diff --git a/ci-operator/config/openshift/cincinnati-operator/openshift-cincinnati-operator-master.yaml b/ci-operator/config/openshift/cincinnati-operator/openshift-cincinnati-operator-master.yaml index 679d0d23671b2..73ab987822bfc 100644 --- a/ci-operator/config/openshift/cincinnati-operator/openshift-cincinnati-operator-master.yaml +++ b/ci-operator/config/openshift/cincinnati-operator/openshift-cincinnati-operator-master.yaml @@ -15,6 +15,10 @@ base_images: name: cincinnati-graph-data namespace: cincinnati-ci-public tag: stable + tls-scanner-tool: + name: "5.0" + namespace: ocp + tag: tls-scanner-tool ubi: name: ubi namespace: ocp @@ -99,6 +103,31 @@ tests: cpu: 500m memory: 1000Mi workflow: generic-claim +- always_run: false + as: install-bundle-tls-scan + optional: true + steps: + cluster_profile: openshift-org-aws + env: + COMPUTE_NODE_TYPE: m5.2xlarge + SCAN_NAMESPACE: install-osus-here + test: + - as: install + cli: latest + commands: | + oc create namespace install-osus-here + operator-sdk run bundle -n install-osus-here "$OO_BUNDLE" --security-context-config restricted + oc wait --for condition=Available -n install-osus-here deployment updateservice-operator + dependencies: + - env: OO_BUNDLE + name: cincinnati-bundle + from: operator-sdk + resources: + requests: + cpu: 500m + memory: 1000Mi + - ref: tls-scanner-run + workflow: ipi-aws - as: scorecard steps: allow_best_effort_post_steps: true diff --git a/ci-operator/config/openshift/cincinnati/openshift-cincinnati-master.yaml b/ci-operator/config/openshift/cincinnati/openshift-cincinnati-master.yaml index 8c25a9d316a28..c20107db44729 100644 --- a/ci-operator/config/openshift/cincinnati/openshift-cincinnati-master.yaml +++ b/ci-operator/config/openshift/cincinnati/openshift-cincinnati-master.yaml @@ -7,6 +7,10 @@ base_images: name: openapi-validator namespace: cincinnati-ci-public tag: ci-1.35.2 + tls-scanner-tool: + name: "5.0" + namespace: ocp + tag: tls-scanner-tool ubi: name: ubi namespace: ocp @@ -77,6 +81,12 @@ promotion: - downstream-deploy name: cincinnati-build-root namespace: cincinnati-ci +releases: + latest: + release: + architecture: multi + channel: candidate + version: "4.18" resources: '*': requests: @@ -178,6 +188,27 @@ tests: cpu: 100m memory: 200Mi workflow: generic-claim +- always_run: false + as: olm-e2e-tls-scan + optional: true + steps: + cluster_profile: openshift-org-aws + env: + COMPUTE_NODE_TYPE: m5.2xlarge + SCAN_NAMESPACE: openshift-update-service + test: + - as: openshift-e2e-test + commands: just run_e2e + dependencies: + - env: CINCINNATI_IMAGE + name: deploy + from: e2e-test + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-scanner-run + workflow: ipi-aws - as: osus-e2e cluster_claim: architecture: amd64 diff --git a/ci-operator/jobs/openshift/cincinnati-operator/openshift-cincinnati-operator-master-presubmits.yaml b/ci-operator/jobs/openshift/cincinnati-operator/openshift-cincinnati-operator-master-presubmits.yaml index f9847e85da898..0ff611f0940ae 100644 --- a/ci-operator/jobs/openshift/cincinnati-operator/openshift-cincinnati-operator-master-presubmits.yaml +++ b/ci-operator/jobs/openshift/cincinnati-operator/openshift-cincinnati-operator-master-presubmits.yaml @@ -351,6 +351,91 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )install-bundle,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^master$ + - ^master- + cluster: build07 + context: ci/prow/install-bundle-tls-scan + decorate: true + decoration_config: + sparse_checkout_files: + - build/Dockerfile + - dev/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cincinnati-operator-master-install-bundle-tls-scan + optional: true + rerun_command: /test install-bundle-tls-scan + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=install-bundle-tls-scan + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )install-bundle-tls-scan,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/cincinnati/openshift-cincinnati-master-presubmits.yaml b/ci-operator/jobs/openshift/cincinnati/openshift-cincinnati-master-presubmits.yaml index 8a19b606bcc31..ccb5ad7f1ea6f 100644 --- a/ci-operator/jobs/openshift/cincinnati/openshift-cincinnati-master-presubmits.yaml +++ b/ci-operator/jobs/openshift/cincinnati/openshift-cincinnati-master-presubmits.yaml @@ -23,6 +23,7 @@ presubmits: - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - --lease-server-credentials-file=/etc/boskos/credentials - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials - --target=cargo-test command: - ci-operator @@ -44,6 +45,9 @@ presubmits: - mountPath: /etc/boskos name: boskos readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true - mountPath: /secrets/gcs name: gcs-credentials readOnly: true @@ -64,6 +68,9 @@ presubmits: - key: credentials path: credentials secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials - name: manifest-tool-local-pusher secret: secretName: manifest-tool-local-pusher @@ -218,6 +225,90 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )olm-e2e,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^master$ + - ^master- + cluster: build06 + context: ci/prow/olm-e2e-tls-scan + decorate: true + decoration_config: + sparse_checkout_files: + - dist/Dockerfile.deploy/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cincinnati-master-olm-e2e-tls-scan + optional: true + rerun_command: /test olm-e2e-tls-scan + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=olm-e2e-tls-scan + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )olm-e2e-tls-scan,?($|\s.*) - agent: kubernetes always_run: true branches: