From e26da2df5555d7640b65c38756033810b27d3b06 Mon Sep 17 00:00:00 2001 From: Roman Bednar Date: Mon, 20 Jul 2026 16:36:27 +0200 Subject: [PATCH] Add TLS scanner job to csi-operator for AWS EBS Add an optional, manually-triggered TLS scanner presubmit job (tls-scanner-aws-ebs) to the csi-operator CI configuration for main, release-4.23, release-5.0, and release-5.1 branches. The job reuses the openshift-e2e-aws-csi workflow to provision an AWS cluster with the built-in EBS CSI driver, then overrides the test phase to run tls-scanner-run against the openshift-cluster-csi-drivers namespace. Scanner resources are set to 1 CPU / 1Gi to fit CI cluster node capacity. Triggered via `/test tls-scanner-aws-ebs`. --- .../openshift-csi-operator-main.yaml | 16 ++++ .../openshift-csi-operator-release-4.23.yaml | 16 ++++ .../openshift-csi-operator-release-5.0.yaml | 16 ++++ .../openshift-csi-operator-release-5.1.yaml | 16 ++++ ...penshift-csi-operator-main-presubmits.yaml | 94 +++++++++++++++++++ ...-csi-operator-release-4.23-presubmits.yaml | 94 +++++++++++++++++++ ...t-csi-operator-release-5.0-presubmits.yaml | 94 +++++++++++++++++++ ...t-csi-operator-release-5.1-presubmits.yaml | 94 +++++++++++++++++++ 8 files changed, 440 insertions(+) diff --git a/ci-operator/config/openshift/csi-operator/openshift-csi-operator-main.yaml b/ci-operator/config/openshift/csi-operator/openshift-csi-operator-main.yaml index 14b65b88ba415..a3c8d3f5563c2 100644 --- a/ci-operator/config/openshift/csi-operator/openshift-csi-operator-main.yaml +++ b/ci-operator/config/openshift/csi-operator/openshift-csi-operator-main.yaml @@ -43,6 +43,10 @@ base_images: name: tests-private namespace: ci tag: "4.22" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -167,6 +171,18 @@ tests: steps: cluster_profile: aws-qe workflow: openshift-e2e-aws-csi-extended +- always_run: false + as: tls-scanner-aws-ebs + optional: true + steps: + cluster_profile: openshift-org-aws + env: + SCAN_NAMESPACE: openshift-cluster-csi-drivers + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + test: + - ref: tls-scanner-run + workflow: openshift-e2e-aws-csi - as: aws-efs-operator-e2e steps: cluster_profile: openshift-org-aws diff --git a/ci-operator/config/openshift/csi-operator/openshift-csi-operator-release-4.23.yaml b/ci-operator/config/openshift/csi-operator/openshift-csi-operator-release-4.23.yaml index f1d47db53796d..838135614e998 100644 --- a/ci-operator/config/openshift/csi-operator/openshift-csi-operator-release-4.23.yaml +++ b/ci-operator/config/openshift/csi-operator/openshift-csi-operator-release-4.23.yaml @@ -43,6 +43,10 @@ base_images: name: tests-private namespace: ci tag: "4.22" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -167,6 +171,18 @@ tests: steps: cluster_profile: aws-qe workflow: openshift-e2e-aws-csi-extended +- always_run: false + as: tls-scanner-aws-ebs + optional: true + steps: + cluster_profile: openshift-org-aws + env: + SCAN_NAMESPACE: openshift-cluster-csi-drivers + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + test: + - ref: tls-scanner-run + workflow: openshift-e2e-aws-csi - as: aws-efs-operator-e2e steps: cluster_profile: openshift-org-aws diff --git a/ci-operator/config/openshift/csi-operator/openshift-csi-operator-release-5.0.yaml b/ci-operator/config/openshift/csi-operator/openshift-csi-operator-release-5.0.yaml index fb35dd34a89e1..919315a65c662 100644 --- a/ci-operator/config/openshift/csi-operator/openshift-csi-operator-release-5.0.yaml +++ b/ci-operator/config/openshift/csi-operator/openshift-csi-operator-release-5.0.yaml @@ -43,6 +43,10 @@ base_images: name: tests-private namespace: ci tag: "4.22" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -168,6 +172,18 @@ tests: steps: cluster_profile: aws-qe workflow: openshift-e2e-aws-csi-extended +- always_run: false + as: tls-scanner-aws-ebs + optional: true + steps: + cluster_profile: openshift-org-aws + env: + SCAN_NAMESPACE: openshift-cluster-csi-drivers + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + test: + - ref: tls-scanner-run + workflow: openshift-e2e-aws-csi - as: aws-efs-operator-e2e steps: cluster_profile: openshift-org-aws diff --git a/ci-operator/config/openshift/csi-operator/openshift-csi-operator-release-5.1.yaml b/ci-operator/config/openshift/csi-operator/openshift-csi-operator-release-5.1.yaml index 1bff52d353562..9db0f255e1aa5 100644 --- a/ci-operator/config/openshift/csi-operator/openshift-csi-operator-release-5.1.yaml +++ b/ci-operator/config/openshift/csi-operator/openshift-csi-operator-release-5.1.yaml @@ -43,6 +43,10 @@ base_images: name: tests-private namespace: ci tag: "4.22" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -167,6 +171,18 @@ tests: steps: cluster_profile: aws-qe workflow: openshift-e2e-aws-csi-extended +- always_run: false + as: tls-scanner-aws-ebs + optional: true + steps: + cluster_profile: openshift-org-aws + env: + SCAN_NAMESPACE: openshift-cluster-csi-drivers + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + test: + - ref: tls-scanner-run + workflow: openshift-e2e-aws-csi - as: aws-efs-operator-e2e steps: cluster_profile: openshift-org-aws diff --git a/ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-main-presubmits.yaml b/ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-main-presubmits.yaml index cfdc00ce787df..b8963ca1e8327 100644 --- a/ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-main-presubmits.yaml @@ -4502,6 +4502,100 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )smb-win2022-operator-e2e,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build06 + context: ci/prow/tls-scanner-aws-ebs + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile.aws-ebs + - Dockerfile.aws-efs + - Dockerfile.azure-disk + - Dockerfile.azure-file + - Dockerfile.create_efs + - Dockerfile.gcp-pd + - Dockerfile.openstack-cinder + - Dockerfile.openstack-manila + - Dockerfile.samba + - Dockerfile.test + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-csi-operator-main-tls-scanner-aws-ebs + optional: true + rerun_command: /test tls-scanner-aws-ebs + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-aws-ebs + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-aws-ebs,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-release-4.23-presubmits.yaml b/ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-release-4.23-presubmits.yaml index 3e2cd7a24275d..5416184a6e14a 100644 --- a/ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-release-4.23-presubmits.yaml +++ b/ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-release-4.23-presubmits.yaml @@ -4465,6 +4465,100 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )smb-win2022-operator-e2e,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-4\.23$ + - ^release-4\.23- + cluster: build06 + context: ci/prow/tls-scanner-aws-ebs + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile.aws-ebs + - Dockerfile.aws-efs + - Dockerfile.azure-disk + - Dockerfile.azure-file + - Dockerfile.create_efs + - Dockerfile.gcp-pd + - Dockerfile.openstack-cinder + - Dockerfile.openstack-manila + - Dockerfile.samba + - Dockerfile.test + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-csi-operator-release-4.23-tls-scanner-aws-ebs + optional: true + rerun_command: /test tls-scanner-aws-ebs + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-aws-ebs + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-aws-ebs,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-release-5.0-presubmits.yaml b/ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-release-5.0-presubmits.yaml index 68946f3641906..9579c04140089 100644 --- a/ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-release-5.0-presubmits.yaml +++ b/ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-release-5.0-presubmits.yaml @@ -4464,6 +4464,100 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )smb-win2022-operator-e2e,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-5\.0$ + - ^release-5\.0- + cluster: build05 + context: ci/prow/tls-scanner-aws-ebs + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile.aws-ebs + - Dockerfile.aws-efs + - Dockerfile.azure-disk + - Dockerfile.azure-file + - Dockerfile.create_efs + - Dockerfile.gcp-pd + - Dockerfile.openstack-cinder + - Dockerfile.openstack-manila + - Dockerfile.samba + - Dockerfile.test + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-csi-operator-release-5.0-tls-scanner-aws-ebs + optional: true + rerun_command: /test tls-scanner-aws-ebs + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-aws-ebs + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-aws-ebs,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-release-5.1-presubmits.yaml b/ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-release-5.1-presubmits.yaml index 31b1f89841267..59f71d424f839 100644 --- a/ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-release-5.1-presubmits.yaml +++ b/ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-release-5.1-presubmits.yaml @@ -4347,6 +4347,100 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )smb-win2022-operator-e2e,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-5\.1$ + - ^release-5\.1- + cluster: build05 + context: ci/prow/tls-scanner-aws-ebs + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile.aws-ebs + - Dockerfile.aws-efs + - Dockerfile.azure-disk + - Dockerfile.azure-file + - Dockerfile.create_efs + - Dockerfile.gcp-pd + - Dockerfile.openstack-cinder + - Dockerfile.openstack-manila + - Dockerfile.samba + - Dockerfile.test + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-csi-operator-release-5.1-tls-scanner-aws-ebs + optional: true + rerun_command: /test tls-scanner-aws-ebs + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-aws-ebs + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-aws-ebs,?($|\s.*) - agent: kubernetes always_run: true branches: