STOR-3001: Add TLS scanner job to gcp-filestore-csi-driver-operator - #81917
Merged
openshift-merge-bot[bot] merged 1 commit intoJul 22, 2026
Merged
openshift-merge-bot[bot] merged 1 commit into
openshift-merge-bot[bot] merged 1 commit into
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
Contributor
|
Skipping CI for Draft Pull Request. |
Contributor
WalkthroughThe four GCP Filestore CSI driver operator CI configurations add equivalent optional ChangesTLS scanner CI coverage
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
approved
Contributor
|
@RomanBednar: |
Contributor
|
@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
RomanBednar
changed the title
openshift-ci-robot
added
the
jira/valid-reference
Contributor
|
@RomanBednar: This pull request references STOR-3001 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Contributor
Author
|
/pj-rehearse pull-ci-openshift-gcp-filestore-csi-driver-operator-main-tls-scanner |
Contributor
|
@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
RomanBednar
marked this pull request as ready for review
July 17, 2026 13:23
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
RomanBednar
force-pushed
the
feat/gcp-filestore-tls-scanner
branch
from
July 21, 2026 07:56
0b503ae to
f4c07f8
Compare
Contributor
Author
|
/pj-rehearse pull-ci-openshift-gcp-filestore-csi-driver-operator-main-tls-scanner |
Contributor
|
@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Contributor
Author
|
/pj-rehearse pull-ci-openshift-gcp-filestore-csi-driver-operator-main-tls-scanner |
Contributor
|
@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Contributor
|
@RomanBednar: job(s): pull-ci-openshift-gcp-filestore-csi-driver-operator-main-tls-scanner either don't exist or were not found to be affected, and cannot be rehearsed |
Contributor
Author
|
/pj-rehearse pull-ci-openshift-gcp-filestore-csi-driver-operator-main-tls-scanner-gcp-filestore |
Contributor
|
@RomanBednar: job(s): pull-ci-openshift-gcp-filestore-csi-driver-operator-main-tls-scanner either don't exist or were not found to be affected, and cannot be rehearsed |
Contributor
|
@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Contributor
Author
|
/pj-rehearse pull-ci-openshift-gcp-filestore-csi-driver-operator-release-4.23-tls-scanner-gcp-filestore |
Contributor
|
@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
RomanBednar
force-pushed
the
feat/gcp-filestore-tls-scanner
branch
from
July 21, 2026 12:08
f4c07f8 to
ce15eac
Compare
Contributor
Author
|
/pj-rehearse pull-ci-openshift-gcp-filestore-csi-driver-operator-main-tls-scanner-gcp-filestore pull-ci-openshift-gcp-filestore-csi-driver-operator-release-4.23-tls-scanner-gcp-filestore |
Contributor
|
@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Contributor
|
[REHEARSALNOTIFIER]
A total of 44 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
RomanBednar
added a commit
to RomanBednar/release
that referenced
this pull request
Jul 22, 2026
Add TLS_13_ENABLE_TLS_ADHERENCE, TLS_13_TLS_ADHERENCE_POLICY env vars and tls-13 step ref to tls-scanner-aws-ebs test in csi-operator configs for main, release-4.23, release-5.0, and release-5.1. This follows the pattern established in PR openshift#81917 for GCP Filestore and is a followup to PR openshift#82134 which added the base TLS scanner test.
Contributor
|
@RomanBednar: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Contributor
Author
|
/pj-rehearse ack |
Contributor
|
@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
Contributor
|
/lgtm |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dfajmon, RomanBednar The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
Bot
merged commit Jul 22, 2026
bc46f53
into
openshift:main
16 of 18 checks passed
fracappa
pushed a commit
to fracappa/release
that referenced
this pull request
Jul 22, 2026
jzding
added a commit
to jzding/release
that referenced
this pull request
Jul 27, 2026
Add TLS compliance scanning to PTP operator CI per OCPSTRAT-2611, following the patterns from OADP (PR openshift#79196) and gcp-filestore (PR openshift#81917). For each branch (release-4.22, release-4.23), add: Presubmit (on-demand, optional, non-blocking): - tls-pqc-readiness: deploys PTP operator via OLM (ci-index), runs tls-13 step then tls-scanner-run with PQC check enabled - tls13-adherence: same flow with TLS 1.3 StrictAllComponents adherence policy Periodic (weekly Monday 6am UTC): - tls-pqc-readiness-periodic: same as presubmit PQC test - tls13-adherence-periodic: same as presubmit adherence test All tests: - Use optional-operators-ci-aws workflow (deploys PTP from ci-index) - Scoped to openshift-ptp namespace via SCAN_NAMESPACE - Use tls-scanner-tool from the tls-scanner namespace (official image) Branches 5.0/5.1/main are skipped because the PTP operator CSV is not yet available in the standard catalog for those versions. linuxptp-daemon is skipped because it has no operator bundle config. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Jack Ding <jackding@gmail.com>
3 tasks
jzding
added a commit
to jzding/release
that referenced
this pull request
Jul 27, 2026
Add TLS compliance scanning to PTP operator CI per OCPSTRAT-2611, following the patterns from OADP (PR openshift#79196) and gcp-filestore (PR openshift#81917). For each branch (4.22, 4.23, 5.0, 5.1, main), add a combined tls-scan test that covers both TLS 1.3 adherence (StrictAllComponents) and PQC readiness in a single cluster deploy: Presubmit (on-demand): - tls-scan: always_run false, optional true. Deploys PTP operator via ci-index, runs tls-13 then tls-scanner-run with PQC check and TLS 1.3 StrictAllComponents adherence enabled. Periodic (weekly, staggered): - tls-scan-periodic: 4.22 Saturday, 4.23 Monday, 5.0 Tuesday, 5.1 Wednesday, main Thursday (all 6am UTC). All tests use optional-operators-ci-aws workflow, scoped to openshift-ptp namespace, SCANNER_CPU=2, tls-scanner-tool from the official tls-scanner namespace. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Jack Ding <jackding@gmail.com>
jzding
added a commit
to jzding/release
that referenced
this pull request
Jul 27, 2026
Add TLS compliance scanning to PTP operator CI per OCPSTRAT-2611, following the patterns from OADP (PR openshift#79196) and gcp-filestore (PR openshift#81917). For each branch (4.22, 4.23, 5.0, 5.1, main), add a combined tls-scan test that covers both TLS 1.3 adherence (StrictAllComponents) and PQC readiness in a single cluster deploy: Presubmit (on-demand): - tls-scan: always_run false, optional true. Deploys PTP operator via ci-index, runs tls-13 then tls-scanner-run with PQC check and TLS 1.3 StrictAllComponents adherence enabled. Periodic (weekly Saturday, staggered 3 hours): - 4.22 at 00:00 UTC, 4.23 at 03:00, 5.0 at 06:00, 5.1 at 09:00, main at 12:00. All tests use optional-operators-ci-aws workflow, scoped to openshift-ptp namespace, SCANNER_CPU=2, tls-scanner-tool from the official tls-scanner namespace. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Jack Ding <jackding@gmail.com>
jzding
added a commit
to jzding/release
that referenced
this pull request
Jul 27, 2026
Add TLS compliance scanning to PTP operator CI per OCPSTRAT-2611, following the patterns from OADP (PR openshift#79196) and gcp-filestore (PR openshift#81917). For each branch (4.22, 4.23, 5.0, 5.1, main), add a combined tls-scan test that covers both TLS 1.3 adherence (StrictAllComponents) and PQC readiness in a single cluster deploy: Presubmit (on-demand): - tls-scan: always_run false, optional true. Deploys PTP operator via ci-index, runs tls-13 then tls-scanner-run with PQC check and TLS 1.3 StrictAllComponents adherence enabled. Periodic (weekly Saturday, staggered 3 hours): - 4.22 at 00:00 UTC, 4.23 at 03:00, 5.0 at 06:00, 5.1 at 09:00, main at 12:00. All tests use optional-operators-ci-aws workflow, scoped to openshift-ptp namespace, SCANNER_CPU=2, tls-scanner-tool from the official tls-scanner namespace. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Jack Ding <jackding@gmail.com>
jzding
added a commit
to jzding/release
that referenced
this pull request
Jul 28, 2026
Add TLS compliance scanning to PTP operator CI per OCPSTRAT-2611, following the patterns from OADP (PR openshift#79196) and gcp-filestore (PR openshift#81917). For each branch (4.22, 4.23, 5.0, 5.1, main), add a combined tls-scan test that covers both TLS 1.3 adherence (StrictAllComponents) and PQC readiness in a single cluster deploy: Presubmit (on-demand): - tls-scan: always_run false, optional true. Deploys PTP operator via ci-index, runs tls-13, waits for PTP operator to restart with the new TLS profile, then runs tls-scanner-run. The wait-ptp-tls-restart step is needed because the PTP operator's SecurityProfileWatcher detects the TLS profile change from the tls-13 step and self-terminates for OLM to restart it. The reconciler then re-renders the kube-rbac-proxy daemonset template with the new TLS min version and cipher suites. Without the wait, the scanner would scan endpoints still running with the old TLS configuration. Periodic (weekly Saturday, staggered 3 hours): - 4.22 at 00:00 UTC, 4.23 at 03:00, 5.0 at 06:00, 5.1 at 09:00, main at 12:00. All tests use optional-operators-ci-aws workflow, scoped to openshift-ptp namespace, SCANNER_CPU=2, tls-scanner-tool from the official tls-scanner namespace. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Jack Ding <jackding@gmail.com>
jzding
added a commit
to jzding/release
that referenced
this pull request
Jul 28, 2026
Add TLS compliance scanning to PTP operator CI per OCPSTRAT-2611, following the patterns from OADP (PR openshift#79196) and gcp-filestore (PR openshift#81917). For each branch (4.22, 4.23, 5.0, 5.1, main), add a combined tls-scan test that covers both TLS 1.3 adherence (StrictAllComponents) and PQC readiness in a single cluster deploy: Presubmit (on-demand): - tls-scan: always_run false, optional true. Deploys PTP operator via ci-index, runs tls-13, waits for PTP operator to restart with the new TLS profile, then runs tls-scanner-run. The wait-ptp-tls-restart step is needed because the PTP operator's SecurityProfileWatcher detects the TLS profile change from the tls-13 step and self-terminates for OLM to restart it. The reconciler then re-renders the kube-rbac-proxy daemonset template with the new TLS min version and cipher suites. Without the wait, the scanner would scan endpoints still running with the old TLS configuration. Periodic (weekly Saturday, staggered 3 hours): - 4.22 at 00:00 UTC, 4.23 at 03:00, 5.0 at 06:00, 5.1 at 09:00, main at 12:00. All tests use optional-operators-ci-aws workflow, scoped to openshift-ptp namespace, SCANNER_CPU=2, tls-scanner-tool from the official tls-scanner namespace. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Jack Ding <jackding@gmail.com>
jzding
added a commit
to jzding/release
that referenced
this pull request
Jul 28, 2026
Add TLS compliance scanning to PTP operator CI per OCPSTRAT-2611, following the patterns from OADP (PR openshift#79196) and gcp-filestore (PR openshift#81917). For each branch (4.22, 4.23, 5.0, 5.1, main), add a combined tls-scan test that covers both TLS 1.3 adherence (StrictAllComponents) and PQC readiness in a single cluster deploy: Presubmit (on-demand): - tls-scan: always_run false, optional true. Deploys PTP operator via ci-index, runs tls-13, waits for PTP operator to restart with the new TLS profile, then runs tls-scanner-run. The wait-ptp-tls-restart step is needed because the PTP operator's SecurityProfileWatcher detects the TLS profile change from the tls-13 step and self-terminates for OLM to restart it. The reconciler then re-renders the kube-rbac-proxy daemonset template with the new TLS min version and cipher suites. Without the wait, the scanner would scan endpoints still running with the old TLS configuration. Periodic (weekly Saturday, staggered 3 hours): - 4.22 at 00:00 UTC, 4.23 at 03:00, 5.0 at 06:00, 5.1 at 09:00, main at 12:00. All tests use optional-operators-ci-aws workflow, scoped to openshift-ptp namespace, SCANNER_CPU=2, tls-scanner-tool from the official tls-scanner namespace. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Jack Ding <jackding@gmail.com>
jzding
added a commit
to jzding/release
that referenced
this pull request
Jul 28, 2026
Add TLS compliance scanning to PTP operator CI per OCPSTRAT-2611, following the patterns from OADP (PR openshift#79196) and gcp-filestore (PR openshift#81917). For each branch (4.22, 4.23, 5.0, 5.1, main), add a combined tls-scan test that covers both TLS 1.3 adherence (StrictAllComponents) and PQC readiness in a single cluster deploy: Presubmit (on-demand): - tls-scan: always_run false, optional true. Deploys PTP operator via ci-index, runs tls-13, waits for PTP operator to restart with the new TLS profile, then runs tls-scanner-run. The wait-ptp-tls-restart step is needed because the PTP operator's SecurityProfileWatcher detects the TLS profile change from the tls-13 step and self-terminates for OLM to restart it. The reconciler then re-renders the kube-rbac-proxy daemonset template with the new TLS min version and cipher suites. Without the wait, the scanner would scan endpoints still running with the old TLS configuration. Periodic (weekly Saturday, staggered 3 hours): - 4.22 at 00:00 UTC, 4.23 at 03:00, 5.0 at 06:00, 5.1 at 09:00, main at 12:00. All tests use optional-operators-ci-aws workflow, scoped to openshift-ptp namespace, SCANNER_CPU=2, tls-scanner-tool from the official tls-scanner namespace. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Jack Ding <jackding@gmail.com>
RomanBednar
added a commit
to RomanBednar/release
that referenced
this pull request
Jul 29, 2026
Add TLS_13_ENABLE_TLS_ADHERENCE, TLS_13_TLS_ADHERENCE_POLICY env vars and tls-13 step ref to tls-scanner-aws-ebs test in csi-operator configs for main, release-4.23, release-5.0, and release-5.1. This follows the pattern established in PR openshift#81917 for GCP Filestore and is a followup to PR openshift#82134 which added the base TLS scanner test.
RomanBednar
added a commit
to RomanBednar/release
that referenced
this pull request
Jul 30, 2026
Align with the GCP Filestore TLS scanner pattern from PR openshift#81917: - Add tls-13 ref step before tls-scanner-run - Add CLUSTERCSIDRIVER, OO_INSTALL_NAMESPACE, OO_PACKAGE, OO_TARGET_NAMESPACES, TLS_13_ENABLE_TLS_ADHERENCE, TLS_13_TLS_ADHERENCE_POLICY, and TRUECONDITIONS env vars
openshift-merge-bot Bot
pushed a commit
that referenced
this pull request
Jul 30, 2026
) Add TLS_13_ENABLE_TLS_ADHERENCE, TLS_13_TLS_ADHERENCE_POLICY env vars and tls-13 step ref to tls-scanner-aws-ebs test in csi-operator configs for main, release-4.23, release-5.0, and release-5.1. This follows the pattern established in PR #81917 for GCP Filestore and is a followup to PR #82134 which added the base TLS scanner test.
amogh-redhat
pushed a commit
to amogh-redhat/release
that referenced
this pull request
Aug 5, 2026
![openshift-prow[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
amogh-redhat
pushed a commit
to amogh-redhat/release
that referenced
this pull request
Aug 5, 2026
…nshift#82133) Add TLS_13_ENABLE_TLS_ADHERENCE, TLS_13_TLS_ADHERENCE_POLICY env vars and tls-13 step ref to tls-scanner-aws-ebs test in csi-operator configs for main, release-4.23, release-5.0, and release-5.1. This follows the pattern established in PR openshift#81917 for GCP Filestore and is a followup to PR openshift#82134 which added the base TLS scanner test.
TimurMP
pushed a commit
to TimurMP/release
that referenced
this pull request
Aug 9, 2026
…nshift#82133) Add TLS_13_ENABLE_TLS_ADHERENCE, TLS_13_TLS_ADHERENCE_POLICY env vars and tls-13 step ref to tls-scanner-aws-ebs test in csi-operator configs for main, release-4.23, release-5.0, and release-5.1. This follows the pattern established in PR openshift#81917 for GCP Filestore and is a followup to PR openshift#82134 which added the base TLS scanner test.
TimurMP
pushed a commit
to TimurMP/release
that referenced
this pull request
Sep 5, 2026
TimurMP
pushed a commit
to TimurMP/release
that referenced
this pull request
Sep 5, 2026
…nshift#82133) Add TLS_13_ENABLE_TLS_ADHERENCE, TLS_13_TLS_ADHERENCE_POLICY env vars and tls-13 step ref to tls-scanner-aws-ebs test in csi-operator configs for main, release-4.23, release-5.0, and release-5.1. This follows the pattern established in PR openshift#81917 for GCP Filestore and is a followup to PR openshift#82134 which added the base TLS scanner test.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/test tls-scanner-gcp-filestore) to gcp-filestore-csi-driver-operatormain,release-4.23,release-5.0, andrelease-5.1branchesopenshift-e2e-gcp-csi-filestoreworkflow (GCP cluster + OLM operator install) with the test phase overridden to runtls-scanner-runagainstopenshift-cluster-csi-driversnamespaceSummary by CodeRabbit
Adds an optional, manually triggered
tls-scannerpresubmit job for the GCP Filestore CSI driver operator across themain,release-4.23,release-5.0, andrelease-5.1CI configurations. The job provisions a GCP cluster using the existing workflow, installs the operator through OLM, and scans theopenshift-cluster-csi-driversnamespace.