From fdc275739a4a15c29be76f09a15f0ab1f9d6a095 Mon Sep 17 00:00:00 2001 From: Sayak Das Date: Tue, 11 Aug 2026 12:43:00 +0530 Subject: [PATCH 1/3] SPIRE-632: Add optional TLS scanner CI job for zero-trust-workload-identity-manager Install the PR operator on AWS, deploy SPIRE operand CRs, enable Modern TLS adherence, and scan operator/operand endpoints in the install namespace. --- ...-trust-workload-identity-manager-main.yaml | 143 ++++++++++++++++++ ...load-identity-manager-main-presubmits.yaml | 86 +++++++++++ 2 files changed, 229 insertions(+) diff --git a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml index 62a74abd2e869..8533d58454d13 100644 --- a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml +++ b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml @@ -7,6 +7,10 @@ base_images: name: "4.19" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build --warn-undefined-variables build_root: from_repository: true @@ -102,6 +106,145 @@ tests: requests: cpu: 100m workflow: optional-operators-ci-operator-sdk-aws +- always_run: false + as: tls-scanner + optional: true + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: zero-trust-workload-identity-manager-bundle + env: + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: zero-trust-workload-identity-manager + OO_SECURITY_CONTEXT: restricted + SCAN_NAMESPACE: zero-trust-workload-identity-manager + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: deploy-operand + cli: latest + commands: |- + set -o errexit + set -o nounset + set -o pipefail + + NS=zero-trust-workload-identity-manager + + echo "Waiting for operator Deployment..." + oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m + + echo "Waiting for managed CRDs..." + for crd in \ + zerotrustworkloadidentitymanagers.operator.openshift.io \ + spireservers.operator.openshift.io \ + spireagents.operator.openshift.io \ + spiffecsidrivers.operator.openshift.io \ + spireoidcdiscoveryproviders.operator.openshift.io; do + oc wait --for=condition=Established "crd/${crd}" --timeout=5m + done + + # Mirror the manual install flow: derive cluster-specific values, then apply + # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers + # operator and operand communication endpoints in ${NS}. + APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')" + JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}" + CLUSTER_NAME="cluster1" + BUNDLE_CONFIGMAP="spire-bundle" + + echo "APP_DOMAIN=${APP_DOMAIN}" + echo "JWT_ISSUER=${JWT_ISSUER}" + echo "CLUSTER_NAME=${CLUSTER_NAME}" + + echo "Applying ZTWIM and SPIRE operand CRs..." + cat < Date: Tue, 11 Aug 2026 13:02:11 +0530 Subject: [PATCH 2/3] SPIRE-632: Avoid logging cluster hostnames in tls-scanner deploy step Remove APP_DOMAIN/JWT_ISSUER echoes and wide pod listings so CI logs do not expose internal DNS or pod/node network details. Co-authored-by: Cursor --- ...-zero-trust-workload-identity-manager-main.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml index 8533d58454d13..237126eee2c93 100644 --- a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml +++ b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml @@ -148,17 +148,16 @@ tests: # Mirror the manual install flow: derive cluster-specific values, then apply # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers # operator and operand communication endpoints in ${NS}. + # Disable tracing while handling cluster-derived hostnames/issuer URLs. + [[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false + set +x APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')" JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}" CLUSTER_NAME="cluster1" BUNDLE_CONFIGMAP="spire-bundle" - echo "APP_DOMAIN=${APP_DOMAIN}" - echo "JWT_ISSUER=${JWT_ISSUER}" - echo "CLUSTER_NAME=${CLUSTER_NAME}" - echo "Applying ZTWIM and SPIRE operand CRs..." - cat </dev/null apiVersion: operator.openshift.io/v1alpha1 kind: ZeroTrustWorkloadIdentityManager metadata: @@ -218,6 +217,7 @@ tests: jwtIssuer: ${JWT_ISSUER} managedRoute: "true" EOF + $WAS_TRACING && set -x echo "Waiting for SPIRE Server StatefulSet..." oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m @@ -235,8 +235,8 @@ tests: oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m - echo "Listing pods in ${NS} before TLS scan:" - oc get pods -n "${NS}" -o wide || true + echo "Operand pod status in ${NS} before TLS scan:" + oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true from: src resources: requests: From 1cce697e0cf877dcafd681945069258789985571 Mon Sep 17 00:00:00 2001 From: Sayak Das Date: Mon, 17 Aug 2026 16:38:39 +0530 Subject: [PATCH 3/3] SPIRE-632: Add PQC readiness and weekly TLS scanner periodics for ZTWIM Extend the optional TLS scanner coverage with tls-pqc-readiness and weekly cron jobs so CI can validate TLS 1.3 adherence and ML-KEM/PQC readiness. Co-authored-by: Cursor --- ...-trust-workload-identity-manager-main.yaml | 413 ++++++++++++++++++ ...kload-identity-manager-main-periodics.yaml | 175 ++++++++ ...load-identity-manager-main-presubmits.yaml | 86 ++++ 3 files changed, 674 insertions(+) create mode 100644 ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml diff --git a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml index 237126eee2c93..f17d802a3ad1b 100644 --- a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml +++ b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml @@ -245,6 +245,419 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: optional-operators-ci-operator-sdk-aws +- as: tls-scanner-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: zero-trust-workload-identity-manager-bundle + env: + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: zero-trust-workload-identity-manager + OO_SECURITY_CONTEXT: restricted + SCAN_NAMESPACE: zero-trust-workload-identity-manager + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: deploy-operand + cli: latest + commands: |- + set -o errexit + set -o nounset + set -o pipefail + + NS=zero-trust-workload-identity-manager + + echo "Waiting for operator Deployment..." + oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m + + echo "Waiting for managed CRDs..." + for crd in \ + zerotrustworkloadidentitymanagers.operator.openshift.io \ + spireservers.operator.openshift.io \ + spireagents.operator.openshift.io \ + spiffecsidrivers.operator.openshift.io \ + spireoidcdiscoveryproviders.operator.openshift.io; do + oc wait --for=condition=Established "crd/${crd}" --timeout=5m + done + + # Mirror the manual install flow: derive cluster-specific values, then apply + # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers + # operator and operand communication endpoints in ${NS}. + # Disable tracing while handling cluster-derived hostnames/issuer URLs. + [[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false + set +x + APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')" + JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}" + CLUSTER_NAME="cluster1" + BUNDLE_CONFIGMAP="spire-bundle" + + echo "Applying ZTWIM and SPIRE operand CRs..." + cat </dev/null + apiVersion: operator.openshift.io/v1alpha1 + kind: ZeroTrustWorkloadIdentityManager + metadata: + name: cluster + spec: + trustDomain: ${APP_DOMAIN} + clusterName: ${CLUSTER_NAME} + bundleConfigMap: ${BUNDLE_CONFIGMAP} + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireServer + metadata: + name: cluster + spec: + jwtIssuer: ${JWT_ISSUER} + caValidity: 24h + defaultX509Validity: 1h + defaultJWTValidity: 5m + caSubject: + commonName: ${APP_DOMAIN} + country: "US" + organization: "RH" + persistence: + size: "1Gi" + accessMode: ReadWriteOncePod + datastore: + databaseType: sqlite3 + connectionString: "/run/spire/data/datastore.sqlite3" + maxOpenConns: 100 + maxIdleConns: 2 + connMaxLifetime: 3600 + disableMigration: "false" + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireAgent + metadata: + name: cluster + spec: + nodeAttestor: + k8sPSATEnabled: "true" + workloadAttestors: + k8sEnabled: "true" + workloadAttestorsVerification: + type: "auto" + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpiffeCSIDriver + metadata: + name: cluster + spec: {} + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireOIDCDiscoveryProvider + metadata: + name: cluster + spec: + jwtIssuer: ${JWT_ISSUER} + managedRoute: "true" + EOF + $WAS_TRACING && set -x + + echo "Waiting for SPIRE Server StatefulSet..." + oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m + oc rollout status statefulset/spire-server -n "${NS}" --timeout=10m + + echo "Waiting for SPIRE Agent DaemonSet..." + oc wait --for=create -n "${NS}" daemonset/spire-agent --timeout=10m + oc rollout status daemonset/spire-agent -n "${NS}" --timeout=10m + + echo "Waiting for SPIFFE CSI Driver DaemonSet..." + oc wait --for=create -n "${NS}" daemonset/spire-spiffe-csi-driver --timeout=10m + oc rollout status daemonset/spire-spiffe-csi-driver -n "${NS}" --timeout=10m + + echo "Waiting for OIDC Discovery Provider Deployment..." + oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m + oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m + + echo "Operand pod status in ${NS} before TLS scan:" + oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true + from: src + resources: + requests: + cpu: 100m + timeout: 45m0s + - ref: tls-13 + - ref: tls-scanner-run + workflow: optional-operators-ci-operator-sdk-aws +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: zero-trust-workload-identity-manager-bundle + env: + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: zero-trust-workload-identity-manager + OO_SECURITY_CONTEXT: restricted + PQC_CHECK: "true" + SCAN_NAMESPACE: zero-trust-workload-identity-manager + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + test: + - as: deploy-operand + cli: latest + commands: |- + set -o errexit + set -o nounset + set -o pipefail + + NS=zero-trust-workload-identity-manager + + echo "Waiting for operator Deployment..." + oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m + + echo "Waiting for managed CRDs..." + for crd in \ + zerotrustworkloadidentitymanagers.operator.openshift.io \ + spireservers.operator.openshift.io \ + spireagents.operator.openshift.io \ + spiffecsidrivers.operator.openshift.io \ + spireoidcdiscoveryproviders.operator.openshift.io; do + oc wait --for=condition=Established "crd/${crd}" --timeout=5m + done + + # Mirror the manual install flow: derive cluster-specific values, then apply + # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers + # operator and operand communication endpoints in ${NS}. + # Disable tracing while handling cluster-derived hostnames/issuer URLs. + [[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false + set +x + APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')" + JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}" + CLUSTER_NAME="cluster1" + BUNDLE_CONFIGMAP="spire-bundle" + + echo "Applying ZTWIM and SPIRE operand CRs..." + cat </dev/null + apiVersion: operator.openshift.io/v1alpha1 + kind: ZeroTrustWorkloadIdentityManager + metadata: + name: cluster + spec: + trustDomain: ${APP_DOMAIN} + clusterName: ${CLUSTER_NAME} + bundleConfigMap: ${BUNDLE_CONFIGMAP} + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireServer + metadata: + name: cluster + spec: + jwtIssuer: ${JWT_ISSUER} + caValidity: 24h + defaultX509Validity: 1h + defaultJWTValidity: 5m + caSubject: + commonName: ${APP_DOMAIN} + country: "US" + organization: "RH" + persistence: + size: "1Gi" + accessMode: ReadWriteOncePod + datastore: + databaseType: sqlite3 + connectionString: "/run/spire/data/datastore.sqlite3" + maxOpenConns: 100 + maxIdleConns: 2 + connMaxLifetime: 3600 + disableMigration: "false" + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireAgent + metadata: + name: cluster + spec: + nodeAttestor: + k8sPSATEnabled: "true" + workloadAttestors: + k8sEnabled: "true" + workloadAttestorsVerification: + type: "auto" + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpiffeCSIDriver + metadata: + name: cluster + spec: {} + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireOIDCDiscoveryProvider + metadata: + name: cluster + spec: + jwtIssuer: ${JWT_ISSUER} + managedRoute: "true" + EOF + $WAS_TRACING && set -x + + echo "Waiting for SPIRE Server StatefulSet..." + oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m + oc rollout status statefulset/spire-server -n "${NS}" --timeout=10m + + echo "Waiting for SPIRE Agent DaemonSet..." + oc wait --for=create -n "${NS}" daemonset/spire-agent --timeout=10m + oc rollout status daemonset/spire-agent -n "${NS}" --timeout=10m + + echo "Waiting for SPIFFE CSI Driver DaemonSet..." + oc wait --for=create -n "${NS}" daemonset/spire-spiffe-csi-driver --timeout=10m + oc rollout status daemonset/spire-spiffe-csi-driver -n "${NS}" --timeout=10m + + echo "Waiting for OIDC Discovery Provider Deployment..." + oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m + oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m + + echo "Operand pod status in ${NS} before TLS scan:" + oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true + from: src + resources: + requests: + cpu: 100m + timeout: 45m0s + - ref: tls-13 + - ref: tls-scanner-run + workflow: optional-operators-ci-operator-sdk-aws +- as: tls-pqc-readiness-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: zero-trust-workload-identity-manager-bundle + env: + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: zero-trust-workload-identity-manager + OO_SECURITY_CONTEXT: restricted + PQC_CHECK: "true" + SCAN_NAMESPACE: zero-trust-workload-identity-manager + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + test: + - as: deploy-operand + cli: latest + commands: |- + set -o errexit + set -o nounset + set -o pipefail + + NS=zero-trust-workload-identity-manager + + echo "Waiting for operator Deployment..." + oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m + + echo "Waiting for managed CRDs..." + for crd in \ + zerotrustworkloadidentitymanagers.operator.openshift.io \ + spireservers.operator.openshift.io \ + spireagents.operator.openshift.io \ + spiffecsidrivers.operator.openshift.io \ + spireoidcdiscoveryproviders.operator.openshift.io; do + oc wait --for=condition=Established "crd/${crd}" --timeout=5m + done + + # Mirror the manual install flow: derive cluster-specific values, then apply + # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers + # operator and operand communication endpoints in ${NS}. + # Disable tracing while handling cluster-derived hostnames/issuer URLs. + [[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false + set +x + APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')" + JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}" + CLUSTER_NAME="cluster1" + BUNDLE_CONFIGMAP="spire-bundle" + + echo "Applying ZTWIM and SPIRE operand CRs..." + cat </dev/null + apiVersion: operator.openshift.io/v1alpha1 + kind: ZeroTrustWorkloadIdentityManager + metadata: + name: cluster + spec: + trustDomain: ${APP_DOMAIN} + clusterName: ${CLUSTER_NAME} + bundleConfigMap: ${BUNDLE_CONFIGMAP} + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireServer + metadata: + name: cluster + spec: + jwtIssuer: ${JWT_ISSUER} + caValidity: 24h + defaultX509Validity: 1h + defaultJWTValidity: 5m + caSubject: + commonName: ${APP_DOMAIN} + country: "US" + organization: "RH" + persistence: + size: "1Gi" + accessMode: ReadWriteOncePod + datastore: + databaseType: sqlite3 + connectionString: "/run/spire/data/datastore.sqlite3" + maxOpenConns: 100 + maxIdleConns: 2 + connMaxLifetime: 3600 + disableMigration: "false" + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireAgent + metadata: + name: cluster + spec: + nodeAttestor: + k8sPSATEnabled: "true" + workloadAttestors: + k8sEnabled: "true" + workloadAttestorsVerification: + type: "auto" + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpiffeCSIDriver + metadata: + name: cluster + spec: {} + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireOIDCDiscoveryProvider + metadata: + name: cluster + spec: + jwtIssuer: ${JWT_ISSUER} + managedRoute: "true" + EOF + $WAS_TRACING && set -x + + echo "Waiting for SPIRE Server StatefulSet..." + oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m + oc rollout status statefulset/spire-server -n "${NS}" --timeout=10m + + echo "Waiting for SPIRE Agent DaemonSet..." + oc wait --for=create -n "${NS}" daemonset/spire-agent --timeout=10m + oc rollout status daemonset/spire-agent -n "${NS}" --timeout=10m + + echo "Waiting for SPIFFE CSI Driver DaemonSet..." + oc wait --for=create -n "${NS}" daemonset/spire-spiffe-csi-driver --timeout=10m + oc rollout status daemonset/spire-spiffe-csi-driver -n "${NS}" --timeout=10m + + echo "Waiting for OIDC Discovery Provider Deployment..." + oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m + oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m + + echo "Operand pod status in ${NS} before TLS scan:" + oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true + from: src + resources: + requests: + cpu: 100m + timeout: 45m0s + - ref: tls-13 + - ref: tls-scanner-run + workflow: optional-operators-ci-operator-sdk-aws - always_run: false as: e2e-operator-rhcos10-fips optional: true diff --git a/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml new file mode 100644 index 0000000000000..fe09db65631f9 --- /dev/null +++ b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml @@ -0,0 +1,175 @@ +periodics: +- agent: kubernetes + cluster: build05 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.coverage + extra_refs: + - base_ref: main + org: openshift + repo: zero-trust-workload-identity-manager + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.coverage + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-zero-trust-workload-identity-manager-main-tls-pqc-readiness-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-periodic + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build05 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.coverage + extra_refs: + - base_ref: main + org: openshift + repo: zero-trust-workload-identity-manager + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.coverage + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-zero-trust-workload-identity-manager-main-tls-scanner-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-periodic + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-presubmits.yaml b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-presubmits.yaml index 4721af1d02761..69e6957f6a531 100644 --- a/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-presubmits.yaml @@ -555,6 +555,92 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )(operator-e2e-coverage|remaining-required),?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build06 + context: ci/prow/tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.coverage + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-zero-trust-workload-identity-manager-main-tls-pqc-readiness + optional: true + rerun_command: /test tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: false branches: