diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.23.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.23.yaml index 4cefb7b820a34..b4dff8ede7c24 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "false" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml index 5f801adaad86e..d03abc2133ecb 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "false" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml index e68f76fbf5e9c..cdc38e4e79912 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "false" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.8 org: medik8s diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml index 78048bf5279b1..b5e116c191815 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "false" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.8 org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml index da8875c0d6a7f..b8f627977a62a 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml @@ -95,6 +95,74 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "false" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml index e77265039e2bd..7a4e36e2135a4 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -95,6 +99,74 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "false" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml index 0e3ffabd70ec0..07b4e62c33164 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml @@ -81,6 +81,74 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "false" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.7 org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml index f7a8db75ddfec..393e2b64da111 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -81,6 +85,74 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "false" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.7 org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml index 83797e9e4877d..e063eb33b5137 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml @@ -105,6 +105,76 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml index 2b0c33d04d99e..92966f86f823a 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml @@ -11,6 +11,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -105,6 +109,76 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml index eba623116dfe1..e620518827099 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml @@ -84,6 +84,76 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.12 org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml index a0fcbed82fb44..0f5af35d84a07 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -84,6 +88,76 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.12 org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml index eaebc9c4aedfd..35f1f906efa3c 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml @@ -88,6 +88,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml index a70988e1d8205..271f579ea9f2d 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: "5.0" namespace: ocp tag: base + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -88,6 +92,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml index de2bad83ca964..0e36fdebafb17 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml @@ -88,6 +88,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.21 org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml index 159e623e2e127..e93294c3ac3e8 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: "5.0" namespace: ocp tag: base + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -88,6 +92,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.21 org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml index 15ca0c19815e1..60655201877b6 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml @@ -90,6 +90,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml index 4a2d71b0e590e..b4d2b2acee4e5 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: ubi-minimal namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -90,6 +94,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml index d8ba7a6e784b3..2b45477b89dcb 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml @@ -90,6 +90,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.13 org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml index d7c3e689c4fcb..1624b568292ec 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: ubi-minimal namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -90,6 +94,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.13 org: medik8s diff --git a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.23.yaml b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.23.yaml index 339cb5c56b963..04217a3ea7d27 100644 --- a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -104,6 +108,76 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: sbr-operator-system + PQC_CHECK: "true" + SCAN_NAMESPACE: sbr-operator-system + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + - env: SBR_AGENT_IMAGE + name: sbr-agent + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: sbr-operator-system + PQC_CHECK: "false" + SCAN_NAMESPACE: sbr-operator-system + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + - env: SBR_AGENT_IMAGE + name: sbr-agent + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__5.0.yaml b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__5.0.yaml index 9afb07ca2f3ab..44dc2eeb39702 100644 --- a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -104,6 +108,76 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: sbr-operator-system + PQC_CHECK: "true" + SCAN_NAMESPACE: sbr-operator-system + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + - env: SBR_AGENT_IMAGE + name: sbr-agent + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: sbr-operator-system + PQC_CHECK: "false" + SCAN_NAMESPACE: sbr-operator-system + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + - env: SBR_AGENT_IMAGE + name: sbr-agent + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.23.yaml b/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.23.yaml new file mode 100644 index 0000000000000..e92c36f125114 --- /dev/null +++ b/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.23.yaml @@ -0,0 +1,61 @@ +base_images: + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool +build_root: + from_repository: true +releases: + latest: + release: + channel: stable + version: "4.23" +resources: + '*': + requests: + cpu: 500m + memory: 1000Mi +tests: +- as: tls13-adherence-all + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: openshift-workload-availability + OCP_VERSION: "423" + OO_CHANNEL: stable + OPERATORS: fence-agents-remediation,self-node-remediation,node-healthcheck-operator,node-maintenance-operator,machine-deletion-remediation,storage-based-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: openshift-workload-availability + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: medik8s-catalogsource + - ref: medik8s-operator-subscribe + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls-pqc-readiness-all + cron: 0 6 * * 3 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: openshift-workload-availability + OCP_VERSION: "423" + OO_CHANNEL: stable + OPERATORS: fence-agents-remediation,self-node-remediation,node-healthcheck-operator,node-maintenance-operator,machine-deletion-remediation,storage-based-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: openshift-workload-availability + test: + - ref: medik8s-catalogsource + - ref: medik8s-operator-subscribe + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +zz_generated_metadata: + branch: main + org: medik8s + repo: system-tests + variant: "4.23" diff --git a/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__5.0.yaml b/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__5.0.yaml new file mode 100644 index 0000000000000..a2c7d0bdfae91 --- /dev/null +++ b/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__5.0.yaml @@ -0,0 +1,61 @@ +base_images: + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool +build_root: + from_repository: true +releases: + latest: + release: + channel: stable + version: "5.0" +resources: + '*': + requests: + cpu: 500m + memory: 1000Mi +tests: +- as: tls13-adherence-all + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: openshift-workload-availability + OCP_VERSION: "50" + OO_CHANNEL: stable + OPERATORS: fence-agents-remediation,self-node-remediation,node-healthcheck-operator,node-maintenance-operator,machine-deletion-remediation,storage-based-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: openshift-workload-availability + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: medik8s-catalogsource + - ref: medik8s-operator-subscribe + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls-pqc-readiness-all + cron: 0 6 * * 3 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: openshift-workload-availability + OCP_VERSION: "50" + OO_CHANNEL: stable + OPERATORS: fence-agents-remediation,self-node-remediation,node-healthcheck-operator,node-maintenance-operator,machine-deletion-remediation,storage-based-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: openshift-workload-availability + test: + - ref: medik8s-catalogsource + - ref: medik8s-operator-subscribe + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +zz_generated_metadata: + branch: main + org: medik8s + repo: system-tests + variant: "5.0" diff --git a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml index ee2d411de7321..5a7f7c1980729 100644 --- a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml index 9d6cec4054bdd..825327f1f8da2 100644 --- a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml +++ b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.8$ + - ^release-0\.8- + cluster: build07 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-release-0.8-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.8$ + - ^release-0\.8- + cluster: build07 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-release-0.8-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.8$ + - ^release-0\.8- + cluster: build07 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-release-0.8-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.8$ + - ^release-0\.8- + cluster: build07 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-release-0.8-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml index 059bf3f2b5d6e..b5497909975df 100644 --- a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml index db24c06ba4e64..7518ea52fe603 100644 --- a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml +++ b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.7$ + - ^release-0\.7- + cluster: build01 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.7$ + - ^release-0\.7- + cluster: build01 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.7$ + - ^release-0\.7- + cluster: build01 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.7$ + - ^release-0\.7- + cluster: build01 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml index 5a9215260345a..deade958ef61b 100644 --- a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml index 9ff683410b00d..f1b50deef9449 100644 --- a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.12$ + - ^release-0\.12- + cluster: build10 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.12$ + - ^release-0\.12- + cluster: build10 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.12$ + - ^release-0\.12- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.12$ + - ^release-0\.12- + cluster: build10 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml index f65870839d453..612547c864ba0 100644 --- a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml index 97abe94bdf4c2..63ee2182bb7ae 100644 --- a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.21$ + - ^release-0\.21- + cluster: build10 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-release-0.21-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.21$ + - ^release-0\.21- + cluster: build10 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-release-0.21-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.21$ + - ^release-0\.21- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-release-0.21-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.21$ + - ^release-0\.21- + cluster: build10 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-release-0.21-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml index 441dfbc75290c..1182e1d7de0c5 100644 --- a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build05 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build05 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build05 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build05 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml index 69a06b7105916..66fe45bb2dc8a 100644 --- a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml +++ b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.13$ + - ^release-0\.13- + cluster: build05 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-release-0.13-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.13$ + - ^release-0\.13- + cluster: build05 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-release-0.13-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.13$ + - ^release-0\.13- + cluster: build05 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-release-0.13-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.13$ + - ^release-0\.13- + cluster: build05 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-release-0.13-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml index 2082b9d7f96ff..5d2cfde2f7d70 100644 --- a/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml @@ -422,6 +422,186 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-openshift-e2e,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - cmd/sbr-agent/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-storage-based-remediation-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - cmd/sbr-agent/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-storage-based-remediation-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -633,3 +813,183 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-openshift-e2e,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - cmd/sbr-agent/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-storage-based-remediation-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - cmd/sbr-agent/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-storage-based-remediation-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-periodics.yaml b/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-periodics.yaml index 2165f0dbf00a6..549d33e58df05 100644 --- a/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-periodics.yaml +++ b/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-periodics.yaml @@ -945,3 +945,343 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build01 + cron: 0 6 * * 3 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + extra_refs: + - base_ref: main + org: medik8s + repo: system-tests + sparse_checkout_files: + - .ci-operator.yaml + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-system-tests-main-4.23-tls-pqc-readiness-all + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-all + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build01 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + extra_refs: + - base_ref: main + org: medik8s + repo: system-tests + sparse_checkout_files: + - .ci-operator.yaml + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-system-tests-main-4.23-tls13-adherence-all + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-all + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build01 + cron: 0 6 * * 3 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + extra_refs: + - base_ref: main + org: medik8s + repo: system-tests + sparse_checkout_files: + - .ci-operator.yaml + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-system-tests-main-5.0-tls-pqc-readiness-all + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-all + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build01 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + extra_refs: + - base_ref: main + org: medik8s + repo: system-tests + sparse_checkout_files: + - .ci-operator.yaml + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-system-tests-main-5.0-tls13-adherence-all + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-all + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator