STOR-2954: Add TLS scanner job for SMB CSI driver operator

[RomanBednar]

Add a TLS scanner CI job for the SMB CSI driver operator to verify TLS compliance.

Summary by CodeRabbit

Adds an optional manual tls-scanner-smb CI job for the SMB CSI driver operator across main and release 4.23–5.1 branches. The new Azure-based job wires in the existing SMB E2E workflow and the tls-scanner-tool image to scan the openshift-cluster-csi-drivers namespace, with SMB CSI operator installation settings, scanner resource sizing, TLS 1.3 adherence options (where applicable), and execution gated by Samba controller/node service availability. Presubmit/job configurations are generated as part of this change; no csi-operator code is modified.

[openshift-ci-robot]

@RomanBednar: This pull request references STOR-2954 which is a valid jira issue.

Details

In response to this:

Summary

Add a TLS scanner CI job for the SMB CSI driver operator to verify TLS compliance. The job follows the OLM-managed operator pattern established by PR #81917 (GCP Filestore) and PR #82134 (AWS EBS).

Changes

• Added tls-scanner-tool base image reference to csi-operator configs
• Added tls-scanner-smb test definition to configs for main, release-4.23, release-5.0, release-5.1
• Generated presubmit job files via make ci-operator-prowgen

TLS Adherence Evaluation

The SMB operator in openshift/csi-operator already has TLS adherence through:

1. WithCSIConfigObserverController from library-go — watches cluster API server TLS profile
2. kube-rbac-proxy sidecars with ${TLS_CIPHER_SUITES} and ${TLS_MIN_VERSION} template variables
3. CSV annotation features.operators.openshift.io/tls-profiles: "true"

No csi-operator code changes are needed. This scanner job verifies the existing TLS implementation.

Job Details

• Test name: tls-scanner-smb (triggered via /test tls-scanner-smb)
• Manual only: always_run: false, optional: true
• Cloud profile: openshift-org-azure
• Workflow: openshift-e2e-azure-csi-smb (existing SMB e2e workflow)
• Scan namespace: openshift-cluster-csi-drivers

Related PRs

• STOR-2954, CNTRLPLANE-3625: Inject TLS from CVO to operators, update hypershift TLS based on CVO cluster-storage-operator#712 — TLS adherence pattern for CSI operators
• STOR-3001: Add TLS scanner job to gcp-filestore-csi-driver-operator #81917 — TLS scanner for GCP Filestore (OLM pattern template)
• Add TLS scanner job to csi-operator for AWS EBS #82134 — TLS scanner for AWS EBS in csi-operator

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Adds the tls-scanner-tool base image and optional tls-scanner-smb E2E jobs to the main, 4.23, 5.0, and 5.1 CSI operator configurations.

Changes

TLS scanner SMB pipeline

Layer / File(s)	Summary
TLS scanner image registration ci-operator/config/openshift/csi-operator/openshift-csi-operator-release-5.0.yaml	Defines the tls-scanner-tool base image for TLS scanner usage.
SMB scanner job wiring ci-operator/config/openshift/csi-operator/openshift-csi-operator-main.yaml, ...release-4.23.yaml, ...release-5.0.yaml, ...release-5.1.yaml	Adds optional tls-scanner-smb jobs with SMB CSI operator settings, scanner resources, TLS 1.3 adherence settings, Samba availability conditions, and the Azure SMB workflow.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CI as ci-operator
  participant Operator as SMB CSI operator
  participant Services as Samba services
  participant Scanner as TLS scanner workflow
  CI->>Operator: Install SMB operator bundle
  Operator->>Services: Start controller and node services
  CI->>Services: Check service availability
  CI->>Scanner: Run tls-13 and tls-scanner-run

Loading

Possibly related PRs

• openshift/release#82134: Adds a related TLS scanner CSI E2E job using the shared scanner test reference.
• openshift/release#82216: Wires shared TLS scanner tooling into another operator workflow.
• openshift/release#82232: Adds related TLS scanner image and test references to CI operator configuration.

Suggested labels: rehearsals-ack

Suggested reviewers: gnufied, dfajmon

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding a TLS scanner job for the SMB CSI driver operator.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The PR only adds static ci-operator job/config YAML; no Ginkgo It/Describe titles were added, and tls-scanner-smb is a fixed string.
Test Structure And Quality	✅ Passed	PR only changes ci-operator YAML job configs; no Ginkgo test code, assertions, or cluster-resource test logic to review.
Microshift Test Compatibility	✅ Passed	PR only adds ci-operator YAML job configs and generated presubmits; no new Go/Ginkgo test code or test bodies were added to evaluate for MicroShift.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only adds ci-operator job/config YAML; no new Ginkgo specs or test bodies were introduced, so there are no new SNO assumptions to check.
Topology-Aware Scheduling Compatibility	✅ Passed	Only CI presubmit config changed; no manifests/controllers or topology-sensitive scheduling fields were added, and the new job reuses existing Azure SMB workflow/test refs.
Ote Binary Stdout Contract	✅ Passed	Only ci-operator YAML was changed; no OTE binary entrypoints or stdout writes were modified.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only CI config/job entries were added; no Ginkgo test code, hardcoded IPv4 literals, or external-host dependencies were introduced.
No-Weak-Crypto	✅ Passed	No weak-crypto algorithms, custom crypto, or secret comparisons were added; the patch only wires CI YAML for the tls-scanner SMB job.
Container-Privileges	✅ Passed	New tls-scanner-smb job blocks only set env, deps, test refs, and workflow; no privileged/host*/SYS_ADMIN/allowPrivilegeEscalation settings appear.
No-Sensitive-Data-In-Logs	✅ Passed	Only CI job YAML was added; no logging/echo/debug statements or hardcoded secrets, tokens, PII, or hostnames were introduced.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: RomanBednar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/csi-operator/OWNERS [RomanBednar]
• ci-operator/jobs/openshift/csi-operator/OWNERS [RomanBednar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[RomanBednar]

/pj-rehearse pull-ci-openshift-csi-operator-main-tls-scanner-smb

[openshift-merge-bot]

@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[RomanBednar]

/pj-rehearse pull-ci-openshift-csi-operator-release-4.23-tls-scanner-smb

[openshift-merge-bot]

@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[RomanBednar]

/pj-rehearse pull-ci-openshift-csi-operator-main-tls-scanner-smb

[RomanBednar]

/pj-rehearse pull-ci-openshift-csi-operator-release-4.23-tls-scanner-smb

[openshift-merge-bot]

@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

@RomanBednar, pj-rehearse: unable prepare a candidate for rehearsal; rehearsals will not be run. This could be due to a branch that needs to be rebased. ERROR:

couldn't rebase candidate onto 1378dadf0fddd531c65186b27184032559949ffc due to conflicts

[RomanBednar]

/pj-rehearse pull-ci-openshift-csi-operator-main-tls-scanner-smb pull-ci-openshift-csi-operator-release-4.23-tls-scanner-smb

[openshift-merge-bot]

@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[RomanBednar]

/pj-rehearse pull-ci-openshift-csi-operator-main-tls-scanner-smb pull-ci-openshift-csi-operator-release-4.23-tls-scanner-smb

[openshift-merge-bot]

@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@RomanBednar: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-csi-operator-main-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed
pull-ci-openshift-csi-operator-release-4.23-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed
pull-ci-openshift-csi-operator-release-5.0-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed
pull-ci-openshift-csi-operator-release-5.1-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@RomanBednar: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-csi-operator-main-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed
pull-ci-openshift-csi-operator-release-4.23-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed
pull-ci-openshift-csi-operator-release-5.0-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed
pull-ci-openshift-csi-operator-release-5.1-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@RomanBednar: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/openshift/csi-operator/main/tls-scanner-smb	ce7560a	link	unknown	/pj-rehearse pull-ci-openshift-csi-operator-main-tls-scanner-smb
ci/rehearse/openshift/csi-operator/release-4.23/tls-scanner-smb	ce7560a	link	unknown	/pj-rehearse pull-ci-openshift-csi-operator-release-4.23-tls-scanner-smb

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.