TRACING-6644 | Sse 4.22 for OTEL FIPS test with PQC ML-KEM

[pavolloffay]

https://redhat.atlassian.net/browse/TRACING-6644

Summary by CodeRabbit

• Updates the OpenTelemetry Operator OpenShift CI configuration for the OTEL FIPS test.
• Moves the test configuration to OpenShift 4.22 with SSE 4.22 and PQC ML-KEM scanning.
• Updates the CLI, UPI installer, TLS scanner, release version, and generated metadata.
• Updates Loki and cluster-logging channels to stable-6.6.
• Configures the scan namespace, skipped tests, and TLS scanner test step.
• Keeps the GCP IPI workflow unchanged.
• Tracks the change under TRACING-6644.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 7e33431f-34bb-4e2a-97ab-41e6d0382144

📥 Commits

Reviewing files that changed from the base of the PR and between 9a66b49 and 5c0cf22.

⛔ Files ignored due to path filters (2)

• ci-operator/jobs/openshift/open-telemetry-opentelemetry-operator/openshift-open-telemetry-opentelemetry-operator-main-periodics.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/open-telemetry-opentelemetry-operator/openshift-open-telemetry-opentelemetry-operator-main-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (1)

• ci-operator/config/openshift/open-telemetry-opentelemetry-operator/openshift-open-telemetry-opentelemetry-operator-main__opentelemetry-product-ocp-4.22-fips-stage.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The OpenShift 4.22 FIPS stage configuration updates images and release metadata. It updates logging channels, enables PQC checks, configures the scan namespace, changes skipped tests, and adds the TLS scanner test step. The GCP IPI workflow remains unchanged.

Changes

OpenTelemetry Operator 4.22 stage configuration

Layer / File(s)	Summary
Stage assets and validation flow ci-operator/config/openshift/open-telemetry-opentelemetry-operator/...yaml	The configuration updates OpenShift 4.22 images and release metadata. It changes Loki and cluster-logging channels to stable-6.6, enables PQC checks, configures the scan namespace, updates skipped tests, and adds the tls-scanner-run test step. The GCP IPI workflow remains unchanged.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🔵 Low · up to 5c0cf

The PR updates FIPS CI jobs and test configuration; merge readiness depends on confirming the intended scan namespace and regenerating/validating generated CI metadata. These are bounded, non-blocking follow-ups, so the change is mergeable with owner awareness.

Suggested reviewers: andreasgerstmayr, frzifus

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the OpenShift 4.22 update for the OTEL FIPS test with PQC ML-KEM, which matches the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The diff changes only CI configuration and generated job YAML; no Ginkgo title calls change. The configured test name remains the static opentelemetry-stage-tests.
Test Structure And Quality	✅ Passed	HEAD changes only three YAML CI configuration/job files; no Ginkgo test source or test assertions changed, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	The pull request changes only CI YAML and generated job definitions; it adds no Ginkgo test declarations or test source, so the MicroShift test compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only CI configuration and generated job YAML; it adds no Ginkgo e2e test source or multi-node test behavior requiring SNO review.
Topology-Aware Scheduling Compatibility	✅ Passed	The diff changes only CI configuration and generated Prow jobs; it adds no deployment, controller, affinity, topology spread, node selector, toleration, replica, or PDB constraints.
Ote Binary Stdout Contract	✅ Passed	The merge-base diff changes only YAML and generated job files; it introduces no OTE binary process-level stdout writes or logging changes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The diff changes only YAML configuration and generated job manifests; both config versions contain zero It/Describe/Context/When declarations, so no new Ginkgo test or network logic was added.
No-Weak-Crypto	✅ Passed	The cumulative PR diff changes YAML test and CI configuration only; exact added-line scans found no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The PR diff changes CI configuration, channels, test skips, and generated job labels only; no added privileged, host namespace, SYS_ADMIN, allowPrivilegeEscalation, or root settings appear.
No-Sensitive-Data-In-Logs	✅ Passed	The configuration adds fixed CI metadata, operator names, and a namespace-limited scanner; no changed log statement or password, token, API key, PII, hostname, or customer data is present.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[IshwarKanse]

Hi @pavolloffay, thanks for updating the OTEL FIPS stage config to 4.22 with PQC ML-KEM support. A few issues to address:

1. Cluster logging and Loki operator channels should be stable-6.6

The PR currently sets both loki-operator and cluster-logging channels to stable-6.4. These should be updated to stable-6.6:

{"name": "loki-operator", "source": "redhat-operators", "channel": "stable-6.6", ...}
{"name": "cluster-logging", "source": "redhat-operators", "channel": "stable-6.6", ...}

2. tls-scanner-run ref should come before distributed-tracing-tests-opentelemetry-stage

The TLS scanner should run before the OpenTelemetry stage tests. Current order:

    - ref: distributed-tracing-tests-opentelemetry-stage
    - ref: tls-scanner-run

Should be:

    - ref: tls-scanner-run
    - ref: distributed-tracing-tests-opentelemetry-stage

3. Missing entries in SKIP_TESTS

Two test skip entries were removed but still need to be skipped:

• tests/e2e-otel/oidcauthextension — not compatible with FIPS
• tests/e2e/smoke-ports — requires permissions disabled on FIPS cluster

Only tests/e2e-openshift/export-to-cluster-logging-lokistack can be safely removed from the skip list.

The SKIP_TESTS should be:

SKIP_TESTS: tests/e2e/smoke-ip-families tests/e2e-otel/*aws* tests/e2e-otel/oidcauthextension
  tests/e2e-otel/google* tests/e2e/smoke-ports tests/e2e-instrumentation/instrumentation-go

4. make update needs to be run

The CI checks ci-operator-config-metadata and generated-config are both failing because the generated Prow job configs haven't been regenerated after renaming the file from 4.17 to 4.22. Please run make update locally and commit the generated files.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@pavolloffay: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-open-telemetry-opentelemetry-operator-main-opentelemetry-product-ocp-4.22-fips-stage-images	openshift/open-telemetry-opentelemetry-operator	presubmit	Presubmit changed
periodic-ci-openshift-open-telemetry-opentelemetry-operator-main-opentelemetry-product-ocp-4.22-fips-stage-opentelemetry-stage-tests	N/A	periodic	Periodic changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@pavolloffay: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[IshwarKanse]

/lgtm
/pj-rehearse ack

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: IshwarKanse, pavolloffay

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/open-telemetry-opentelemetry-operator/OWNERS [IshwarKanse,pavolloffay]
• ci-operator/jobs/openshift/open-telemetry-opentelemetry-operator/OWNERS [IshwarKanse,pavolloffay]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

@IshwarKanse: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.