DPTP-5088: [tls-scanner] Add periodic TLSAdherence scan for OCP 5.0

[richardsonnick]

The tls-scanner release-5.0 config had a tls13-adherence presubmit but no corresponding periodic. This adds a periodic-tls13-adherence job (72h interval) that runs the TLS scanner with TLS_13_ENABLE_TLS_ADHERENCE=true and StrictAllComponents policy against a OCP 5.0 cluster.

Summary by CodeRabbit

• New Features
  • Added periodic TLS 1.3 adherence jobs for the OpenShift 5.0 TLS scanner on OpenShift and OpenShift Privileged clusters.
  • Jobs run every 72 hours with TLS adherence enabled and the StrictAllComponents policy.
  • Added generated Prow job configuration and Slack reporting for success, failure, and error states.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 6ece7828-d5f6-4029-8ca6-9b23c6ca07b5

📥 Commits

Reviewing files that changed from the base of the PR and between 2f79079 and 7de6bf4.

⛔ Files ignored due to path filters (2)

• ci-operator/jobs/openshift-priv/tls-scanner/openshift-priv-tls-scanner-release-5.0-periodics.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.0-periodics.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (2)

• ci-operator/config/openshift-priv/tls-scanner/openshift-priv-tls-scanner-release-5.0.yaml
• ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml

🚧 Files skipped from review as they are similar to previous changes (2)

• ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml
• ci-operator/config/openshift-priv/tls-scanner/openshift-priv-tls-scanner-release-5.0.yaml

Included review availability: Your plan includes up to 12 reviews per rolling hour; 11 remain after this review.

---

Walkthrough

Adds the periodic-tls13-adherence job to the tls-scanner release 5.0 configurations for openshift and openshift-priv. The job runs every 72 hours, enables TLS 1.3 adherence, uses the AWS OVN workflow, and reports status to #forum-case.

Changes

TLS 1.3 adherence periodic testing

Layer / File(s)	Summary
Test configuration and execution wiring ci-operator/config/openshift/..., ci-operator/config/openshift-priv/..., ci-operator/jobs/openshift/...	Adds the 72-hour periodic-tls13-adherence test, TLS 1.3 adherence settings, AWS workflow wiring, status reporting, and the generated Prow job with its container, resources, service account, and secret-backed volumes.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 7de6b

This change adds the missing periodic TLS adherence scan configuration for OCP 5.0 without a supplied indication of correctness, security, availability, or deployment risk; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: danilo-gemoli, rhmdnd

Sequence Diagram(s)

sequenceDiagram
  participant CIConfig
  participant Prow
  participant CIOperator
  participant TLSScanner
  participant Slack
  CIConfig->>Prow: Schedule periodic-tls13-adherence every 72h
  Prow->>CIOperator: Start the configured job
  CIOperator->>TLSScanner: Run openshift-e2e-aws-ovn-tls-13
  TLSScanner-->>CIOperator: Return status and logs
  CIOperator->>Slack: Report success, failure, or error

Loading

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the new periodic TLS adherence scan for the TLS scanner on OpenShift 5.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The complete PR diff adds only YAML CI configuration and generated jobs; it contains no Ginkgo It(), Describe(), Context(), or When() test titles or dynamic title values.
Test Structure And Quality	✅ Passed	The PR diff changes only four YAML CI configuration/job files and adds no Ginkgo It blocks; the listed test-code quality requirements do not apply.
Microshift Test Compatibility	✅ Passed	The PR diff adds only ci-operator YAML job/config entries; it adds no Ginkgo e2e tests or test code that could reference unavailable MicroShift APIs.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only four YAML ci-operator config/job files; the complete diff adds no Go source or Ginkgo It, Describe, Context, or When declarations, so this SNO test check is inapplicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR only adds ci-operator test and Prow configurations; the diff contains no node selectors, affinity, spread constraints, tolerations, replica counts, or PDBs.
Ote Binary Stdout Contract	✅ Passed	The PR changes four YAML CI configuration and job files only; no OTE source or process-level stdout/logging code was added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The diff adds only YAML CI configuration and generated Prow jobs; it adds no new Ginkgo test or IPv4-only or external-service test logic.
No-Weak-Crypto	✅ Passed	The PR diff adds TLS adherence job configuration and secret mounts only; no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons appear.
Container-Privileges	✅ Passed	Added periodic configs contain no privileged:true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, capabilities, allowPrivilegeEscalation, or runAs-root settings; the pod shape matches existing TLS scann...
No-Sensitive-Data-In-Logs	✅ Passed	The diff adds only job/state/log-link Slack templates; it contains no secret values, tokens, PII, customer data, or explicit internal hostnames.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[richardsonnick]

Fixing build errors.

[coderabbitai]

Caution

Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted.

Error details

Validation Failed: {"resource":"IssueComment","code":"custom","field":"body","message":"body is too long (maximum is 65536 characters)"} - https://docs.github.com/rest/issues/comments#update-an-issue-comment

[richardsonnick]

/pj-rehearse periodic-ci-openshift-tls-scanner-release-5.0-periodic-tls13-adherence

[joelanford]

/lgtm

/hold
Feel free to unhold when you are happy with the rehearsals.

[openshift-merge-bot]

@richardsonnick: your /pj-rehearse request was not processed because the request waited in queue for longer than 5 minutes. Please retry in a few minutes.

[richardsonnick]

/unhold

[openshift-ci-robot]

@richardsonnick: This pull request references DPTP-5088 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

The tls-scanner release-5.0 config had a tls13-adherence presubmit but no corresponding periodic. This adds a periodic-tls13-adherence job (72h interval) that runs the TLS scanner with TLS_13_ENABLE_TLS_ADHERENCE=true and StrictAllComponents policy against a OCP 5.0 cluster.

Summary by CodeRabbit

• New Features
• Added new periodic TLS 1.3 adherence jobs for the OpenShift 5.0 release.
• These jobs run every 72 hours and use the existing TLS scanner workflow.
• Added status reporting so job results are posted to Slack with success, failure, and error updates.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[richardsonnick]

/rehearsals-ack

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[openshift-ci-robot]

@richardsonnick: This pull request references DPTP-5088 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.1.0" version, but no target version was set.

Details

In response to this:

The tls-scanner release-5.0 config had a tls13-adherence presubmit but no corresponding periodic. This adds a periodic-tls13-adherence job (72h interval) that runs the TLS scanner with TLS_13_ENABLE_TLS_ADHERENCE=true and StrictAllComponents policy against a OCP 5.0 cluster.

Summary by CodeRabbit

• New Features
• Added periodic TLS 1.3 adherence jobs for the OpenShift 5.0 TLS scanner on OpenShift and OpenShift Privileged clusters.
• Jobs run every 72 hours with TLS adherence enabled and the StrictAllComponents policy.
• Added generated Prow job configuration and Slack reporting for success, failure, and error states.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@richardsonnick: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
periodic-ci-openshift-tls-scanner-release-5.0-periodic-tls13-adherence	N/A	periodic	Periodic changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@richardsonnick: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[richardsonnick]

/pj-rehearse ack

[openshift-merge-bot]

@richardsonnick: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[smith-xyz]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: joelanford, richardsonnick, smith-xyz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/tls-scanner/OWNERS [richardsonnick,smith-xyz]
• ci-operator/jobs/openshift/tls-scanner/OWNERS [joelanford,richardsonnick,smith-xyz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment