From fdc275739a4a15c29be76f09a15f0ab1f9d6a095 Mon Sep 17 00:00:00 2001 From: Sayak Das Date: Tue, 11 Aug 2026 12:43:00 +0530 Subject: [PATCH 1/4] SPIRE-632: Add optional TLS scanner CI job for zero-trust-workload-identity-manager Install the PR operator on AWS, deploy SPIRE operand CRs, enable Modern TLS adherence, and scan operator/operand endpoints in the install namespace. --- ...-trust-workload-identity-manager-main.yaml | 143 ++++++++++++++++++ ...load-identity-manager-main-presubmits.yaml | 86 +++++++++++ 2 files changed, 229 insertions(+) diff --git a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml index 62a74abd2e869..8533d58454d13 100644 --- a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml +++ b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml @@ -7,6 +7,10 @@ base_images: name: "4.19" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build --warn-undefined-variables build_root: from_repository: true @@ -102,6 +106,145 @@ tests: requests: cpu: 100m workflow: optional-operators-ci-operator-sdk-aws +- always_run: false + as: tls-scanner + optional: true + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: zero-trust-workload-identity-manager-bundle + env: + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: zero-trust-workload-identity-manager + OO_SECURITY_CONTEXT: restricted + SCAN_NAMESPACE: zero-trust-workload-identity-manager + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: deploy-operand + cli: latest + commands: |- + set -o errexit + set -o nounset + set -o pipefail + + NS=zero-trust-workload-identity-manager + + echo "Waiting for operator Deployment..." + oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m + + echo "Waiting for managed CRDs..." + for crd in \ + zerotrustworkloadidentitymanagers.operator.openshift.io \ + spireservers.operator.openshift.io \ + spireagents.operator.openshift.io \ + spiffecsidrivers.operator.openshift.io \ + spireoidcdiscoveryproviders.operator.openshift.io; do + oc wait --for=condition=Established "crd/${crd}" --timeout=5m + done + + # Mirror the manual install flow: derive cluster-specific values, then apply + # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers + # operator and operand communication endpoints in ${NS}. + APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')" + JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}" + CLUSTER_NAME="cluster1" + BUNDLE_CONFIGMAP="spire-bundle" + + echo "APP_DOMAIN=${APP_DOMAIN}" + echo "JWT_ISSUER=${JWT_ISSUER}" + echo "CLUSTER_NAME=${CLUSTER_NAME}" + + echo "Applying ZTWIM and SPIRE operand CRs..." + cat < Date: Tue, 11 Aug 2026 13:02:11 +0530 Subject: [PATCH 2/4] SPIRE-632: Avoid logging cluster hostnames in tls-scanner deploy step Remove APP_DOMAIN/JWT_ISSUER echoes and wide pod listings so CI logs do not expose internal DNS or pod/node network details. Co-authored-by: Cursor --- ...-zero-trust-workload-identity-manager-main.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml index 8533d58454d13..237126eee2c93 100644 --- a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml +++ b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml @@ -148,17 +148,16 @@ tests: # Mirror the manual install flow: derive cluster-specific values, then apply # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers # operator and operand communication endpoints in ${NS}. + # Disable tracing while handling cluster-derived hostnames/issuer URLs. + [[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false + set +x APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')" JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}" CLUSTER_NAME="cluster1" BUNDLE_CONFIGMAP="spire-bundle" - echo "APP_DOMAIN=${APP_DOMAIN}" - echo "JWT_ISSUER=${JWT_ISSUER}" - echo "CLUSTER_NAME=${CLUSTER_NAME}" - echo "Applying ZTWIM and SPIRE operand CRs..." - cat </dev/null apiVersion: operator.openshift.io/v1alpha1 kind: ZeroTrustWorkloadIdentityManager metadata: @@ -218,6 +217,7 @@ tests: jwtIssuer: ${JWT_ISSUER} managedRoute: "true" EOF + $WAS_TRACING && set -x echo "Waiting for SPIRE Server StatefulSet..." oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m @@ -235,8 +235,8 @@ tests: oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m - echo "Listing pods in ${NS} before TLS scan:" - oc get pods -n "${NS}" -o wide || true + echo "Operand pod status in ${NS} before TLS scan:" + oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true from: src resources: requests: From 1cce697e0cf877dcafd681945069258789985571 Mon Sep 17 00:00:00 2001 From: Sayak Das Date: Mon, 17 Aug 2026 16:38:39 +0530 Subject: [PATCH 3/4] SPIRE-632: Add PQC readiness and weekly TLS scanner periodics for ZTWIM Extend the optional TLS scanner coverage with tls-pqc-readiness and weekly cron jobs so CI can validate TLS 1.3 adherence and ML-KEM/PQC readiness. Co-authored-by: Cursor --- ...-trust-workload-identity-manager-main.yaml | 413 ++++++++++++++++++ ...kload-identity-manager-main-periodics.yaml | 175 ++++++++ ...load-identity-manager-main-presubmits.yaml | 86 ++++ 3 files changed, 674 insertions(+) create mode 100644 ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml diff --git a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml index 237126eee2c93..f17d802a3ad1b 100644 --- a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml +++ b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml @@ -245,6 +245,419 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: optional-operators-ci-operator-sdk-aws +- as: tls-scanner-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: zero-trust-workload-identity-manager-bundle + env: + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: zero-trust-workload-identity-manager + OO_SECURITY_CONTEXT: restricted + SCAN_NAMESPACE: zero-trust-workload-identity-manager + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: deploy-operand + cli: latest + commands: |- + set -o errexit + set -o nounset + set -o pipefail + + NS=zero-trust-workload-identity-manager + + echo "Waiting for operator Deployment..." + oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m + + echo "Waiting for managed CRDs..." + for crd in \ + zerotrustworkloadidentitymanagers.operator.openshift.io \ + spireservers.operator.openshift.io \ + spireagents.operator.openshift.io \ + spiffecsidrivers.operator.openshift.io \ + spireoidcdiscoveryproviders.operator.openshift.io; do + oc wait --for=condition=Established "crd/${crd}" --timeout=5m + done + + # Mirror the manual install flow: derive cluster-specific values, then apply + # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers + # operator and operand communication endpoints in ${NS}. + # Disable tracing while handling cluster-derived hostnames/issuer URLs. + [[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false + set +x + APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')" + JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}" + CLUSTER_NAME="cluster1" + BUNDLE_CONFIGMAP="spire-bundle" + + echo "Applying ZTWIM and SPIRE operand CRs..." + cat </dev/null + apiVersion: operator.openshift.io/v1alpha1 + kind: ZeroTrustWorkloadIdentityManager + metadata: + name: cluster + spec: + trustDomain: ${APP_DOMAIN} + clusterName: ${CLUSTER_NAME} + bundleConfigMap: ${BUNDLE_CONFIGMAP} + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireServer + metadata: + name: cluster + spec: + jwtIssuer: ${JWT_ISSUER} + caValidity: 24h + defaultX509Validity: 1h + defaultJWTValidity: 5m + caSubject: + commonName: ${APP_DOMAIN} + country: "US" + organization: "RH" + persistence: + size: "1Gi" + accessMode: ReadWriteOncePod + datastore: + databaseType: sqlite3 + connectionString: "/run/spire/data/datastore.sqlite3" + maxOpenConns: 100 + maxIdleConns: 2 + connMaxLifetime: 3600 + disableMigration: "false" + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireAgent + metadata: + name: cluster + spec: + nodeAttestor: + k8sPSATEnabled: "true" + workloadAttestors: + k8sEnabled: "true" + workloadAttestorsVerification: + type: "auto" + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpiffeCSIDriver + metadata: + name: cluster + spec: {} + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireOIDCDiscoveryProvider + metadata: + name: cluster + spec: + jwtIssuer: ${JWT_ISSUER} + managedRoute: "true" + EOF + $WAS_TRACING && set -x + + echo "Waiting for SPIRE Server StatefulSet..." + oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m + oc rollout status statefulset/spire-server -n "${NS}" --timeout=10m + + echo "Waiting for SPIRE Agent DaemonSet..." + oc wait --for=create -n "${NS}" daemonset/spire-agent --timeout=10m + oc rollout status daemonset/spire-agent -n "${NS}" --timeout=10m + + echo "Waiting for SPIFFE CSI Driver DaemonSet..." + oc wait --for=create -n "${NS}" daemonset/spire-spiffe-csi-driver --timeout=10m + oc rollout status daemonset/spire-spiffe-csi-driver -n "${NS}" --timeout=10m + + echo "Waiting for OIDC Discovery Provider Deployment..." + oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m + oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m + + echo "Operand pod status in ${NS} before TLS scan:" + oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true + from: src + resources: + requests: + cpu: 100m + timeout: 45m0s + - ref: tls-13 + - ref: tls-scanner-run + workflow: optional-operators-ci-operator-sdk-aws +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: zero-trust-workload-identity-manager-bundle + env: + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: zero-trust-workload-identity-manager + OO_SECURITY_CONTEXT: restricted + PQC_CHECK: "true" + SCAN_NAMESPACE: zero-trust-workload-identity-manager + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + test: + - as: deploy-operand + cli: latest + commands: |- + set -o errexit + set -o nounset + set -o pipefail + + NS=zero-trust-workload-identity-manager + + echo "Waiting for operator Deployment..." + oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m + + echo "Waiting for managed CRDs..." + for crd in \ + zerotrustworkloadidentitymanagers.operator.openshift.io \ + spireservers.operator.openshift.io \ + spireagents.operator.openshift.io \ + spiffecsidrivers.operator.openshift.io \ + spireoidcdiscoveryproviders.operator.openshift.io; do + oc wait --for=condition=Established "crd/${crd}" --timeout=5m + done + + # Mirror the manual install flow: derive cluster-specific values, then apply + # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers + # operator and operand communication endpoints in ${NS}. + # Disable tracing while handling cluster-derived hostnames/issuer URLs. + [[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false + set +x + APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')" + JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}" + CLUSTER_NAME="cluster1" + BUNDLE_CONFIGMAP="spire-bundle" + + echo "Applying ZTWIM and SPIRE operand CRs..." + cat </dev/null + apiVersion: operator.openshift.io/v1alpha1 + kind: ZeroTrustWorkloadIdentityManager + metadata: + name: cluster + spec: + trustDomain: ${APP_DOMAIN} + clusterName: ${CLUSTER_NAME} + bundleConfigMap: ${BUNDLE_CONFIGMAP} + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireServer + metadata: + name: cluster + spec: + jwtIssuer: ${JWT_ISSUER} + caValidity: 24h + defaultX509Validity: 1h + defaultJWTValidity: 5m + caSubject: + commonName: ${APP_DOMAIN} + country: "US" + organization: "RH" + persistence: + size: "1Gi" + accessMode: ReadWriteOncePod + datastore: + databaseType: sqlite3 + connectionString: "/run/spire/data/datastore.sqlite3" + maxOpenConns: 100 + maxIdleConns: 2 + connMaxLifetime: 3600 + disableMigration: "false" + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireAgent + metadata: + name: cluster + spec: + nodeAttestor: + k8sPSATEnabled: "true" + workloadAttestors: + k8sEnabled: "true" + workloadAttestorsVerification: + type: "auto" + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpiffeCSIDriver + metadata: + name: cluster + spec: {} + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireOIDCDiscoveryProvider + metadata: + name: cluster + spec: + jwtIssuer: ${JWT_ISSUER} + managedRoute: "true" + EOF + $WAS_TRACING && set -x + + echo "Waiting for SPIRE Server StatefulSet..." + oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m + oc rollout status statefulset/spire-server -n "${NS}" --timeout=10m + + echo "Waiting for SPIRE Agent DaemonSet..." + oc wait --for=create -n "${NS}" daemonset/spire-agent --timeout=10m + oc rollout status daemonset/spire-agent -n "${NS}" --timeout=10m + + echo "Waiting for SPIFFE CSI Driver DaemonSet..." + oc wait --for=create -n "${NS}" daemonset/spire-spiffe-csi-driver --timeout=10m + oc rollout status daemonset/spire-spiffe-csi-driver -n "${NS}" --timeout=10m + + echo "Waiting for OIDC Discovery Provider Deployment..." + oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m + oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m + + echo "Operand pod status in ${NS} before TLS scan:" + oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true + from: src + resources: + requests: + cpu: 100m + timeout: 45m0s + - ref: tls-13 + - ref: tls-scanner-run + workflow: optional-operators-ci-operator-sdk-aws +- as: tls-pqc-readiness-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: zero-trust-workload-identity-manager-bundle + env: + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: zero-trust-workload-identity-manager + OO_SECURITY_CONTEXT: restricted + PQC_CHECK: "true" + SCAN_NAMESPACE: zero-trust-workload-identity-manager + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + test: + - as: deploy-operand + cli: latest + commands: |- + set -o errexit + set -o nounset + set -o pipefail + + NS=zero-trust-workload-identity-manager + + echo "Waiting for operator Deployment..." + oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m + + echo "Waiting for managed CRDs..." + for crd in \ + zerotrustworkloadidentitymanagers.operator.openshift.io \ + spireservers.operator.openshift.io \ + spireagents.operator.openshift.io \ + spiffecsidrivers.operator.openshift.io \ + spireoidcdiscoveryproviders.operator.openshift.io; do + oc wait --for=condition=Established "crd/${crd}" --timeout=5m + done + + # Mirror the manual install flow: derive cluster-specific values, then apply + # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers + # operator and operand communication endpoints in ${NS}. + # Disable tracing while handling cluster-derived hostnames/issuer URLs. + [[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false + set +x + APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')" + JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}" + CLUSTER_NAME="cluster1" + BUNDLE_CONFIGMAP="spire-bundle" + + echo "Applying ZTWIM and SPIRE operand CRs..." + cat </dev/null + apiVersion: operator.openshift.io/v1alpha1 + kind: ZeroTrustWorkloadIdentityManager + metadata: + name: cluster + spec: + trustDomain: ${APP_DOMAIN} + clusterName: ${CLUSTER_NAME} + bundleConfigMap: ${BUNDLE_CONFIGMAP} + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireServer + metadata: + name: cluster + spec: + jwtIssuer: ${JWT_ISSUER} + caValidity: 24h + defaultX509Validity: 1h + defaultJWTValidity: 5m + caSubject: + commonName: ${APP_DOMAIN} + country: "US" + organization: "RH" + persistence: + size: "1Gi" + accessMode: ReadWriteOncePod + datastore: + databaseType: sqlite3 + connectionString: "/run/spire/data/datastore.sqlite3" + maxOpenConns: 100 + maxIdleConns: 2 + connMaxLifetime: 3600 + disableMigration: "false" + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireAgent + metadata: + name: cluster + spec: + nodeAttestor: + k8sPSATEnabled: "true" + workloadAttestors: + k8sEnabled: "true" + workloadAttestorsVerification: + type: "auto" + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpiffeCSIDriver + metadata: + name: cluster + spec: {} + --- + apiVersion: operator.openshift.io/v1alpha1 + kind: SpireOIDCDiscoveryProvider + metadata: + name: cluster + spec: + jwtIssuer: ${JWT_ISSUER} + managedRoute: "true" + EOF + $WAS_TRACING && set -x + + echo "Waiting for SPIRE Server StatefulSet..." + oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m + oc rollout status statefulset/spire-server -n "${NS}" --timeout=10m + + echo "Waiting for SPIRE Agent DaemonSet..." + oc wait --for=create -n "${NS}" daemonset/spire-agent --timeout=10m + oc rollout status daemonset/spire-agent -n "${NS}" --timeout=10m + + echo "Waiting for SPIFFE CSI Driver DaemonSet..." + oc wait --for=create -n "${NS}" daemonset/spire-spiffe-csi-driver --timeout=10m + oc rollout status daemonset/spire-spiffe-csi-driver -n "${NS}" --timeout=10m + + echo "Waiting for OIDC Discovery Provider Deployment..." + oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m + oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m + + echo "Operand pod status in ${NS} before TLS scan:" + oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true + from: src + resources: + requests: + cpu: 100m + timeout: 45m0s + - ref: tls-13 + - ref: tls-scanner-run + workflow: optional-operators-ci-operator-sdk-aws - always_run: false as: e2e-operator-rhcos10-fips optional: true diff --git a/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml new file mode 100644 index 0000000000000..fe09db65631f9 --- /dev/null +++ b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml @@ -0,0 +1,175 @@ +periodics: +- agent: kubernetes + cluster: build05 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.coverage + extra_refs: + - base_ref: main + org: openshift + repo: zero-trust-workload-identity-manager + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.coverage + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-zero-trust-workload-identity-manager-main-tls-pqc-readiness-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-periodic + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build05 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.coverage + extra_refs: + - base_ref: main + org: openshift + repo: zero-trust-workload-identity-manager + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.coverage + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-zero-trust-workload-identity-manager-main-tls-scanner-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-periodic + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-presubmits.yaml b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-presubmits.yaml index 4721af1d02761..69e6957f6a531 100644 --- a/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-presubmits.yaml @@ -555,6 +555,92 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )(operator-e2e-coverage|remaining-required),?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build06 + context: ci/prow/tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - Dockerfile.coverage + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-zero-trust-workload-identity-manager-main-tls-pqc-readiness + optional: true + rerun_command: /test tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: false branches: From 2ccf59136e872aca50b170a5589c1c63f4d39743 Mon Sep 17 00:00:00 2001 From: Sayak Das Date: Tue, 8 Sep 2026 11:09:31 +0530 Subject: [PATCH 4/4] SPIRE-632: Refactor ZTWIM TLS jobs per review feedback Extract operand deployment into shared ztwim-deploy-spire-operands step, reorder test steps to apply tls-13 before operand deploy, add CR Ready waits, and keep only tls-scanner-periodic on the weekly cron schedule. Co-authored-by: Cursor --- ...-trust-workload-identity-manager-main.yaml | 497 +----------------- ...kload-identity-manager-main-periodics.yaml | 87 --- ci-operator/step-registry/ztwim/OWNERS | 13 + .../ztwim/deploy-spire-operands/OWNERS | 13 + .../ztwim-deploy-spire-operands-commands.sh | 130 +++++ ...im-deploy-spire-operands-ref.metadata.json | 19 + .../ztwim-deploy-spire-operands-ref.yaml | 16 + 7 files changed, 194 insertions(+), 581 deletions(-) create mode 100644 ci-operator/step-registry/ztwim/OWNERS create mode 100644 ci-operator/step-registry/ztwim/deploy-spire-operands/OWNERS create mode 100755 ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-commands.sh create mode 100644 ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-ref.metadata.json create mode 100644 ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-ref.yaml diff --git a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml index f17d802a3ad1b..8d0b154eec46c 100644 --- a/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml +++ b/ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml @@ -123,126 +123,8 @@ tests: TLS_13_ENABLE_TLS_ADHERENCE: "true" TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: - - as: deploy-operand - cli: latest - commands: |- - set -o errexit - set -o nounset - set -o pipefail - - NS=zero-trust-workload-identity-manager - - echo "Waiting for operator Deployment..." - oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m - - echo "Waiting for managed CRDs..." - for crd in \ - zerotrustworkloadidentitymanagers.operator.openshift.io \ - spireservers.operator.openshift.io \ - spireagents.operator.openshift.io \ - spiffecsidrivers.operator.openshift.io \ - spireoidcdiscoveryproviders.operator.openshift.io; do - oc wait --for=condition=Established "crd/${crd}" --timeout=5m - done - - # Mirror the manual install flow: derive cluster-specific values, then apply - # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers - # operator and operand communication endpoints in ${NS}. - # Disable tracing while handling cluster-derived hostnames/issuer URLs. - [[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false - set +x - APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')" - JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}" - CLUSTER_NAME="cluster1" - BUNDLE_CONFIGMAP="spire-bundle" - - echo "Applying ZTWIM and SPIRE operand CRs..." - cat </dev/null - apiVersion: operator.openshift.io/v1alpha1 - kind: ZeroTrustWorkloadIdentityManager - metadata: - name: cluster - spec: - trustDomain: ${APP_DOMAIN} - clusterName: ${CLUSTER_NAME} - bundleConfigMap: ${BUNDLE_CONFIGMAP} - --- - apiVersion: operator.openshift.io/v1alpha1 - kind: SpireServer - metadata: - name: cluster - spec: - jwtIssuer: ${JWT_ISSUER} - caValidity: 24h - defaultX509Validity: 1h - defaultJWTValidity: 5m - caSubject: - commonName: ${APP_DOMAIN} - country: "US" - organization: "RH" - persistence: - size: "1Gi" - accessMode: ReadWriteOncePod - datastore: - databaseType: sqlite3 - connectionString: "/run/spire/data/datastore.sqlite3" - maxOpenConns: 100 - maxIdleConns: 2 - connMaxLifetime: 3600 - disableMigration: "false" - --- - apiVersion: operator.openshift.io/v1alpha1 - kind: SpireAgent - metadata: - name: cluster - spec: - nodeAttestor: - k8sPSATEnabled: "true" - workloadAttestors: - k8sEnabled: "true" - workloadAttestorsVerification: - type: "auto" - --- - apiVersion: operator.openshift.io/v1alpha1 - kind: SpiffeCSIDriver - metadata: - name: cluster - spec: {} - --- - apiVersion: operator.openshift.io/v1alpha1 - kind: SpireOIDCDiscoveryProvider - metadata: - name: cluster - spec: - jwtIssuer: ${JWT_ISSUER} - managedRoute: "true" - EOF - $WAS_TRACING && set -x - - echo "Waiting for SPIRE Server StatefulSet..." - oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m - oc rollout status statefulset/spire-server -n "${NS}" --timeout=10m - - echo "Waiting for SPIRE Agent DaemonSet..." - oc wait --for=create -n "${NS}" daemonset/spire-agent --timeout=10m - oc rollout status daemonset/spire-agent -n "${NS}" --timeout=10m - - echo "Waiting for SPIFFE CSI Driver DaemonSet..." - oc wait --for=create -n "${NS}" daemonset/spire-spiffe-csi-driver --timeout=10m - oc rollout status daemonset/spire-spiffe-csi-driver -n "${NS}" --timeout=10m - - echo "Waiting for OIDC Discovery Provider Deployment..." - oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m - oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m - - echo "Operand pod status in ${NS} before TLS scan:" - oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true - from: src - resources: - requests: - cpu: 100m - timeout: 45m0s - ref: tls-13 + - ref: ztwim-deploy-spire-operands - ref: tls-scanner-run workflow: optional-operators-ci-operator-sdk-aws - as: tls-scanner-periodic @@ -261,126 +143,8 @@ tests: TLS_13_ENABLE_TLS_ADHERENCE: "true" TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: - - as: deploy-operand - cli: latest - commands: |- - set -o errexit - set -o nounset - set -o pipefail - - NS=zero-trust-workload-identity-manager - - echo "Waiting for operator Deployment..." - oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m - - echo "Waiting for managed CRDs..." - for crd in \ - zerotrustworkloadidentitymanagers.operator.openshift.io \ - spireservers.operator.openshift.io \ - spireagents.operator.openshift.io \ - spiffecsidrivers.operator.openshift.io \ - spireoidcdiscoveryproviders.operator.openshift.io; do - oc wait --for=condition=Established "crd/${crd}" --timeout=5m - done - - # Mirror the manual install flow: derive cluster-specific values, then apply - # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers - # operator and operand communication endpoints in ${NS}. - # Disable tracing while handling cluster-derived hostnames/issuer URLs. - [[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false - set +x - APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')" - JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}" - CLUSTER_NAME="cluster1" - BUNDLE_CONFIGMAP="spire-bundle" - - echo "Applying ZTWIM and SPIRE operand CRs..." - cat </dev/null - apiVersion: operator.openshift.io/v1alpha1 - kind: ZeroTrustWorkloadIdentityManager - metadata: - name: cluster - spec: - trustDomain: ${APP_DOMAIN} - clusterName: ${CLUSTER_NAME} - bundleConfigMap: ${BUNDLE_CONFIGMAP} - --- - apiVersion: operator.openshift.io/v1alpha1 - kind: SpireServer - metadata: - name: cluster - spec: - jwtIssuer: ${JWT_ISSUER} - caValidity: 24h - defaultX509Validity: 1h - defaultJWTValidity: 5m - caSubject: - commonName: ${APP_DOMAIN} - country: "US" - organization: "RH" - persistence: - size: "1Gi" - accessMode: ReadWriteOncePod - datastore: - databaseType: sqlite3 - connectionString: "/run/spire/data/datastore.sqlite3" - maxOpenConns: 100 - maxIdleConns: 2 - connMaxLifetime: 3600 - disableMigration: "false" - --- - apiVersion: operator.openshift.io/v1alpha1 - kind: SpireAgent - metadata: - name: cluster - spec: - nodeAttestor: - k8sPSATEnabled: "true" - workloadAttestors: - k8sEnabled: "true" - workloadAttestorsVerification: - type: "auto" - --- - apiVersion: operator.openshift.io/v1alpha1 - kind: SpiffeCSIDriver - metadata: - name: cluster - spec: {} - --- - apiVersion: operator.openshift.io/v1alpha1 - kind: SpireOIDCDiscoveryProvider - metadata: - name: cluster - spec: - jwtIssuer: ${JWT_ISSUER} - managedRoute: "true" - EOF - $WAS_TRACING && set -x - - echo "Waiting for SPIRE Server StatefulSet..." - oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m - oc rollout status statefulset/spire-server -n "${NS}" --timeout=10m - - echo "Waiting for SPIRE Agent DaemonSet..." - oc wait --for=create -n "${NS}" daemonset/spire-agent --timeout=10m - oc rollout status daemonset/spire-agent -n "${NS}" --timeout=10m - - echo "Waiting for SPIFFE CSI Driver DaemonSet..." - oc wait --for=create -n "${NS}" daemonset/spire-spiffe-csi-driver --timeout=10m - oc rollout status daemonset/spire-spiffe-csi-driver -n "${NS}" --timeout=10m - - echo "Waiting for OIDC Discovery Provider Deployment..." - oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m - oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m - - echo "Operand pod status in ${NS} before TLS scan:" - oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true - from: src - resources: - requests: - cpu: 100m - timeout: 45m0s - ref: tls-13 + - ref: ztwim-deploy-spire-operands - ref: tls-scanner-run workflow: optional-operators-ci-operator-sdk-aws - always_run: false @@ -399,263 +163,8 @@ tests: SCANNER_CPU: "1" SCANNER_MEMORY: 1Gi test: - - as: deploy-operand - cli: latest - commands: |- - set -o errexit - set -o nounset - set -o pipefail - - NS=zero-trust-workload-identity-manager - - echo "Waiting for operator Deployment..." - oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m - - echo "Waiting for managed CRDs..." - for crd in \ - zerotrustworkloadidentitymanagers.operator.openshift.io \ - spireservers.operator.openshift.io \ - spireagents.operator.openshift.io \ - spiffecsidrivers.operator.openshift.io \ - spireoidcdiscoveryproviders.operator.openshift.io; do - oc wait --for=condition=Established "crd/${crd}" --timeout=5m - done - - # Mirror the manual install flow: derive cluster-specific values, then apply - # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers - # operator and operand communication endpoints in ${NS}. - # Disable tracing while handling cluster-derived hostnames/issuer URLs. - [[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false - set +x - APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')" - JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}" - CLUSTER_NAME="cluster1" - BUNDLE_CONFIGMAP="spire-bundle" - - echo "Applying ZTWIM and SPIRE operand CRs..." - cat </dev/null - apiVersion: operator.openshift.io/v1alpha1 - kind: ZeroTrustWorkloadIdentityManager - metadata: - name: cluster - spec: - trustDomain: ${APP_DOMAIN} - clusterName: ${CLUSTER_NAME} - bundleConfigMap: ${BUNDLE_CONFIGMAP} - --- - apiVersion: operator.openshift.io/v1alpha1 - kind: SpireServer - metadata: - name: cluster - spec: - jwtIssuer: ${JWT_ISSUER} - caValidity: 24h - defaultX509Validity: 1h - defaultJWTValidity: 5m - caSubject: - commonName: ${APP_DOMAIN} - country: "US" - organization: "RH" - persistence: - size: "1Gi" - accessMode: ReadWriteOncePod - datastore: - databaseType: sqlite3 - connectionString: "/run/spire/data/datastore.sqlite3" - maxOpenConns: 100 - maxIdleConns: 2 - connMaxLifetime: 3600 - disableMigration: "false" - --- - apiVersion: operator.openshift.io/v1alpha1 - kind: SpireAgent - metadata: - name: cluster - spec: - nodeAttestor: - k8sPSATEnabled: "true" - workloadAttestors: - k8sEnabled: "true" - workloadAttestorsVerification: - type: "auto" - --- - apiVersion: operator.openshift.io/v1alpha1 - kind: SpiffeCSIDriver - metadata: - name: cluster - spec: {} - --- - apiVersion: operator.openshift.io/v1alpha1 - kind: SpireOIDCDiscoveryProvider - metadata: - name: cluster - spec: - jwtIssuer: ${JWT_ISSUER} - managedRoute: "true" - EOF - $WAS_TRACING && set -x - - echo "Waiting for SPIRE Server StatefulSet..." - oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m - oc rollout status statefulset/spire-server -n "${NS}" --timeout=10m - - echo "Waiting for SPIRE Agent DaemonSet..." - oc wait --for=create -n "${NS}" daemonset/spire-agent --timeout=10m - oc rollout status daemonset/spire-agent -n "${NS}" --timeout=10m - - echo "Waiting for SPIFFE CSI Driver DaemonSet..." - oc wait --for=create -n "${NS}" daemonset/spire-spiffe-csi-driver --timeout=10m - oc rollout status daemonset/spire-spiffe-csi-driver -n "${NS}" --timeout=10m - - echo "Waiting for OIDC Discovery Provider Deployment..." - oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m - oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m - - echo "Operand pod status in ${NS} before TLS scan:" - oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true - from: src - resources: - requests: - cpu: 100m - timeout: 45m0s - - ref: tls-13 - - ref: tls-scanner-run - workflow: optional-operators-ci-operator-sdk-aws -- as: tls-pqc-readiness-periodic - cron: 0 6 * * 1 - steps: - cluster_profile: openshift-org-aws - dependencies: - OO_BUNDLE: zero-trust-workload-identity-manager-bundle - env: - OO_INSTALL_MODE: AllNamespaces - OO_INSTALL_NAMESPACE: zero-trust-workload-identity-manager - OO_SECURITY_CONTEXT: restricted - PQC_CHECK: "true" - SCAN_NAMESPACE: zero-trust-workload-identity-manager - SCANNER_CPU: "1" - SCANNER_MEMORY: 1Gi - test: - - as: deploy-operand - cli: latest - commands: |- - set -o errexit - set -o nounset - set -o pipefail - - NS=zero-trust-workload-identity-manager - - echo "Waiting for operator Deployment..." - oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m - - echo "Waiting for managed CRDs..." - for crd in \ - zerotrustworkloadidentitymanagers.operator.openshift.io \ - spireservers.operator.openshift.io \ - spireagents.operator.openshift.io \ - spiffecsidrivers.operator.openshift.io \ - spireoidcdiscoveryproviders.operator.openshift.io; do - oc wait --for=condition=Established "crd/${crd}" --timeout=5m - done - - # Mirror the manual install flow: derive cluster-specific values, then apply - # ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers - # operator and operand communication endpoints in ${NS}. - # Disable tracing while handling cluster-derived hostnames/issuer URLs. - [[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false - set +x - APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')" - JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}" - CLUSTER_NAME="cluster1" - BUNDLE_CONFIGMAP="spire-bundle" - - echo "Applying ZTWIM and SPIRE operand CRs..." - cat </dev/null - apiVersion: operator.openshift.io/v1alpha1 - kind: ZeroTrustWorkloadIdentityManager - metadata: - name: cluster - spec: - trustDomain: ${APP_DOMAIN} - clusterName: ${CLUSTER_NAME} - bundleConfigMap: ${BUNDLE_CONFIGMAP} - --- - apiVersion: operator.openshift.io/v1alpha1 - kind: SpireServer - metadata: - name: cluster - spec: - jwtIssuer: ${JWT_ISSUER} - caValidity: 24h - defaultX509Validity: 1h - defaultJWTValidity: 5m - caSubject: - commonName: ${APP_DOMAIN} - country: "US" - organization: "RH" - persistence: - size: "1Gi" - accessMode: ReadWriteOncePod - datastore: - databaseType: sqlite3 - connectionString: "/run/spire/data/datastore.sqlite3" - maxOpenConns: 100 - maxIdleConns: 2 - connMaxLifetime: 3600 - disableMigration: "false" - --- - apiVersion: operator.openshift.io/v1alpha1 - kind: SpireAgent - metadata: - name: cluster - spec: - nodeAttestor: - k8sPSATEnabled: "true" - workloadAttestors: - k8sEnabled: "true" - workloadAttestorsVerification: - type: "auto" - --- - apiVersion: operator.openshift.io/v1alpha1 - kind: SpiffeCSIDriver - metadata: - name: cluster - spec: {} - --- - apiVersion: operator.openshift.io/v1alpha1 - kind: SpireOIDCDiscoveryProvider - metadata: - name: cluster - spec: - jwtIssuer: ${JWT_ISSUER} - managedRoute: "true" - EOF - $WAS_TRACING && set -x - - echo "Waiting for SPIRE Server StatefulSet..." - oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m - oc rollout status statefulset/spire-server -n "${NS}" --timeout=10m - - echo "Waiting for SPIRE Agent DaemonSet..." - oc wait --for=create -n "${NS}" daemonset/spire-agent --timeout=10m - oc rollout status daemonset/spire-agent -n "${NS}" --timeout=10m - - echo "Waiting for SPIFFE CSI Driver DaemonSet..." - oc wait --for=create -n "${NS}" daemonset/spire-spiffe-csi-driver --timeout=10m - oc rollout status daemonset/spire-spiffe-csi-driver -n "${NS}" --timeout=10m - - echo "Waiting for OIDC Discovery Provider Deployment..." - oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m - oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m - - echo "Operand pod status in ${NS} before TLS scan:" - oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true - from: src - resources: - requests: - cpu: 100m - timeout: 45m0s - ref: tls-13 + - ref: ztwim-deploy-spire-operands - ref: tls-scanner-run workflow: optional-operators-ci-operator-sdk-aws - always_run: false diff --git a/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml index fe09db65631f9..ef8f215321a48 100644 --- a/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml +++ b/ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-periodics.yaml @@ -1,91 +1,4 @@ periodics: -- agent: kubernetes - cluster: build05 - cron: 0 6 * * 1 - decorate: true - decoration_config: - sparse_checkout_files: - - .ci-operator.yaml - - Dockerfile - - Dockerfile.coverage - extra_refs: - - base_ref: main - org: openshift - repo: zero-trust-workload-identity-manager - sparse_checkout_files: - - .ci-operator.yaml - - Dockerfile - - Dockerfile.coverage - labels: - ci-operator.openshift.io/cloud: aws - ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws - ci.openshift.io/generator: prowgen - pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: periodic-ci-openshift-zero-trust-workload-identity-manager-main-tls-pqc-readiness-periodic - spec: - containers: - - args: - - --gcs-upload-secret=/secrets/gcs/service-account.json - - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --lease-server-credentials-file=/etc/boskos/credentials - - --report-credentials-file=/etc/report/credentials - - --secret-dir=/secrets/ci-pull-credentials - - --target=tls-pqc-readiness-periodic - command: - - ci-operator - env: - - name: HTTP_SERVER_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest - imagePullPolicy: Always - name: "" - ports: - - containerPort: 8080 - name: http - resources: - requests: - cpu: 10m - volumeMounts: - - mountPath: /etc/boskos - name: boskos - readOnly: true - - mountPath: /secrets/ci-pull-credentials - name: ci-pull-credentials - readOnly: true - - mountPath: /secrets/gcs - name: gcs-credentials - readOnly: true - - mountPath: /secrets/manifest-tool - name: manifest-tool-local-pusher - readOnly: true - - mountPath: /etc/pull-secret - name: pull-secret - readOnly: true - - mountPath: /etc/report - name: result-aggregator - readOnly: true - serviceAccountName: ci-operator - volumes: - - name: boskos - secret: - items: - - key: credentials - path: credentials - secretName: boskos-credentials - - name: ci-pull-credentials - secret: - secretName: ci-pull-credentials - - name: manifest-tool-local-pusher - secret: - secretName: manifest-tool-local-pusher - - name: pull-secret - secret: - secretName: registry-pull-credentials - - name: result-aggregator - secret: - secretName: result-aggregator - agent: kubernetes cluster: build05 cron: 0 6 * * 1 diff --git a/ci-operator/step-registry/ztwim/OWNERS b/ci-operator/step-registry/ztwim/OWNERS new file mode 100644 index 0000000000000..b789b83f4e879 --- /dev/null +++ b/ci-operator/step-registry/ztwim/OWNERS @@ -0,0 +1,13 @@ +approvers: +- bharath-b-rh +- nhegde07 +- rausingh-rh +- swghosh +- trilokgeer +options: {} +reviewers: +- bharath-b-rh +- nhegde07 +- rausingh-rh +- swghosh +- trilokgeer diff --git a/ci-operator/step-registry/ztwim/deploy-spire-operands/OWNERS b/ci-operator/step-registry/ztwim/deploy-spire-operands/OWNERS new file mode 100644 index 0000000000000..b789b83f4e879 --- /dev/null +++ b/ci-operator/step-registry/ztwim/deploy-spire-operands/OWNERS @@ -0,0 +1,13 @@ +approvers: +- bharath-b-rh +- nhegde07 +- rausingh-rh +- swghosh +- trilokgeer +options: {} +reviewers: +- bharath-b-rh +- nhegde07 +- rausingh-rh +- swghosh +- trilokgeer diff --git a/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-commands.sh b/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-commands.sh new file mode 100755 index 0000000000000..942c6b128c04a --- /dev/null +++ b/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-commands.sh @@ -0,0 +1,130 @@ +#!/bin/bash +set -o errexit +set -o nounset +set -o pipefail + +export KUBECONFIG="${SHARED_DIR}/kubeconfig" + +# For disconnected or otherwise unreachable environments, use the shared proxy config. +if test -f "${SHARED_DIR}/proxy-conf.sh"; then + # shellcheck disable=SC1090 + source "${SHARED_DIR}/proxy-conf.sh" +fi + +NS=zero-trust-workload-identity-manager + +echo "Waiting for operator Deployment..." +oc wait --for=condition=Available -n "${NS}" deployment/zero-trust-workload-identity-manager-controller-manager --timeout=10m + +echo "Waiting for managed CRDs..." +for crd in \ + zerotrustworkloadidentitymanagers.operator.openshift.io \ + spireservers.operator.openshift.io \ + spireagents.operator.openshift.io \ + spiffecsidrivers.operator.openshift.io \ + spireoidcdiscoveryproviders.operator.openshift.io; do + oc wait --for=condition=Established "crd/${crd}" --timeout=5m +done + +# Mirror the manual install flow: derive cluster-specific values, then apply +# ZeroTrustWorkloadIdentityManager + SPIRE operand CRs so TLS scanning covers +# operator and operand communication endpoints in ${NS}. +# Disable tracing while handling cluster-derived hostnames/issuer URLs. +[[ $- == *x* ]] && WAS_TRACING=true || WAS_TRACING=false +set +x +APP_DOMAIN="apps.$(oc get dns cluster -o jsonpath='{.spec.baseDomain}')" +JWT_ISSUER="https://oidc-discovery.${APP_DOMAIN}" +CLUSTER_NAME="cluster1" +BUNDLE_CONFIGMAP="spire-bundle" + +echo "Applying ZTWIM and SPIRE operand CRs..." +cat </dev/null +apiVersion: operator.openshift.io/v1alpha1 +kind: ZeroTrustWorkloadIdentityManager +metadata: + name: cluster +spec: + trustDomain: ${APP_DOMAIN} + clusterName: ${CLUSTER_NAME} + bundleConfigMap: ${BUNDLE_CONFIGMAP} +--- +apiVersion: operator.openshift.io/v1alpha1 +kind: SpireServer +metadata: + name: cluster +spec: + jwtIssuer: ${JWT_ISSUER} + caValidity: 24h + defaultX509Validity: 1h + defaultJWTValidity: 5m + caSubject: + commonName: ${APP_DOMAIN} + country: "US" + organization: "RH" + persistence: + size: "1Gi" + accessMode: ReadWriteOncePod + datastore: + databaseType: sqlite3 + connectionString: "/run/spire/data/datastore.sqlite3" + maxOpenConns: 100 + maxIdleConns: 2 + connMaxLifetime: 3600 + disableMigration: "false" +--- +apiVersion: operator.openshift.io/v1alpha1 +kind: SpireAgent +metadata: + name: cluster +spec: + nodeAttestor: + k8sPSATEnabled: "true" + workloadAttestors: + k8sEnabled: "true" + workloadAttestorsVerification: + type: "auto" +--- +apiVersion: operator.openshift.io/v1alpha1 +kind: SpiffeCSIDriver +metadata: + name: cluster +spec: {} +--- +apiVersion: operator.openshift.io/v1alpha1 +kind: SpireOIDCDiscoveryProvider +metadata: + name: cluster +spec: + jwtIssuer: ${JWT_ISSUER} + managedRoute: "true" +EOF +$WAS_TRACING && set -x + +echo "Waiting for SPIRE Server StatefulSet..." +oc wait --for=create -n "${NS}" statefulset/spire-server --timeout=10m +oc rollout status statefulset/spire-server -n "${NS}" --timeout=10m + +echo "Waiting for SPIRE Agent DaemonSet..." +oc wait --for=create -n "${NS}" daemonset/spire-agent --timeout=10m +oc rollout status daemonset/spire-agent -n "${NS}" --timeout=10m + +echo "Waiting for SPIFFE CSI Driver DaemonSet..." +oc wait --for=create -n "${NS}" daemonset/spire-spiffe-csi-driver --timeout=10m +oc rollout status daemonset/spire-spiffe-csi-driver -n "${NS}" --timeout=10m + +echo "Waiting for OIDC Discovery Provider Deployment..." +oc wait --for=create -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m +oc wait --for=condition=Available -n "${NS}" deployment/spire-spiffe-oidc-discovery-provider --timeout=10m + +echo "Waiting for operand CRs to become Ready..." +for cr in \ + spireservers.operator.openshift.io/cluster \ + spireagents.operator.openshift.io/cluster \ + spiffecsidrivers.operator.openshift.io/cluster \ + spireoidcdiscoveryproviders.operator.openshift.io/cluster \ + zerotrustworkloadidentitymanagers.operator.openshift.io/cluster; do + oc wait --for=condition=Ready "${cr}" --timeout=10m +done + +echo "Operand pod status in ${NS} before TLS scan:" +oc get pods -n "${NS}" -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,READY:.status.containerStatuses[*].ready --no-headers || true diff --git a/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-ref.metadata.json b/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-ref.metadata.json new file mode 100644 index 0000000000000..43f2fe5cb89d3 --- /dev/null +++ b/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-ref.metadata.json @@ -0,0 +1,19 @@ +{ + "path": "ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-ref.yaml", + "owners": { + "approvers": [ + "bharath-b-rh", + "nhegde07", + "rausingh-rh", + "swghosh", + "trilokgeer" + ], + "reviewers": [ + "bharath-b-rh", + "nhegde07", + "rausingh-rh", + "swghosh", + "trilokgeer" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-ref.yaml b/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-ref.yaml new file mode 100644 index 0000000000000..48829675c18db --- /dev/null +++ b/ci-operator/step-registry/ztwim/deploy-spire-operands/ztwim-deploy-spire-operands-ref.yaml @@ -0,0 +1,16 @@ +ref: + as: ztwim-deploy-spire-operands + from: src + cli: latest + commands: ztwim-deploy-spire-operands-commands.sh + resources: + requests: + cpu: 100m + memory: 200Mi + timeout: 45m0s + documentation: |- + Deploys ZeroTrustWorkloadIdentityManager and SPIRE operand CRs + (SpireServer, SpireAgent, SpiffeCSIDriver, SpireOIDCDiscoveryProvider), + then waits until the operator Deployment, managed workloads, and CR Ready + conditions are satisfied. Intended for TLS/PQC scanner jobs after operator + install.