From f9d2c7324fa654badf2e91a75488b1edc6b332da Mon Sep 17 00:00:00 2001 From: Nicholas Richardson <29212540+richardsonnick@users.noreply.github.com> Date: Tue, 11 Aug 2026 10:47:41 -0400 Subject: [PATCH 1/3] Add baremetal variant of tls-scanner TLSAdherence jobs --- .../openshift-tls-scanner-main.yaml | 25 +++++ .../openshift-tls-scanner-release-4.23.yaml | 15 +++ .../openshift-tls-scanner-release-5.0.yaml | 15 +++ .../openshift-tls-scanner-release-5.1.yaml | 15 +++ .../openshift-tls-scanner-main-periodics.yaml | 94 +++++++++++++++++++ ...t-tls-scanner-release-4.23-presubmits.yaml | 84 +++++++++++++++++ ...ft-tls-scanner-release-5.0-presubmits.yaml | 84 +++++++++++++++++ ...ft-tls-scanner-release-5.1-presubmits.yaml | 84 +++++++++++++++++ .../scanner/run/tls-scanner-run-commands.sh | 7 ++ 9 files changed, 423 insertions(+) diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml index c40aa50271cfa..e264d7154c151 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml @@ -179,6 +179,31 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: openshift-e2e-azure-ovn +- as: periodic-tls13-adherence-metal + interval: 72h + reporter_config: + channel: '#forum-case' + job_states_to_report: + - success + - failure + - error + report_template: '{{if eq .Status.State "success"}} :white_check_mark: Job *{{.Spec.Job}}* + ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :warning: + Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> + {{end}}' + steps: + cluster_profile: equinix-ocp-metal + env: + DEVSCRIPTS_CONFIG: | + IP_STACK=v4 + NETWORK_TYPE=OVNKubernetes + PQC_CHECK: "false" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - ref: tls-scanner-run + workflow: baremetalds-e2e - as: periodic-pqc-readiness-hypershift interval: 72h reporter_config: diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml index 26e675adb38e3..6c3d46276f52a 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml @@ -111,6 +111,21 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: openshift-e2e-azure-ovn +- as: tls13-adherence-metal + optional: true + steps: + cluster_profile: equinix-ocp-metal + env: + DEVSCRIPTS_CONFIG: | + IP_STACK=v4 + NETWORK_TYPE=OVNKubernetes + PQC_CHECK: "false" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - ref: tls-scanner-run + workflow: baremetalds-e2e - as: tls13-pqc-readiness optional: true steps: diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml index 602736bf235f5..8280bef1d431d 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml @@ -112,6 +112,21 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: openshift-e2e-azure-ovn +- as: tls13-adherence-metal + optional: true + steps: + cluster_profile: equinix-ocp-metal + env: + DEVSCRIPTS_CONFIG: | + IP_STACK=v4 + NETWORK_TYPE=OVNKubernetes + PQC_CHECK: "false" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - ref: tls-scanner-run + workflow: baremetalds-e2e - as: tls13-pqc-readiness optional: true steps: diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml index acb9a4158f909..c3b5dfa2dceb3 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml @@ -111,6 +111,21 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: openshift-e2e-azure-ovn +- as: tls13-adherence-metal + optional: true + steps: + cluster_profile: equinix-ocp-metal + env: + DEVSCRIPTS_CONFIG: | + IP_STACK=v4 + NETWORK_TYPE=OVNKubernetes + PQC_CHECK: "false" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - ref: tls-scanner-run + workflow: baremetalds-e2e - as: tls13-pqc-readiness optional: true steps: diff --git a/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-main-periodics.yaml b/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-main-periodics.yaml index aa4316dff6eb0..5a47d7d4d2d0b 100644 --- a/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-main-periodics.yaml +++ b/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-main-periodics.yaml @@ -563,3 +563,97 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build03 + decorate: true + decoration_config: + sparse_checkout_files: + - Dockerfile + extra_refs: + - base_ref: main + org: openshift + repo: tls-scanner + sparse_checkout_files: + - Dockerfile + interval: 72h + labels: + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-tls-scanner-main-periodic-tls13-adherence-metal + reporter_config: + slack: + channel: '#forum-case' + job_states_to_report: + - success + - failure + - error + report_template: '{{if eq .Status.State "success"}} :white_check_mark: Job *{{.Spec.Job}}* + ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :warning: + Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View + logs> {{end}}' + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=periodic-tls13-adherence-metal + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-4.23-presubmits.yaml b/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-4.23-presubmits.yaml index f5486b84553b4..84cabd4a0e646 100644 --- a/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-4.23-presubmits.yaml +++ b/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-4.23-presubmits.yaml @@ -482,6 +482,90 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )tls13-adherence-gcp,?($|\s.*) + - agent: kubernetes + always_run: true + branches: + - ^release-4\.23$ + - ^release-4\.23- + cluster: build05 + context: ci/prow/tls13-adherence-metal + decorate: true + decoration_config: + sparse_checkout_files: + - Dockerfile + labels: + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-tls-scanner-release-4.23-tls13-adherence-metal + optional: true + rerun_command: /test tls13-adherence-metal + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-metal + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls13-adherence-metal,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.0-presubmits.yaml b/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.0-presubmits.yaml index 8152e0640b933..a47bea1d2deab 100644 --- a/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.0-presubmits.yaml +++ b/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.0-presubmits.yaml @@ -481,6 +481,90 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )tls13-adherence-gcp,?($|\s.*) + - agent: kubernetes + always_run: true + branches: + - ^release-5\.0$ + - ^release-5\.0- + cluster: build03 + context: ci/prow/tls13-adherence-metal + decorate: true + decoration_config: + sparse_checkout_files: + - Dockerfile + labels: + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-tls-scanner-release-5.0-tls13-adherence-metal + optional: true + rerun_command: /test tls13-adherence-metal + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-metal + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls13-adherence-metal,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.1-presubmits.yaml b/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.1-presubmits.yaml index 918fe3d92adda..5a2e0838bfbfe 100644 --- a/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.1-presubmits.yaml +++ b/ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.1-presubmits.yaml @@ -482,6 +482,90 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )tls13-adherence-gcp,?($|\s.*) + - agent: kubernetes + always_run: true + branches: + - ^release-5\.1$ + - ^release-5\.1- + cluster: build03 + context: ci/prow/tls13-adherence-metal + decorate: true + decoration_config: + sparse_checkout_files: + - Dockerfile + labels: + ci-operator.openshift.io/cloud: equinix-ocp-metal + ci-operator.openshift.io/cloud-cluster-profile: equinix-ocp-metal + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-tls-scanner-release-5.1-tls13-adherence-metal + optional: true + rerun_command: /test tls13-adherence-metal + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-metal + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls13-adherence-metal,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh index cf89d9e816d48..30929134267e1 100644 --- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh +++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh @@ -3,6 +3,13 @@ set -o nounset set -o errexit set -o pipefail +# Clusters behind a bastion (e.g. baremetal dev-scripts) are only reachable +# through the proxy configured by the install steps. +if test -f "${SHARED_DIR}/proxy-conf.sh"; then + # shellcheck disable=SC1090 + source "${SHARED_DIR}/proxy-conf.sh" +fi + run_tls_scan() { # TLS Scanner - scans TLS configurations of all pods in the cluster From 733d012a3e4ec0e78d4b9d2445bd5bd096b679e9 Mon Sep 17 00:00:00 2001 From: Nicholas Richardson <29212540+richardsonnick@users.noreply.github.com> Date: Tue, 11 Aug 2026 18:29:37 -0400 Subject: [PATCH 2/3] Add dev-scripts base image required by the baremetalds-e2e workflow --- .../openshift/tls-scanner/openshift-tls-scanner-main.yaml | 4 ++++ .../tls-scanner/openshift-tls-scanner-release-4.23.yaml | 4 ++++ .../tls-scanner/openshift-tls-scanner-release-5.0.yaml | 4 ++++ .../tls-scanner/openshift-tls-scanner-release-5.1.yaml | 4 ++++ 4 files changed, 16 insertions(+) diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml index e264d7154c151..6e13a03d9dad1 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml @@ -3,6 +3,10 @@ base_images: name: "5.0" namespace: ocp tag: base-rhel9 + dev-scripts: + name: test + namespace: ocp-kni + tag: dev-scripts hypershift-operator: name: hypershift-operator namespace: hypershift diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml index 6c3d46276f52a..6f0d8047fc2c9 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml @@ -3,6 +3,10 @@ base_images: name: "4.23" namespace: ocp tag: base-rhel9 + dev-scripts: + name: test + namespace: ocp-kni + tag: dev-scripts ocp_builder_rhel-9-golang-1.25-openshift-4.22: name: builder namespace: ocp diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml index 8280bef1d431d..f33779cf210a6 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml @@ -3,6 +3,10 @@ base_images: name: "5.0" namespace: ocp tag: base-rhel9 + dev-scripts: + name: test + namespace: ocp-kni + tag: dev-scripts ocp_builder_rhel-9-golang-1.25-openshift-4.22: name: builder namespace: ocp diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml index c3b5dfa2dceb3..0bfa14449aba7 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml @@ -3,6 +3,10 @@ base_images: name: "5.1" namespace: ocp tag: base-rhel9 + dev-scripts: + name: test + namespace: ocp-kni + tag: dev-scripts ocp_builder_rhel-9-golang-1.25-openshift-4.22: name: builder namespace: ocp From abd621a30eadf34394c053ef3b99a97ca8c116bd Mon Sep 17 00:00:00 2001 From: Nicholas Richardson <29212540+richardsonnick@users.noreply.github.com> Date: Wed, 12 Aug 2026 10:56:35 -0400 Subject: [PATCH 3/3] Lower scanner pod CPU request so it schedules on compact metal clusters The metal rehearsals failed with FailedScheduling (Insufficient cpu): the scanner pod defaulted to a Guaranteed 4 CPU request/limit, which does not fit on the dev-scripts workers. Request 500m/1Gi and keep the 4 CPU/4Gi limit so the pod schedules as Burstable and can still burst. Co-Authored-By: Claude Fable 5 --- .../openshift/tls-scanner/openshift-tls-scanner-main.yaml | 4 ++++ .../tls-scanner/openshift-tls-scanner-release-4.23.yaml | 4 ++++ .../tls-scanner/openshift-tls-scanner-release-5.0.yaml | 4 ++++ .../tls-scanner/openshift-tls-scanner-release-5.1.yaml | 4 ++++ 4 files changed, 16 insertions(+) diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml index 6e13a03d9dad1..fdb25f4941fdd 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml @@ -202,6 +202,10 @@ tests: IP_STACK=v4 NETWORK_TYPE=OVNKubernetes PQC_CHECK: "false" + SCANNER_CPU_LIMIT: "4" + SCANNER_CPU_REQUEST: 500m + SCANNER_MEM_LIMIT: 4Gi + SCANNER_MEM_REQUEST: 1Gi TLS_13_ENABLE_TLS_ADHERENCE: "true" TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml index 6f0d8047fc2c9..a2337235d9319 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml @@ -124,6 +124,10 @@ tests: IP_STACK=v4 NETWORK_TYPE=OVNKubernetes PQC_CHECK: "false" + SCANNER_CPU_LIMIT: "4" + SCANNER_CPU_REQUEST: 500m + SCANNER_MEM_LIMIT: 4Gi + SCANNER_MEM_REQUEST: 1Gi TLS_13_ENABLE_TLS_ADHERENCE: "true" TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml index f33779cf210a6..718e105cfe0e4 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml @@ -125,6 +125,10 @@ tests: IP_STACK=v4 NETWORK_TYPE=OVNKubernetes PQC_CHECK: "false" + SCANNER_CPU_LIMIT: "4" + SCANNER_CPU_REQUEST: 500m + SCANNER_MEM_LIMIT: 4Gi + SCANNER_MEM_REQUEST: 1Gi TLS_13_ENABLE_TLS_ADHERENCE: "true" TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: diff --git a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml index 0bfa14449aba7..b2e2d85c18cac 100644 --- a/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml +++ b/ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml @@ -124,6 +124,10 @@ tests: IP_STACK=v4 NETWORK_TYPE=OVNKubernetes PQC_CHECK: "false" + SCANNER_CPU_LIMIT: "4" + SCANNER_CPU_REQUEST: 500m + SCANNER_MEM_LIMIT: 4Gi + SCANNER_MEM_REQUEST: 1Gi TLS_13_ENABLE_TLS_ADHERENCE: "true" TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: