diff --git a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml index 62a74abd2e869..8d0b154eec46c 100644 --- a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml +++ b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml @@ -7,6 +7,10 @@ base_images: name: "4.19" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build --warn-undefined-variables build_root: from_repository: true @@ -102,6 +106,67 @@ tests: requests: cpu: 100m workflow: optional-operators-ci-operator-sdk-aws +- always_run: false + as: tls-scanner + optional: true + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: zero-trust-workload-identity-manager-bundle + env: + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: zero-trust-workload-identity-manager + OO_SECURITY_CONTEXT: restricted + SCAN_NAMESPACE: zero-trust-workload-identity-manager + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - ref: ztwim-deploy-spire-operands + - ref: tls-scanner-run + workflow: optional-operators-ci-operator-sdk-aws +- as: tls-scanner-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: zero-trust-workload-identity-manager-bundle + env: + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: zero-trust-workload-identity-manager + OO_SECURITY_CONTEXT: restricted + SCAN_NAMESPACE: zero-trust-workload-identity-manager + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - ref: ztwim-deploy-spire-operands + - ref: tls-scanner-run + workflow: optional-operators-ci-operator-sdk-aws +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: zero-trust-workload-identity-manager-bundle + env: + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: zero-trust-workload-identity-manager + OO_SECURITY_CONTEXT: restricted + PQC_CHECK: "true" + SCAN_NAMESPACE: zero-trust-workload-identity-manager + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + test: + - ref: tls-13 + - ref: ztwim-deploy-spire-operands + - ref: tls-scanner-run + workflow: optional-operators-ci-operator-sdk-aws - always_run: false as: e2e-operator-rhcos10-fips optional: true diff --git a/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml new file mode 100644 index 0000000000000..ef8f215321a48 --- /dev/null +++ b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml @@ -0,0 +1,88 @@ +periodics: +- agent: kubernetes + cluster: build05 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.coverage + extra_refs: + - base_ref: main + org: openshift + repo: zero-trust-workload-identity-manager + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.coverage + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-zero-trust-workload-identity-manager-main-tls-scanner-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-periodic + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-presubmits.yaml b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-presubmits.yaml index 594e903419544..69e6957f6a531 100644 --- a/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-presubmits.yaml @@ -555,6 +555,178 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )(operator-e2e-coverage|remaining-required),?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build06 + context: ci/prow/tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.coverage + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-zero-trust-workload-identity-manager-main-tls-pqc-readiness + optional: true + rerun_command: /test tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build06 + context: ci/prow/tls-scanner + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.coverage + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-zero-trust-workload-identity-manager-main-tls-scanner + optional: true + rerun_command: /test tls-scanner + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/step-registry/ztwim/OWNERS b/ci-operator/step-registry/ztwim/OWNERS new file mode 100644 index 0000000000000..b789b83f4e879 --- /dev/null +++ b/ci-operator/step-registry/ztwim/OWNERS @@ -0,0 +1,13 @@ +approvers: +- bharath-b-rh +- nhegde07 +- rausingh-rh +- swghosh +- trilokgeer +options: {} +reviewers: +- bharath-b-rh +- nhegde07 +- rausingh-rh +- swghosh +- trilokgeer diff --git a/ci-operator/step-registry/ztwim/deploy-spire-operands/OWNERS b/ci-operator/step-registry/ztwim/deploy-spire-operands/OWNERS new file mode 100644 index 0000000000000..b789b83f4e879 --- /dev/null +++ b/ci-operator/step-registry/ztwim/deploy-spire-operands/OWNERS @@ -0,0 +1,13 @@ +approvers: +- bharath-b-rh +- nhegde07 +- rausingh-rh +- swghosh +- trilokgeer +options: {} +reviewers: +- bharath-b-rh +- nhegde07 +- rausingh-rh +- swghosh +- trilokgeer diff --git a/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-commands.sh b/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-commands.sh new file mode 100755 index 0000000000000..942c6b128c04a --- /dev/null +++ b/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-commands.sh @@ -0,0 +1,130 @@ +#!/bin/bash +set -o errexit +set -o nounset +set -o pipefail + +export KUBECONFIG="${SHARED_DIR}/kubeconfig" + +# For disconnected or otherwise unreachable environments, use the shared proxy config. +if test -f "${SHARED_DIR}/proxy-conf.sh"; then + # shellcheck disable=SC1090 + source "${SHARED_DIR}/proxy-conf.sh" +fi + +NS=zero-trust-workload-identity-manager + +echo "Waiting for operator Deployment..." +oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m + +echo "Waiting for managed CRDs..." +for crd in \ + zerotrustworkloadidentitymanagers.operator.openshift.io \ + spireservers.operator.openshift.io \ + spireagents.operator.openshift.io \ + spiffecsidrivers.operator.openshift.io \ + spireoidcdiscoveryproviders.operator.openshift.io; do + oc wait --for=condition=Established "crd/${crd}" --timeout=5m +done + +# Mirror the manual install flow: derive cluster-specific values, then apply +# ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers +# operator and operand communication endpoints in ${NS}. +# Disable tracing while handling cluster-derived hostnames/issuer URLs. +[[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false +set +x +APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')" +JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}" +CLUSTER_NAME="cluster1" +BUNDLE_CONFIGMAP="spire-bundle" + +echo "Applying ZTWIM and SPIRE operand CRs..." +cat </dev/null +apiVersion: operator.openshift.io/v1alpha1 +kind: ZeroTrustWorkloadIdentityManager +metadata: + name: cluster +spec: + trustDomain: ${APP_DOMAIN} + clusterName: ${CLUSTER_NAME} + bundleConfigMap: ${BUNDLE_CONFIGMAP} +--- +apiVersion: operator.openshift.io/v1alpha1 +kind: SpireServer +metadata: + name: cluster +spec: + jwtIssuer: ${JWT_ISSUER} + caValidity: 24h + defaultX509Validity: 1h + defaultJWTValidity: 5m + caSubject: + commonName: ${APP_DOMAIN} + country: "US" + organization: "RH" + persistence: + size: "1Gi" + accessMode: ReadWriteOncePod + datastore: + databaseType: sqlite3 + connectionString: "/run/spire/data/datastore.sqlite3" + maxOpenConns: 100 + maxIdleConns: 2 + connMaxLifetime: 3600 + disableMigration: "false" +--- +apiVersion: operator.openshift.io/v1alpha1 +kind: SpireAgent +metadata: + name: cluster +spec: + nodeAttestor: + k8sPSATEnabled: "true" + workloadAttestors: + k8sEnabled: "true" + workloadAttestorsVerification: + type: "auto" +--- +apiVersion: operator.openshift.io/v1alpha1 +kind: SpiffeCSIDriver +metadata: + name: cluster +spec: {} +--- +apiVersion: operator.openshift.io/v1alpha1 +kind: SpireOIDCDiscoveryProvider +metadata: + name: cluster +spec: + jwtIssuer: ${JWT_ISSUER} + managedRoute: "true" +EOF +$WAS_TRACING && set -x + +echo "Waiting for SPIRE Server StatefulSet..." +oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m +oc rollout status statefulset/spire-server -n "${NS}" --timeout=10m + +echo "Waiting for SPIRE Agent DaemonSet..." +oc wait --for=create -n "${NS}" daemonset/spire-agent --timeout=10m +oc rollout status daemonset/spire-agent -n "${NS}" --timeout=10m + +echo "Waiting for SPIFFE CSI Driver DaemonSet..." +oc wait --for=create -n "${NS}" daemonset/spire-spiffe-csi-driver --timeout=10m +oc rollout status daemonset/spire-spiffe-csi-driver -n "${NS}" --timeout=10m + +echo "Waiting for OIDC Discovery Provider Deployment..." +oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m +oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m + +echo "Waiting for operand CRs to become Ready..." +for cr in \ + spireservers.operator.openshift.io/cluster \ + spireagents.operator.openshift.io/cluster \ + spiffecsidrivers.operator.openshift.io/cluster \ + spireoidcdiscoveryproviders.operator.openshift.io/cluster \ + zerotrustworkloadidentitymanagers.operator.openshift.io/cluster; do + oc wait --for=condition=Ready "${cr}" --timeout=10m +done + +echo "Operand pod status in ${NS} before TLS scan:" +oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true diff --git a/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-ref.metadata.json b/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-ref.metadata.json new file mode 100644 index 0000000000000..43f2fe5cb89d3 --- /dev/null +++ b/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-ref.metadata.json @@ -0,0 +1,19 @@ +{ + "path": "ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-ref.yaml", + "owners": { + "approvers": [ + "bharath-b-rh", + "nhegde07", + "rausingh-rh", + "swghosh", + "trilokgeer" + ], + "reviewers": [ + "bharath-b-rh", + "nhegde07", + "rausingh-rh", + "swghosh", + "trilokgeer" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-ref.yaml b/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-ref.yaml new file mode 100644 index 0000000000000..48829675c18db --- /dev/null +++ b/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-ref.yaml @@ -0,0 +1,16 @@ +ref: + as: ztwim-deploy-spire-operands + from: src + cli: latest + commands: ztwim-deploy-spire-operands-commands.sh + resources: + requests: + cpu: 100m + memory: 200Mi + timeout: 45m0s + documentation: |- + Deploys ZeroTrustWorkloadIdentityManager and SPIRE operand CRs + (SpireServer, SpireAgent, SpiffeCSIDriver, SpireOIDCDiscoveryProvider), + then waits until the operator Deployment, managed workloads, and CR Ready + conditions are satisfied. Intended for TLS/PQC scanner jobs after operator + install.