NE-2821: Add tls-scanner job for TLS1.3 on Gateway API - #82586
Conversation
|
@rikatz: This pull request references NE-2821 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
WalkthroughAdds component-scoped TLS scanning and optional Gateway API TLS 1.3 scanning pipelines for cluster-ingress-operator master and releases 4.23, 5.0, and 5.1. ChangesTLS scanner Gateway API integration
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant tls-scanner-gatewayapi
participant gatewayapi-tls-scanner-setup
participant tls-scanner-run
tls-scanner-gatewayapi->>gatewayapi-tls-scanner-setup: Run make gatewayapi-tls-scanner-setup
gatewayapi-tls-scanner-setup->>tls-scanner-run: Provide configured Gateway API environment
tls-scanner-run->>tls-scanner-run: Apply COMPONENT_FILTER and scan TLS 1.3 targets
Possibly related PRs
🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: rikatz The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml`:
- Around line 314-341: Regenerate CI metadata for the new tls-scanner-gatewayapi
job by running make update once after all edits, then commit the generated
output. Apply this for the master job
(ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml:314-341),
4.23 job
(ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml:287-314),
5.0 job
(ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml:288-315),
and 5.1 job
(ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml:287-314).
In
`@ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml`:
- Around line 288-315: Regenerate the Prow-job configuration for the new
tls-scanner-gatewayapi job by running the repository’s make update target, and
commit all generated metadata and Prow-job output alongside the configuration
change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 551de558-e2c8-4769-9b1c-7ec8ae4f47f3
⛔ Files ignored due to path filters (4)
ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0-presubmits.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (7)
ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yamlci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yamlci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yamlci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yamlci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yamlci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.shci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml
| - always_run: false | ||
| as: tls-scanner-gatewayapi | ||
| optional: true | ||
| pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ | ||
| steps: | ||
| cluster_profile: openshift-org-aws | ||
| env: | ||
| COMPONENT_FILTER: tls-scanner-gatewayapi | ||
| FEATURE_SET: TechPreviewNoUpgrade | ||
| GATEWAY_NAME: tls-scanner-gatewayapi | ||
| SCAN_NAMESPACE: openshift-ingress | ||
| SCANNER_CPU: "1" | ||
| SCANNER_MEMORY: 1Gi | ||
| TLS_13_ENABLE_TLS_ADHERENCE: "true" | ||
| TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents | ||
| test: | ||
| - ref: tls-13 | ||
| - as: setup-gateway | ||
| cli: latest | ||
| commands: make gatewayapi-tls-scanner-setup | ||
| env: | ||
| - name: GATEWAY_NAME | ||
| from: src | ||
| resources: | ||
| requests: | ||
| cpu: 100m | ||
| - ref: tls-scanner-run | ||
| workflow: ipi-aws |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Regenerate CI configuration for all new jobs.
Each branch adds the same structural tls-scanner-gatewayapi job without generated Prow-job/metadata changes. Run make update once after all edits and commit its output.
ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml#L314-L341: regenerate output for the master job.ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml#L287-L314: regenerate output for the 4.23 job.ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml#L288-L315: regenerate output for the 5.0 job.ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml#L287-L314: regenerate output for the 5.1 job.
📍 Affects 4 files
ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml#L314-L341(this comment)ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml#L287-L314ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml#L288-L315ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml#L287-L314
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml`
around lines 314 - 341, Regenerate CI metadata for the new
tls-scanner-gatewayapi job by running make update once after all edits, then
commit the generated output. Apply this for the master job
(ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml:314-341),
4.23 job
(ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml:287-314),
5.0 job
(ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml:288-315),
and 5.1 job
(ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml:287-314).
Source: Coding guidelines
|
/pj-rehearse --pull=openshift/cluster-ingress-operator#1480 pull-ci-openshift-cluster-ingress-operator-master-tls-scanner-gatewayapi |
|
@rikatz: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@rikatz: job(s): --pull=openshift/cluster-ingress-operator#1480 either don't exist or were not found to be affected, and cannot be rehearsed |
|
/pj-rehearse help |
|
@rikatz: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse list |
|
@rikatz: job(s): help either don't exist or were not found to be affected, and cannot be rehearsed |
|
@rikatz: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
[REHEARSALNOTIFIER]
A total of 216 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
@rikatz: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/assign @gcs278 |
|
/assign @bentito |
4 participants
This PR adds a new set of jobs for cluster-ingress-operator to test TLS 1.3 adherence.
It expects a cluster with TLS 1.3 and Adherence strict, and will provision a new Gateway and validate if the gateway is adherent with the tls-scanner
Summary by CodeRabbit
COMPONENT_FILTER, allowing scans to target pods by component labels and avoid unrelated workloads.