diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml index c40aa50271cfa..fdb25f4941fdd 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml @@ -3,6 +3,10 @@ base_images: name: "5.0" namespace: ocp tag: base-rhel9 + dev-scripts: + name: test + namespace: ocp-kni + tag: dev-scripts hypershift-operator: name: hypershift-operator namespace: hypershift @@ -179,6 +183,35 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: openshift-e2e-azure-ovn +- as: periodic-tls13-adherence-metal + interval: 72h + reporter_config: + channel: '#forum-case' + job_states_to_report: + - success + - failure + - error + report_template: '{{if eq .Status.State "success"}} :white_check_mark: Job *{{.Spec.Job}}* + ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :warning: + Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> + {{end}}' + steps: + cluster_profile: equinix-ocp-metal + env: + DEVSCRIPTS_CONFIG: | + IP_STACK=v4 + NETWORK_TYPE=OVNKubernetes + PQC_CHECK: "false" + SCANNER_CPU_LIMIT: "4" + SCANNER_CPU_REQUEST: 500m + SCANNER_MEM_LIMIT: 4Gi + SCANNER_MEM_REQUEST: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - ref: tls-scanner-run + workflow: baremetalds-e2e - as: periodic-pqc-readiness-hypershift interval: 72h reporter_config: diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml index 26e675adb38e3..a2337235d9319 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml @@ -3,6 +3,10 @@ base_images: name: "4.23" namespace: ocp tag: base-rhel9 + dev-scripts: + name: test + namespace: ocp-kni + tag: dev-scripts ocp_builder_rhel-9-golang-1.25-openshift-4.22: name: builder namespace: ocp @@ -111,6 +115,25 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: openshift-e2e-azure-ovn +- as: tls13-adherence-metal + optional: true + steps: + cluster_profile: equinix-ocp-metal + env: + DEVSCRIPTS_CONFIG: | + IP_STACK=v4 + NETWORK_TYPE=OVNKubernetes + PQC_CHECK: "false" + SCANNER_CPU_LIMIT: "4" + SCANNER_CPU_REQUEST: 500m + SCANNER_MEM_LIMIT: 4Gi + SCANNER_MEM_REQUEST: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - ref: tls-scanner-run + workflow: baremetalds-e2e - as: tls13-pqc-readiness optional: true steps: diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml index 602736bf235f5..718e105cfe0e4 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml @@ -3,6 +3,10 @@ base_images: name: "5.0" namespace: ocp tag: base-rhel9 + dev-scripts: + name: test + namespace: ocp-kni + tag: dev-scripts ocp_builder_rhel-9-golang-1.25-openshift-4.22: name: builder namespace: ocp @@ -112,6 +116,25 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: openshift-e2e-azure-ovn +- as: tls13-adherence-metal + optional: true + steps: + cluster_profile: equinix-ocp-metal + env: + DEVSCRIPTS_CONFIG: | + IP_STACK=v4 + NETWORK_TYPE=OVNKubernetes + PQC_CHECK: "false" + SCANNER_CPU_LIMIT: "4" + SCANNER_CPU_REQUEST: 500m + SCANNER_MEM_LIMIT: 4Gi + SCANNER_MEM_REQUEST: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - ref: tls-scanner-run + workflow: baremetalds-e2e - as: tls13-pqc-readiness optional: true steps: diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml index acb9a4158f909..b2e2d85c18cac 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml @@ -3,6 +3,10 @@ base_images: name: "5.1" namespace: ocp tag: base-rhel9 + dev-scripts: + name: test + namespace: ocp-kni + tag: dev-scripts ocp_builder_rhel-9-golang-1.25-openshift-4.22: name: builder namespace: ocp @@ -111,6 +115,25 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: openshift-e2e-azure-ovn +- as: tls13-adherence-metal + optional: true + steps: + cluster_profile: equinix-ocp-metal + env: + DEVSCRIPTS_CONFIG: | + IP_STACK=v4 + NETWORK_TYPE=OVNKubernetes + PQC_CHECK: "false" + SCANNER_CPU_LIMIT: "4" + SCANNER_CPU_REQUEST: 500m + SCANNER_MEM_LIMIT: 4Gi + SCANNER_MEM_REQUEST: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - ref: tls-scanner-run + workflow: baremetalds-e2e - as: tls13-pqc-readiness optional: true steps: diff --git a/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-main-periodics.yaml b/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-main-periodics.yaml index aa4316dff6eb0..5a47d7d4d2d0b 100644 --- a/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-main-periodics.yaml +++ b/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-main-periodics.yaml @@ -563,3 +563,97 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build03 + decorate: true + decoration_config: + sparse_checkout_files: + - Dockerfile + extra_refs: + - base_ref: main + org: openshift + repo: tls-scanner + sparse_checkout_files: + - Dockerfile + interval: 72h + labels: + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-tls-scanner-main-periodic-tls13-adherence-metal + reporter_config: + slack: + channel: '#forum-case' + job_states_to_report: + - success + - failure + - error + report_template: '{{if eq .Status.State "success"}} :white_check_mark: Job *{{.Spec.Job}}* + ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :warning: + Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View + logs> {{end}}' + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=periodic-tls13-adherence-metal + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-4.23-presubmits.yaml b/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-4.23-presubmits.yaml index f5486b84553b4..84cabd4a0e646 100644 --- a/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-4.23-presubmits.yaml +++ b/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-4.23-presubmits.yaml @@ -482,6 +482,90 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )tls13-adherence-gcp,?($|\s.*) + - agent: kubernetes + always_run: true + branches: + - ^release-4\.23$ + - ^release-4\.23- + cluster: build05 + context: ci/prow/tls13-adherence-metal + decorate: true + decoration_config: + sparse_checkout_files: + - Dockerfile + labels: + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-tls-scanner-release-4.23-tls13-adherence-metal + optional: true + rerun_command: /test tls13-adherence-metal + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-metal + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls13-adherence-metal,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.0-presubmits.yaml b/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.0-presubmits.yaml index 8152e0640b933..a47bea1d2deab 100644 --- a/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.0-presubmits.yaml +++ b/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.0-presubmits.yaml @@ -481,6 +481,90 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )tls13-adherence-gcp,?($|\s.*) + - agent: kubernetes + always_run: true + branches: + - ^release-5\.0$ + - ^release-5\.0- + cluster: build03 + context: ci/prow/tls13-adherence-metal + decorate: true + decoration_config: + sparse_checkout_files: + - Dockerfile + labels: + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-tls-scanner-release-5.0-tls13-adherence-metal + optional: true + rerun_command: /test tls13-adherence-metal + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-metal + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls13-adherence-metal,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.1-presubmits.yaml b/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.1-presubmits.yaml index 918fe3d92adda..5a2e0838bfbfe 100644 --- a/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.1-presubmits.yaml +++ b/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.1-presubmits.yaml @@ -482,6 +482,90 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )tls13-adherence-gcp,?($|\s.*) + - agent: kubernetes + always_run: true + branches: + - ^release-5\.1$ + - ^release-5\.1- + cluster: build03 + context: ci/prow/tls13-adherence-metal + decorate: true + decoration_config: + sparse_checkout_files: + - Dockerfile + labels: + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-tls-scanner-release-5.1-tls13-adherence-metal + optional: true + rerun_command: /test tls13-adherence-metal + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-metal + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls13-adherence-metal,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh index cf89d9e816d48..30929134267e1 100644 --- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh +++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh @@ -3,6 +3,13 @@ set -o nounset set -o errexit set -o pipefail +# Clusters behind a bastion (e.g. baremetal dev-scripts) are only reachable +# through the proxy configured by the install steps. +if test -f "${SHARED_DIR}/proxy-conf.sh"; then + # shellcheck disable=SC1090 + source "${SHARED_DIR}/proxy-conf.sh" +fi + run_tls_scan() { # TLS Scanner - scans TLS configurations of all pods in the cluster