From d780e9add519c77de67cfb763b63ee2ee18559cf Mon Sep 17 00:00:00 2001 From: Mytreya Kasturi Date: Mon, 10 Aug 2026 17:57:54 +0530 Subject: [PATCH 1/2] Add TLS strict-adherence and PQC-readiness scanner jobs for SDK operators Deploys the sample memcached operator built from the existing osdk-helm-e2e / ansible-operator-e2e images and runs the tls-13 / tls-scanner-run steps against it, mirroring the tls13-adherence and tls-pqc-readiness (+ periodic) pattern used by oadp-operator and other repos. Co-authored-by: Cursor --- ...enshift-ansible-operator-plugins-main.yaml | 115 +++++++++++ ...enshift-ocp-release-operator-sdk-main.yaml | 123 ++++++++++++ ...sible-operator-plugins-main-periodics.yaml | 183 ++++++++++++++++++ ...ible-operator-plugins-main-presubmits.yaml | 176 +++++++++++++++++ ...p-release-operator-sdk-main-periodics.yaml | 179 +++++++++++++++++ ...-release-operator-sdk-main-presubmits.yaml | 174 +++++++++++++++++ 6 files changed, 950 insertions(+) create mode 100644 ci-operator/jobs/openshift/ansible-operator-plugins/openshift-ansible-operator-plugins-main-periodics.yaml create mode 100644 ci-operator/jobs/openshift/ocp-release-operator-sdk/openshift-ocp-release-operator-sdk-main-periodics.yaml diff --git a/ci-operator/config/openshift/ansible-operator-plugins/openshift-ansible-operator-plugins-main.yaml b/ci-operator/config/openshift/ansible-operator-plugins/openshift-ansible-operator-plugins-main.yaml index 23dbcc961ee7c..1e135aa8bf80f 100644 --- a/ci-operator/config/openshift/ansible-operator-plugins/openshift-ansible-operator-plugins-main.yaml +++ b/ci-operator/config/openshift/ansible-operator-plugins/openshift-ansible-operator-plugins-main.yaml @@ -1,3 +1,8 @@ +base_images: + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -146,6 +151,116 @@ tests: requests: cpu: 100m workflow: ipi-gcp +- always_run: false + as: tls13-adherence + optional: true + steps: + cluster_profile: openshift-org-gcp + env: + PQC_CHECK: "false" + SCAN_NAMESPACE: memcached-molecule-operator-system + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: deploy-operator + cli: latest + commands: | + cd testdata/memcached-molecule-operator + make deploy IMG="${IMAGE_FORMAT}" + oc wait --for=condition=Available --timeout=5m -n memcached-molecule-operator-system deployment/memcached-molecule-operator-controller-manager + dependencies: + - env: IMAGE_FORMAT + name: ansible-operator-e2e + from: src + resources: + requests: + cpu: 100m + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-gcp +- as: tls13-adherence-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: openshift-org-gcp + env: + PQC_CHECK: "false" + SCAN_NAMESPACE: memcached-molecule-operator-system + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: deploy-operator + cli: latest + commands: | + cd testdata/memcached-molecule-operator + make deploy IMG="${IMAGE_FORMAT}" + oc wait --for=condition=Available --timeout=5m -n memcached-molecule-operator-system deployment/memcached-molecule-operator-controller-manager + dependencies: + - env: IMAGE_FORMAT + name: ansible-operator-e2e + from: src + resources: + requests: + cpu: 100m + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-gcp +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: openshift-org-gcp + env: + PQC_CHECK: "true" + SCAN_NAMESPACE: memcached-molecule-operator-system + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + test: + - as: deploy-operator + cli: latest + commands: | + cd testdata/memcached-molecule-operator + make deploy IMG="${IMAGE_FORMAT}" + oc wait --for=condition=Available --timeout=5m -n memcached-molecule-operator-system deployment/memcached-molecule-operator-controller-manager + dependencies: + - env: IMAGE_FORMAT + name: ansible-operator-e2e + from: src + resources: + requests: + cpu: 100m + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-gcp +- as: tls-pqc-readiness-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: openshift-org-gcp + env: + PQC_CHECK: "true" + SCAN_NAMESPACE: memcached-molecule-operator-system + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + test: + - as: deploy-operator + cli: latest + commands: | + cd testdata/memcached-molecule-operator + make deploy IMG="${IMAGE_FORMAT}" + oc wait --for=condition=Available --timeout=5m -n memcached-molecule-operator-system deployment/memcached-molecule-operator-controller-manager + dependencies: + - env: IMAGE_FORMAT + name: ansible-operator-e2e + from: src + resources: + requests: + cpu: 100m + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-gcp - as: verify-deps steps: env: diff --git a/ci-operator/config/openshift/ocp-release-operator-sdk/openshift-ocp-release-operator-sdk-main.yaml b/ci-operator/config/openshift/ocp-release-operator-sdk/openshift-ocp-release-operator-sdk-main.yaml index a072a42aec715..a0b8d97a71ef1 100644 --- a/ci-operator/config/openshift/ocp-release-operator-sdk/openshift-ocp-release-operator-sdk-main.yaml +++ b/ci-operator/config/openshift/ocp-release-operator-sdk/openshift-ocp-release-operator-sdk-main.yaml @@ -1,3 +1,8 @@ +base_images: + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -147,6 +152,124 @@ tests: requests: cpu: 100m workflow: ipi-gcp +- always_run: false + as: tls13-adherence + optional: true + steps: + cluster_profile: openshift-org-gcp + env: + PQC_CHECK: "false" + SCAN_NAMESPACE: memcached-operator-system + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: deploy-operator + cli: latest + commands: | + make -f ci/prow.Makefile patch + cd testdata/helm/memcached-operator + oc adm policy add-cluster-role-to-user cluster-admin -z default || true + make deploy IMG="${IMAGE_FORMAT}" + oc wait --for=condition=Available --timeout=5m -n memcached-operator-system deployment/memcached-operator-controller-manager + dependencies: + - env: IMAGE_FORMAT + name: osdk-helm-e2e + from: src + resources: + requests: + cpu: 100m + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-gcp +- as: tls13-adherence-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: openshift-org-gcp + env: + PQC_CHECK: "false" + SCAN_NAMESPACE: memcached-operator-system + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: deploy-operator + cli: latest + commands: | + make -f ci/prow.Makefile patch + cd testdata/helm/memcached-operator + oc adm policy add-cluster-role-to-user cluster-admin -z default || true + make deploy IMG="${IMAGE_FORMAT}" + oc wait --for=condition=Available --timeout=5m -n memcached-operator-system deployment/memcached-operator-controller-manager + dependencies: + - env: IMAGE_FORMAT + name: osdk-helm-e2e + from: src + resources: + requests: + cpu: 100m + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-gcp +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: openshift-org-gcp + env: + PQC_CHECK: "true" + SCAN_NAMESPACE: memcached-operator-system + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + test: + - as: deploy-operator + cli: latest + commands: | + make -f ci/prow.Makefile patch + cd testdata/helm/memcached-operator + oc adm policy add-cluster-role-to-user cluster-admin -z default || true + make deploy IMG="${IMAGE_FORMAT}" + oc wait --for=condition=Available --timeout=5m -n memcached-operator-system deployment/memcached-operator-controller-manager + dependencies: + - env: IMAGE_FORMAT + name: osdk-helm-e2e + from: src + resources: + requests: + cpu: 100m + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-gcp +- as: tls-pqc-readiness-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: openshift-org-gcp + env: + PQC_CHECK: "true" + SCAN_NAMESPACE: memcached-operator-system + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + test: + - as: deploy-operator + cli: latest + commands: | + make -f ci/prow.Makefile patch + cd testdata/helm/memcached-operator + oc adm policy add-cluster-role-to-user cluster-admin -z default || true + make deploy IMG="${IMAGE_FORMAT}" + oc wait --for=condition=Available --timeout=5m -n memcached-operator-system deployment/memcached-operator-controller-manager + dependencies: + - env: IMAGE_FORMAT + name: osdk-helm-e2e + from: src + resources: + requests: + cpu: 100m + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-gcp - as: verify-deps steps: env: diff --git a/ci-operator/jobs/openshift/ansible-operator-plugins/openshift-ansible-operator-plugins-main-periodics.yaml b/ci-operator/jobs/openshift/ansible-operator-plugins/openshift-ansible-operator-plugins-main-periodics.yaml new file mode 100644 index 0000000000000..3ec844b7873ee --- /dev/null +++ b/ci-operator/jobs/openshift/ansible-operator-plugins/openshift-ansible-operator-plugins-main-periodics.yaml @@ -0,0 +1,183 @@ +periodics: +- agent: kubernetes + cluster: build13 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - openshift/Dockerfile + - openshift/Dockerfile.requirements + - openshift/ci/dockerfiles/ansible-e2e.Dockerfile + - openshift/release/ansible/Dockerfile.collections + extra_refs: + - base_ref: main + org: openshift + repo: ansible-operator-plugins + sparse_checkout_files: + - .ci-operator.yaml + - openshift/Dockerfile + - openshift/Dockerfile.requirements + - openshift/ci/dockerfiles/ansible-e2e.Dockerfile + - openshift/release/ansible/Dockerfile.collections + labels: + ci-operator.openshift.io/cloud: gcp + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-gcp + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-ansible-operator-plugins-main-tls-pqc-readiness-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-periodic + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build13 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - openshift/Dockerfile + - openshift/Dockerfile.requirements + - openshift/ci/dockerfiles/ansible-e2e.Dockerfile + - openshift/release/ansible/Dockerfile.collections + extra_refs: + - base_ref: main + org: openshift + repo: ansible-operator-plugins + sparse_checkout_files: + - .ci-operator.yaml + - openshift/Dockerfile + - openshift/Dockerfile.requirements + - openshift/ci/dockerfiles/ansible-e2e.Dockerfile + - openshift/release/ansible/Dockerfile.collections + labels: + ci-operator.openshift.io/cloud: gcp + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-gcp + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-ansible-operator-plugins-main-tls13-adherence-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-periodic + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/openshift/ansible-operator-plugins/openshift-ansible-operator-plugins-main-presubmits.yaml b/ci-operator/jobs/openshift/ansible-operator-plugins/openshift-ansible-operator-plugins-main-presubmits.yaml index 3b2223cbc599e..039d0a5267607 100644 --- a/ci-operator/jobs/openshift/ansible-operator-plugins/openshift-ansible-operator-plugins-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/ansible-operator-plugins/openshift-ansible-operator-plugins-main-presubmits.yaml @@ -480,6 +480,182 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )sanity,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build02 + context: ci/prow/tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - openshift/Dockerfile + - openshift/Dockerfile.requirements + - openshift/ci/dockerfiles/ansible-e2e.Dockerfile + - openshift/release/ansible/Dockerfile.collections + labels: + ci-operator.openshift.io/cloud: gcp + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-gcp + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-ansible-operator-plugins-main-tls-pqc-readiness + optional: true + rerun_command: /test tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build02 + context: ci/prow/tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - openshift/Dockerfile + - openshift/Dockerfile.requirements + - openshift/ci/dockerfiles/ansible-e2e.Dockerfile + - openshift/release/ansible/Dockerfile.collections + labels: + ci-operator.openshift.io/cloud: gcp + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-gcp + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-ansible-operator-plugins-main-tls13-adherence + optional: true + rerun_command: /test tls13-adherence + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/ocp-release-operator-sdk/openshift-ocp-release-operator-sdk-main-periodics.yaml b/ci-operator/jobs/openshift/ocp-release-operator-sdk/openshift-ocp-release-operator-sdk-main-periodics.yaml new file mode 100644 index 0000000000000..04021ee3d1339 --- /dev/null +++ b/ci-operator/jobs/openshift/ocp-release-operator-sdk/openshift-ocp-release-operator-sdk-main-periodics.yaml @@ -0,0 +1,179 @@ +periodics: +- agent: kubernetes + cluster: build13 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - ci/dockerfiles/builder.Dockerfile + - ci/dockerfiles/helm-e2e.Dockerfile + - release/helm/Dockerfile + extra_refs: + - base_ref: main + org: openshift + repo: ocp-release-operator-sdk + sparse_checkout_files: + - .ci-operator.yaml + - ci/dockerfiles/builder.Dockerfile + - ci/dockerfiles/helm-e2e.Dockerfile + - release/helm/Dockerfile + labels: + ci-operator.openshift.io/cloud: gcp + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-gcp + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-ocp-release-operator-sdk-main-tls-pqc-readiness-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-periodic + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build13 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - ci/dockerfiles/builder.Dockerfile + - ci/dockerfiles/helm-e2e.Dockerfile + - release/helm/Dockerfile + extra_refs: + - base_ref: main + org: openshift + repo: ocp-release-operator-sdk + sparse_checkout_files: + - .ci-operator.yaml + - ci/dockerfiles/builder.Dockerfile + - ci/dockerfiles/helm-e2e.Dockerfile + - release/helm/Dockerfile + labels: + ci-operator.openshift.io/cloud: gcp + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-gcp + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-ocp-release-operator-sdk-main-tls13-adherence-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-periodic + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/openshift/ocp-release-operator-sdk/openshift-ocp-release-operator-sdk-main-presubmits.yaml b/ci-operator/jobs/openshift/ocp-release-operator-sdk/openshift-ocp-release-operator-sdk-main-presubmits.yaml index 1dab573c09648..d26170b2e34a6 100644 --- a/ci-operator/jobs/openshift/ocp-release-operator-sdk/openshift-ocp-release-operator-sdk-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/ocp-release-operator-sdk/openshift-ocp-release-operator-sdk-main-presubmits.yaml @@ -474,6 +474,180 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )sanity,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build02 + context: ci/prow/tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - ci/dockerfiles/builder.Dockerfile + - ci/dockerfiles/helm-e2e.Dockerfile + - release/helm/Dockerfile + labels: + ci-operator.openshift.io/cloud: gcp + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-gcp + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-ocp-release-operator-sdk-main-tls-pqc-readiness + optional: true + rerun_command: /test tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build02 + context: ci/prow/tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - ci/dockerfiles/builder.Dockerfile + - ci/dockerfiles/helm-e2e.Dockerfile + - release/helm/Dockerfile + labels: + ci-operator.openshift.io/cloud: gcp + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-gcp + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-ocp-release-operator-sdk-main-tls13-adherence + optional: true + rerun_command: /test tls13-adherence + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: From 884cefe0231691520ac5e8141c257a8097e6dfcf Mon Sep 17 00:00:00 2001 From: Mytreya Kasturi Date: Fri, 14 Aug 2026 06:18:20 +0530 Subject: [PATCH 2/2] Fix deploy-operator: make kubectl available for make deploy The sample operators' Makefiles hard-code `kubectl apply`/`kubectl delete` in their `deploy`/`undeploy` targets, but the deploy-operator step only has `oc` available (via cli: latest). Symlink kubectl -> oc on PATH before invoking `make deploy`, same approach already relied on implicitly by other steps using oc for everything else. Co-authored-by: Cursor --- .../openshift-ansible-operator-plugins-main.yaml | 12 ++++++++++++ .../openshift-ocp-release-operator-sdk-main.yaml | 12 ++++++++++++ 2 files changed, 24 insertions(+) diff --git a/ci-operator/config/openshift/ansible-operator-plugins/openshift-ansible-operator-plugins-main.yaml b/ci-operator/config/openshift/ansible-operator-plugins/openshift-ansible-operator-plugins-main.yaml index 1e135aa8bf80f..240e9ffb558d0 100644 --- a/ci-operator/config/openshift/ansible-operator-plugins/openshift-ansible-operator-plugins-main.yaml +++ b/ci-operator/config/openshift/ansible-operator-plugins/openshift-ansible-operator-plugins-main.yaml @@ -167,6 +167,9 @@ tests: - as: deploy-operator cli: latest commands: | + mkdir -p /tmp/bin + ln -sf "$(command -v oc)" /tmp/bin/kubectl + export PATH="/tmp/bin:${PATH}" cd testdata/memcached-molecule-operator make deploy IMG="${IMAGE_FORMAT}" oc wait --for=condition=Available --timeout=5m -n memcached-molecule-operator-system deployment/memcached-molecule-operator-controller-manager @@ -195,6 +198,9 @@ tests: - as: deploy-operator cli: latest commands: | + mkdir -p /tmp/bin + ln -sf "$(command -v oc)" /tmp/bin/kubectl + export PATH="/tmp/bin:${PATH}" cd testdata/memcached-molecule-operator make deploy IMG="${IMAGE_FORMAT}" oc wait --for=condition=Available --timeout=5m -n memcached-molecule-operator-system deployment/memcached-molecule-operator-controller-manager @@ -222,6 +228,9 @@ tests: - as: deploy-operator cli: latest commands: | + mkdir -p /tmp/bin + ln -sf "$(command -v oc)" /tmp/bin/kubectl + export PATH="/tmp/bin:${PATH}" cd testdata/memcached-molecule-operator make deploy IMG="${IMAGE_FORMAT}" oc wait --for=condition=Available --timeout=5m -n memcached-molecule-operator-system deployment/memcached-molecule-operator-controller-manager @@ -248,6 +257,9 @@ tests: - as: deploy-operator cli: latest commands: | + mkdir -p /tmp/bin + ln -sf "$(command -v oc)" /tmp/bin/kubectl + export PATH="/tmp/bin:${PATH}" cd testdata/memcached-molecule-operator make deploy IMG="${IMAGE_FORMAT}" oc wait --for=condition=Available --timeout=5m -n memcached-molecule-operator-system deployment/memcached-molecule-operator-controller-manager diff --git a/ci-operator/config/openshift/ocp-release-operator-sdk/openshift-ocp-release-operator-sdk-main.yaml b/ci-operator/config/openshift/ocp-release-operator-sdk/openshift-ocp-release-operator-sdk-main.yaml index a0b8d97a71ef1..61b09a119b77f 100644 --- a/ci-operator/config/openshift/ocp-release-operator-sdk/openshift-ocp-release-operator-sdk-main.yaml +++ b/ci-operator/config/openshift/ocp-release-operator-sdk/openshift-ocp-release-operator-sdk-main.yaml @@ -168,6 +168,9 @@ tests: - as: deploy-operator cli: latest commands: | + mkdir -p /tmp/bin + ln -sf "$(command -v oc)" /tmp/bin/kubectl + export PATH="/tmp/bin:${PATH}" make -f ci/prow.Makefile patch cd testdata/helm/memcached-operator oc adm policy add-cluster-role-to-user cluster-admin -z default || true @@ -198,6 +201,9 @@ tests: - as: deploy-operator cli: latest commands: | + mkdir -p /tmp/bin + ln -sf "$(command -v oc)" /tmp/bin/kubectl + export PATH="/tmp/bin:${PATH}" make -f ci/prow.Makefile patch cd testdata/helm/memcached-operator oc adm policy add-cluster-role-to-user cluster-admin -z default || true @@ -227,6 +233,9 @@ tests: - as: deploy-operator cli: latest commands: | + mkdir -p /tmp/bin + ln -sf "$(command -v oc)" /tmp/bin/kubectl + export PATH="/tmp/bin:${PATH}" make -f ci/prow.Makefile patch cd testdata/helm/memcached-operator oc adm policy add-cluster-role-to-user cluster-admin -z default || true @@ -255,6 +264,9 @@ tests: - as: deploy-operator cli: latest commands: | + mkdir -p /tmp/bin + ln -sf "$(command -v oc)" /tmp/bin/kubectl + export PATH="/tmp/bin:${PATH}" make -f ci/prow.Makefile patch cd testdata/helm/memcached-operator oc adm policy add-cluster-role-to-user cluster-admin -z default || true