Add TLS strict-adherence and PQC-readiness scanner jobs for ocp-release-operator-sdk and ansible-operator-plugins - #83172
Open
mytreya-rh wants to merge 2 commits into
Open
Conversation
…tors Deploys the sample memcached operator built from the existing osdk-helm-e2e / ansible-operator-e2e images and runs the tls-13 / tls-scanner-run steps against it, mirroring the tls13-adherence and tls-pqc-readiness (+ periodic) pattern used by oadp-operator and other repos. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThe change adds the ChangesTLS validation workflows
Estimated code review effort: 3 (Moderate) | ~20 minutes Mergeability Score: ⚪ Minimal · up to The PR adds optional and periodic TLS/PQC scanner jobs plus their required configuration entries; no actionable merge-blocking risk remains beyond normal checks and review. Sequence Diagram(s)sequenceDiagram
participant CIJob
participant MemcachedOperator
participant TLS13Workflow
participant TLSScannerWorkflow
CIJob->>MemcachedOperator: Deploy operator
MemcachedOperator-->>CIJob: Confirm availability
CIJob->>TLS13Workflow: Run adherence or PQC checks
CIJob->>TLSScannerWorkflow: Run scanner workflow
Possibly related PRs
Suggested labels: Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: mytreya-rh The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
Contributor
Author
|
/pj-rehearse pull-ci-openshift-ansible-operator-plugins-main-tls13-adherence pull-ci-openshift-ansible-operator-plugins-main-tls-pqc-readiness pull-ci-openshift-ocp-release-operator-sdk-main-tls13-adherence pull-ci-openshift-ocp-release-operator-sdk-main-tls-pqc-readiness |
Contributor
|
@mytreya-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
This was referenced Aug 10, 2026
3 tasks
This was referenced Aug 11, 2026
The sample operators' Makefiles hard-code `kubectl apply`/`kubectl delete` in their `deploy`/`undeploy` targets, but the deploy-operator step only has `oc` available (via cli: latest). Symlink kubectl -> oc on PATH before invoking `make deploy`, same approach already relied on implicitly by other steps using oc for everything else. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
Author
|
/pj-rehearse pull-ci-openshift-ansible-operator-plugins-main-tls13-adherence pull-ci-openshift-ansible-operator-plugins-main-tls-pqc-readiness pull-ci-openshift-ocp-release-operator-sdk-main-tls13-adherence pull-ci-openshift-ocp-release-operator-sdk-main-tls-pqc-readiness |
Contributor
|
@mytreya-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Contributor
|
[REHEARSALNOTIFIER]
A total of 26 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
Contributor
|
@mytreya-rh: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Contributor
Author
|
/pj-rehearse ack
|
Contributor
|
@mytreya-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
Contributor
Author
|
/cc @chiragkyal |
mytreya-rh
added a commit
to mytreya-rh/ocp-release-operator-sdk
that referenced
this pull request
Aug 14, 2026
…n Helm operator metrics server Fixes the tls13-adherence CI job: the Helm operator's metrics server (port 8443) never set a TLS MinVersion, so it always negotiated down to TLS 1.2 regardless of the cluster's configured TLS security profile, violating strict adherence on Modern (TLS-1.3-only) clusters. Adds internal/helm/openshifttls, a downstream-only package that: - registers itself with the generic run.ClusterTLSPolicy extension point (see previous commit) via a blank import from cmd/helm-operator/main.go; - fetches the TLS profile from apiservers.config.openshift.io/cluster at startup using github.com/openshift/controller-runtime-common/pkg/tls (FetchAPIServerTLSProfile / NewTLSConfigFromProfile), falling back to the default (Intermediate) profile on any error - e.g. non-OpenShift clusters or a missing APIServer object/CRD - so startup is never blocked; - appends the resulting TLS config (MinVersion/CipherSuites) to options.Metrics.TLSOpts; - registers a SecurityProfileWatcher that cancels the manager's run context when the profile changes, triggering a graceful shutdown; the surrounding Deployment/container restart re-applies the (possibly new) profile on the next boot. Also: - adds a get/list/watch RBAC rule for config.openshift.io/apiservers to the Helm plugin's manager_role.go scaffold template, and mirrors it into the memcached-operator testdata's role.yaml and CSV clusterPermissions (the fixture this CI job actually deploys); - adds github.com/openshift/controller-runtime-common (and its transitive github.com/openshift/api, github.com/openshift/library-go) to go.mod/go.sum/vendor. This commit is genuinely OpenShift-specific and is not proposed upstream; it is permanent carry, unlike the two preceding commits. Fixes: rehearse-*-tls13-adherence job in openshift/release#83172 Ref: OCPSTRAT-2611 Co-authored-by: Cursor <cursoragent@cursor.com>
4 tasks
mytreya-rh
added a commit
to mytreya-rh/ocp-release-operator-sdk
that referenced
this pull request
Aug 14, 2026
…n Helm operator metrics server Fixes the tls13-adherence CI job: the Helm operator's metrics server (port 8443) never set a TLS MinVersion, so it always negotiated down to TLS 1.2 regardless of the cluster's configured TLS security profile, violating strict adherence on Modern (TLS-1.3-only) clusters. Adds internal/helm/openshifttls, a downstream-only package that: - registers itself with the generic run.ClusterTLSPolicy extension point (see previous commit) via a blank import from cmd/helm-operator/main.go; - fetches the TLS profile from apiservers.config.openshift.io/cluster at startup using github.com/openshift/controller-runtime-common/pkg/tls (FetchAPIServerTLSProfile / NewTLSConfigFromProfile), falling back to the default (Intermediate) profile on any error - e.g. non-OpenShift clusters or a missing APIServer object/CRD - so startup is never blocked; - appends the resulting TLS config (MinVersion/CipherSuites) to options.Metrics.TLSOpts; - registers a SecurityProfileWatcher that cancels the manager's run context when the profile changes, triggering a graceful shutdown; the surrounding Deployment/container restart re-applies the (possibly new) profile on the next boot. Also: - adds a get/list/watch RBAC rule for config.openshift.io/apiservers to the Helm plugin's manager_role.go scaffold template, and mirrors it into the memcached-operator testdata's role.yaml and CSV clusterPermissions (the fixture this CI job actually deploys); - adds github.com/openshift/controller-runtime-common (and its transitive github.com/openshift/api, github.com/openshift/library-go) to go.mod/go.sum/vendor. This commit is genuinely OpenShift-specific and is not proposed upstream; it is permanent carry, unlike the two preceding commits. Fixes: rehearse-*-tls13-adherence job in openshift/release#83172 Ref: OCPSTRAT-2611 Co-authored-by: Cursor <cursoragent@cursor.com>
mytreya-rh
added a commit
to mytreya-rh/ansible-operator-plugins
that referenced
this pull request
Aug 14, 2026
…n Ansible operator metrics server Fixes the tls13-adherence CI job: the ansible-operator's metrics server (port 8443) never set a TLS MinVersion, so it always negotiated down to TLS 1.2 regardless of the cluster's configured TLS security profile, violating strict adherence on Modern (TLS-1.3-only) clusters. Adds internal/ansible/openshifttls, a downstream-only package that: - registers itself with the generic run.ClusterTLSPolicy extension point (see previous commit) via a blank import from cmd/ansible-operator/main.go; - fetches the TLS profile from apiservers.config.openshift.io/cluster at startup using github.com/openshift/controller-runtime-common/pkg/tls (FetchAPIServerTLSProfile / NewTLSConfigFromProfile), falling back to the default (Intermediate) profile on any error - e.g. non-OpenShift clusters or a missing APIServer object/CRD - so startup is never blocked; - appends the resulting TLS config (MinVersion/CipherSuites) to options.Metrics.TLSOpts; - registers a SecurityProfileWatcher that cancels the manager's run context when the profile changes, triggering a graceful shutdown; the surrounding Deployment/container restart re-applies the (possibly new) profile on the next boot. Also: - adds a get/list/watch RBAC rule for config.openshift.io/apiservers to the Ansible plugin's role.go scaffold template, and mirrors it (via `make generate`, verified to produce an identical diff) into the memcached-molecule-operator testdata's role.yaml - the fixture this CI job actually deploys; - adds github.com/openshift/controller-runtime-common (and its transitive github.com/openshift/api, github.com/openshift/library-go) to go.mod/go.sum (vendor/ synced in the following commit). This commit is genuinely OpenShift-specific and is not proposed upstream; it is permanent carry, unlike the two preceding commits. Fixes: rehearse-*-tls13-adherence job in openshift/release#83172 Ref: OCPSTRAT-2611 Co-authored-by: Cursor <cursoragent@cursor.com>
mytreya-rh
added a commit
to mytreya-rh/ocp-release-operator-sdk
that referenced
this pull request
Aug 14, 2026
…n Helm operator metrics server Fixes the tls13-adherence CI job: the Helm operator's metrics server (port 8443) never set a TLS MinVersion, so it always negotiated down to TLS 1.2 regardless of the cluster's configured TLS security profile, violating strict adherence on Modern (TLS-1.3-only) clusters. Adds internal/helm/openshifttls, a downstream-only package that: - registers itself with the generic run.ClusterTLSPolicy extension point (see previous commit) via a blank import from cmd/helm-operator/main.go; - fetches the TLS profile from apiservers.config.openshift.io/cluster at startup using github.com/openshift/controller-runtime-common/pkg/tls (FetchAPIServerTLSProfile / NewTLSConfigFromProfile), falling back to the default (Intermediate) profile on any error - e.g. non-OpenShift clusters or a missing APIServer object/CRD - so startup is never blocked; - appends the resulting TLS config (MinVersion/CipherSuites) to options.Metrics.TLSOpts; - registers a SecurityProfileWatcher that cancels the manager's run context when the profile changes, triggering a graceful shutdown; the surrounding Deployment/container restart re-applies the (possibly new) profile on the next boot. Also: - adds a get/list/watch RBAC rule for config.openshift.io/apiservers to the Helm plugin's manager_role.go scaffold template, and mirrors it into the memcached-operator testdata's role.yaml and CSV clusterPermissions (the fixture this CI job actually deploys); - adds github.com/openshift/controller-runtime-common (and its transitive github.com/openshift/api, github.com/openshift/library-go) to go.mod/go.sum/vendor. This commit is genuinely OpenShift-specific and is not proposed upstream; it is permanent carry, unlike the two preceding commits. Fixes: rehearse-*-tls13-adherence job in openshift/release#83172 Ref: OCPSTRAT-2611 Co-authored-by: Cursor <cursoragent@cursor.com>
mytreya-rh
added a commit
to mytreya-rh/ansible-operator-plugins
that referenced
this pull request
Aug 14, 2026
…n Ansible operator metrics server Fixes the tls13-adherence CI job: the ansible-operator's metrics server (port 8443) never set a TLS MinVersion, so it always negotiated down to TLS 1.2 regardless of the cluster's configured TLS security profile, violating strict adherence on Modern (TLS-1.3-only) clusters. Adds internal/ansible/openshifttls, a downstream-only package that: - registers itself with the generic run.ClusterTLSPolicy extension point (see previous commit) via a blank import from cmd/ansible-operator/main.go; - fetches the TLS profile from apiservers.config.openshift.io/cluster at startup using github.com/openshift/controller-runtime-common/pkg/tls (FetchAPIServerTLSProfile / NewTLSConfigFromProfile), falling back to the default (Intermediate) profile on any error - e.g. non-OpenShift clusters or a missing APIServer object/CRD - so startup is never blocked; - appends the resulting TLS config (MinVersion/CipherSuites) to options.Metrics.TLSOpts; - registers a SecurityProfileWatcher that cancels the manager's run context when the profile changes, triggering a graceful shutdown; the surrounding Deployment/container restart re-applies the (possibly new) profile on the next boot. Also: - adds a get/list/watch RBAC rule for config.openshift.io/apiservers to the Ansible plugin's role.go scaffold template, and mirrors it (via `make generate`, verified to produce an identical diff) into the memcached-molecule-operator testdata's role.yaml - the fixture this CI job actually deploys; - adds github.com/openshift/controller-runtime-common (and its transitive github.com/openshift/api, github.com/openshift/library-go) to go.mod/go.sum (vendor/ synced in the following commit). This commit is genuinely OpenShift-specific and is not proposed upstream; it is permanent carry, unlike the two preceding commits. Fixes: rehearse-*-tls13-adherence job in openshift/release#83172 Ref: OCPSTRAT-2611 Co-authored-by: Cursor <cursoragent@cursor.com>
chiragkyal
reviewed
Aug 15, 2026
| steps: | ||
| cluster_profile: openshift-org-gcp | ||
| env: | ||
| PQC_CHECK: "false" |
Member
There was a problem hiding this comment.
I was comparing the changes with https://github.com/openshift/release/pull/82718/changes PR, but I cannot see PQC_CHECK envvar was defined there. Is false the default value?
Contributor
Author
There was a problem hiding this comment.
yes. By default its false.
Comment on lines
+174
to
+175
| make deploy IMG="${IMAGE_FORMAT}" | ||
| oc wait --for=condition=Available --timeout=5m -n memcached-molecule-operator-system deployment/memcached-molecule-operator-controller-manager |
Member
There was a problem hiding this comment.
We generally do some modifications before checking whether the pods are running or not
Don't we need that here?
Comment on lines
+170
to
+173
| mkdir -p /tmp/bin | ||
| ln -sf "$(command -v oc)" /tmp/bin/kubectl | ||
| export PATH="/tmp/bin:${PATH}" | ||
| cd testdata/memcached-molecule-operator |
Member
There was a problem hiding this comment.
Instead of modifying this here, can we not make the actual script configurable to deploy the operator, then proceed if required?
| - ref: tls-13 | ||
| - ref: tls-scanner-run | ||
| workflow: ipi-gcp | ||
| - as: tls13-adherence-periodic |
Member
There was a problem hiding this comment.
Do we really need a periodic job? Given the traffic on this repo, is the pre-merge test not enough?
| @@ -146,6 +151,128 @@ tests: | |||
| requests: | |||
| cpu: 100m | |||
| workflow: ipi-gcp | |||
| - always_run: false | |||
| as: tls13-adherence | |||
| optional: true | |||
Member
There was a problem hiding this comment.
Instead of another periodic job, I think making this required would be more reasonable.
| - ref: tls-13 | ||
| - ref: tls-scanner-run | ||
| workflow: ipi-gcp | ||
| - as: tls-pqc-readiness-periodic |
Member
There was a problem hiding this comment.
Same comment as above to periodic job
| steps: | ||
| cluster_profile: openshift-org-gcp | ||
| env: | ||
| PQC_CHECK: "true" |
Member
There was a problem hiding this comment.
Don't we need a similar job for SSCSI?
Member
There was a problem hiding this comment.
Similar comments for this repo as well, not adding them again.
mytreya-rh
added a commit
to mytreya-rh/ansible-operator-plugins
that referenced
this pull request
Aug 17, 2026
CI jobs that just need a running sample operator (e.g. the tls13-adherence scanner job) currently reimplement a stripped-down deploy sequence directly in the openshift/release ci-operator config, missing the memory-limit patch and RBAC tweaks this script already applies, and working around the lack of a kubectl binary via a manual oc-to-kubectl symlink. Extract the setup/patch/deploy logic into a deploy_operator() function (mirroring the existing test_operator() function), and add a DEPLOY_ONLY=true mode that calls deploy_operator and then exits before the CR-based functional test and undeploy, leaving the operator running. Expose it via a new deploy-e2e-ansible Makefile target so callers don't need to know the env var. Default (unset) behavior is unchanged. Ref: openshift/release#83172 (comment) Co-authored-by: Cursor <cursoragent@cursor.com>
mytreya-rh
added a commit
to mytreya-rh/ocp-release-operator-sdk
that referenced
this pull request
Aug 17, 2026
Extract the memcached-operator deployment steps (RBAC grant, make deploy, rollout wait, metrics clusterrolebinding, namespace switch) into a deploy_operator() function, and gate the rest of the script (test_operator, metrics cleanup, make undeploy) behind a DEPLOY_ONLY env var. This lets CI jobs that only need a running operator (e.g. the tls13-adherence job, which scans the operator with tls-scanner) invoke `DEPLOY_ONLY=true make -f ci/prow.Makefile test-e2e-helm` instead of duplicating inline deploy commands, per feedback on openshift/release#83172 (comment). Default behavior (DEPLOY_ONLY unset) is unchanged. Co-authored-by: Cursor <cursoragent@cursor.com>
mytreya-rh
added a commit
to mytreya-rh/ansible-operator-plugins
that referenced
this pull request
Aug 17, 2026
… for CI reuse CI jobs that just need a running sample operator (e.g. the tls13-adherence scanner job) currently reimplement a stripped-down deploy sequence directly in the openshift/release ci-operator config, missing the memory-limit patch and RBAC tweaks this script already applies, and working around the lack of a kubectl binary via a manual oc-to-kubectl symlink. Extract the setup/patch/deploy logic into a deploy_operator() function (mirroring the existing test_operator() function), and add a DEPLOY_ONLY=true mode that calls deploy_operator and then exits before the CR-based functional test and undeploy, leaving the operator running. Expose it via a new deploy-e2e-ansible Makefile target so callers don't need to know the env var. Default (unset) behavior is unchanged. Ref: openshift/release#83172 (comment) Co-authored-by: Cursor <cursoragent@cursor.com>
mytreya-rh
added a commit
to mytreya-rh/ocp-release-operator-sdk
that referenced
this pull request
Aug 17, 2026
Extract the memcached-operator deployment steps (RBAC grant, make deploy, rollout wait, metrics clusterrolebinding, namespace switch) into a deploy_operator() function, and gate the rest of the script (test_operator, metrics cleanup, make undeploy) behind a DEPLOY_ONLY env var. This lets CI jobs that only need a running operator (e.g. the tls13-adherence job, which scans the operator with tls-scanner) invoke `DEPLOY_ONLY=true make -f ci/prow.Makefile test-e2e-helm` instead of duplicating inline deploy commands, per feedback on openshift/release#83172 (comment). Default behavior (DEPLOY_ONLY unset) is unchanged. ci/tests/e2e-helm.sh is OpenShift/Prow-specific tooling with no counterpart in operator-framework/operator-sdk (its upstream predecessor, hack/tests/e2e-helm.sh, was replaced by Go-based e2e tests years ago), so this is permanent carry, not proposed upstream. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds TLS 1.3 strict-adherence and post-quantum-cryptography (PQC) readiness scanner jobs for
openshift/ocp-release-operator-sdkandopenshift/ansible-operator-plugins, mirroring thetls13-adherence/tls-pqc-readiness(+-periodic) pattern already used byoadp-operator,machine-config-operator, and the CSI driver operators.For each repo, this adds 4 tests:
tls13-adherence(presubmit,optional: true,always_run: false— triggerable via/test tls13-adherence): sets the cluster TLS profile toModernwith strict TLS adherence (TLS_13_ENABLE_TLS_ADHERENCE: "true", policyStrictAllComponents), then scans the deployed sample operator's namespace.tls13-adherence-periodic(weekly cron): same as above, runs automatically.tls-pqc-readiness(presubmit,optional: true,always_run: false— triggerable via/test tls-pqc-readiness): scans the deployed sample operator's namespace withPQC_CHECK: "true"(checks TLS 1.3 + mlkem/mlkem25519 support).tls-pqc-readiness-periodic(weekly cron): same as above, runs automatically.Since neither repo ships an OLM bundle, each job first deploys the repo's own sample memcached operator (built from the existing
osdk-helm-e2e/ansible-operator-e2ee2e images, same as the existinge2e-helm/e2e-ansiblejobs) intomemcached-operator-system/memcached-molecule-operator-systemviamake deploy IMG=..., waits for the deployment to become available, and then runs thetls-13andtls-scanner-runstep-registry refs against that namespace.Both configs also gain a
base_images.tls-scanner-toolentry, required by thetls-scanner-runref'sPULL_SPEC_TLS_SCANNER_TOOLdependency.Test plan
make updateregeneratedci-operator/jobs/**presubmits/periodics for both repos with no unexpected diffs.make jobs(ci-operator-checkconfig+ci-operator-prowgen+sanitize-prow-jobs) completed with no errors, validating the new step-registry refs/workflow usage./test tls13-adherenceand/test tls-pqc-readinesson a PR against each repo to confirm the sample operator deploys and the scan runs end-to-end.Made with Cursor
Summary by CodeRabbit
openshift/ocp-release-operator-sdkandopenshift/ansible-operator-plugins.tls-scanner-toolas a base image dependency and configures TLS and PQC scanner settings.kubectltoocbefore runningmake deploy.