: metallb-e2e-metal
capabilities:
- intranet
Expand Down
91 changes: 91 additions & 0 deletions ci-operator/jobs/openshift/metallb-operator/openshift-metallb-operator-main-presubmits.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -497,6 +497,97 @@ presubmits:
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )security,?($|\s.*)
- agent: kubernetes
always_run: false
branches:
- ^main$
- ^main-
cluster: build02
context: ci/prow/tls-scanner
decorate: true
decoration_config:
sparse_checkout_files:
- .ci-operator.yaml
- Dockerfile.openshift
- bundleci.Dockerfile
labels:
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
name: pull-ci-openshift-metallb-operator-main-tls-scanner
optional: true
rerun_command: /test tls-scanner
spec:
containers:
- args:
- --gcs-upload-secret=/secrets/gcs/service-account.json
- --hive-kubeconfig=/secrets/hive-hive-credentials/kubeconfig
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
- --lease-server-credentials-file=/etc/boskos/credentials
- --report-credentials-file=/etc/report/credentials
- --secret-dir=/secrets/ci-pull-credentials
- --target=tls-scanner
command:
- ci-operator
env:
- name: HTTP_SERVER_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
imagePullPolicy: Always
name: ""
ports:
- containerPort: 8080
name: http
resources:
requests:
cpu: 10m
volumeMounts:
- mountPath: /etc/boskos
name: boskos
readOnly: true
- mountPath: /secrets/ci-pull-credentials
name: ci-pull-credentials
readOnly: true
- mountPath: /secrets/gcs
name: gcs-credentials
readOnly: true
- mountPath: /secrets/hive-hive-credentials
name: hive-hive-credentials
readOnly: true
- mountPath: /secrets/manifest-tool
name: manifest-tool-local-pusher
readOnly: true
- mountPath: /etc/pull-secret
name: pull-secret
readOnly: true
- mountPath: /etc/report
name: result-aggregator
readOnly: true
serviceAccountName: ci-operator
volumes:
- name: boskos
secret:
items:
- key: credentials
path: credentials
secretName: boskos-credentials
- name: ci-pull-credentials
secret:
secretName: ci-pull-credentials
- name: hive-hive-credentials
secret:
secretName: hive-hive-credentials
- name: manifest-tool-local-pusher
secret:
secretName: manifest-tool-local-pusher
- name: pull-secret
secret:
secretName: registry-pull-credentials
- name: result-aggregator
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )tls-scanner,?($|\s.*)
- agent: kubernetes
always_run: true
branches:
Expand Down