DPTP-5127: Add baremetal variant of tls-scanner TLSAdherence jobs - #83269
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
WalkthroughThe TLS scanner configuration adds Equinix bare-metal TLS 1.3 adherence jobs for the main and 4.23–5.1 release streams. The scanner command loads proxy settings from ChangesTLS scanner coverage
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant PeriodicJob
participant TLS13Tests
participant TLSScanner
participant SharedProxyConfig
PeriodicJob->>TLS13Tests: Run tls-13 and tls-scanner-run
TLS13Tests->>TLSScanner: Execute scanner commands
TLSScanner->>SharedProxyConfig: Source proxy-conf.sh when present
Possibly related PRs
Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml`:
- Around line 136-160: Generate the missing Prow artifacts for the new TLS
scanner jobs by running make update, then commit the resulting updates for
ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml lines
136-160, openshift-tls-scanner-release-4.23.yaml lines 88-102,
openshift-tls-scanner-release-5.0.yaml lines 89-103, and
openshift-tls-scanner-release-5.1.yaml lines 88-102.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 74e88712-77d9-4b90-95e5-652d60cf1e51
⛔ Files ignored due to path filters (4)
ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-main-periodics.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-4.23-presubmits.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.0-presubmits.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift/tls-scanner/openshift-tls-scanner-release-5.1-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (5)
ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yamlci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yamlci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yamlci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yamlci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh
|
/pj-rehearse |
|
@richardsonnick: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
ef46dcf to
f9d2c73
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
|
/pj-rehearse |
|
@richardsonnick: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
There was a problem hiding this comment.
♻️ Duplicate comments (1)
ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml (1)
186-210:⚠️ Potential issue | 🟠 MajorRegenerate the Prow job artifacts for these new CI jobs.
These are structural changes under
ci-operator/config/. The reviewed change set does not include the corresponding generated Prow job and metadata updates. Without them, the new jobs may not be scheduled.
ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml#L186-L210: generate artifacts forperiodic-tls13-adherence-metal.ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml#L118-L132: generate artifacts for the release 4.23 optional job.ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml#L118-L132: generate artifacts for the release 5.1 optional job.As per coding guidelines, run
make updateafter modifying CI jobs underci-operator/config/.Verification
#!/usr/bin/env bash set -euo pipefail make update git diff --check git status --short -- ci-operator/config ci-operator/jobs🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml` around lines 186 - 210, Regenerate the Prow job and metadata artifacts for the new jobs defined at ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml:186-210, ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml:118-132, and ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml:118-132 by running make update; then verify the generated changes with git diff --check and inspect ci-operator/config and ci-operator/jobs.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml`:
- Around line 186-210: Regenerate the Prow job and metadata artifacts for the
new jobs defined at
ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yaml:186-210,
ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yaml:118-132,
and
ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml:118-132
by running make update; then verify the generated changes with git diff --check
and inspect ci-operator/config and ci-operator/jobs.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 5967f0ba-df2d-44b5-8874-638b5f1a4712
📒 Files selected for processing (4)
ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-main.yamlci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-4.23.yamlci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yamlci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.1.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
- ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-5.0.yaml
|
/pj-rehearse periodic-ci-openshift-tls-scanner-main-periodic-tls13-adherence-metal pull-ci-openshift-tls-scanner-release-4.23-tls13-adherence-metal |
|
@richardsonnick: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
The metal rehearsals failed with FailedScheduling (Insufficient cpu): the scanner pod defaulted to a Guaranteed 4 CPU request/limit, which does not fit on the dev-scripts workers. Request 500m/1Gi and keep the 4 CPU/4Gi limit so the pod schedules as Burstable and can still burst. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
/pj-rehearse periodic-ci-openshift-tls-scanner-main-periodic-tls13-adherence-metal pull-ci-openshift-tls-scanner-release-4.23-tls13-adherence-metal |
|
@richardsonnick: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
[REHEARSALNOTIFIER]
A total of 145 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse periodic-ci-openshift-tls-scanner-main-periodic-tls13-adherence-metal |
|
@richardsonnick: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
richardsonnick
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@richardsonnick: This pull request references DPTP-5127 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/pj-rehearse periodic-ci-openshift-tls-scanner-main-periodic-tls13-adherence |
|
/pj-rehearse periodic-ci-openshift-tls-scanner-main-periodic-tls13-adherence |
|
@richardsonnick: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse periodic-ci-openshift-tls-scanner-main-periodic-pqc-readiness-hypershift |
|
@richardsonnick: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@richardsonnick: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command. |
2 similar comments
|
@richardsonnick: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command. |
|
@richardsonnick: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command. |
|
/pj-rehearse periodic-ci-openshift-tls-scanner-main-periodic-pqc-readiness-hypershift |
|
@richardsonnick: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-windows-machine-config-operator-master-tls-scanner |
|
/pj-rehearse pull-ci-openshift-insights-operator-master-tls-scanner |
|
/pj-rehearse periodic-ci-openshift-tls-scanner-main-periodic-tls13-adherence-gcp |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: richardsonnick, smith-xyz The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@richardsonnick: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/pj-rehearse ack |
|
@richardsonnick: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
b49bfb0
into
openshift:main
3 participants
Summary by CodeRabbit
Adds optional TLS 1.3 adherence jobs for Equinix bare-metal OpenShift clusters across releases 4.23, 5.0, 5.1, and the main branch. The jobs use the
baremetalds-e2eworkflow, IPv4 OVN-Kubernetes networking, and runtls-13andtls-scanner-runtests.Adds
dev-scriptsbase image configurations and scanner resource settings for the bare-metal workflows.Updates
tls-scanner-runto load proxy settings from${SHARED_DIR}/proxy-conf.shwhen available. This allows the scanner to use proxy configuration created during installation.