STOR-2954: Add TLS scanner job for SMB CSI driver operator by RomanBednar · Pull Request #82204 · openshift/release

RomanBednar · 2026-07-21T09:19:35Z

Add a TLS scanner CI job for the SMB CSI driver operator to verify TLS compliance.

Summary by CodeRabbit

Adds an optional manual tls-scanner-smb CI job for the SMB CSI driver operator across main and release 4.23–5.1 branches. The new Azure-based job wires in the existing SMB E2E workflow and the tls-scanner-tool image to scan the openshift-cluster-csi-drivers namespace, with SMB CSI operator installation settings, scanner resource sizing, TLS 1.3 adherence options (where applicable), and execution gated by Samba controller/node service availability. Presubmit/job configurations are generated as part of this change; no csi-operator code is modified.

openshift-ci-robot · 2026-07-21T09:19:40Z

@RomanBednar: This pull request references STOR-2954 which is a valid jira issue.

Details

In response to this:

Summary

Add a TLS scanner CI job for the SMB CSI driver operator to verify TLS compliance. The job follows the OLM-managed operator pattern established by PR #81917 (GCP Filestore) and PR #82134 (AWS EBS).

Changes

Added tls-scanner-tool base image reference to csi-operator configs

Added tls-scanner-smb test definition to configs for main, release-4.23, release-5.0, release-5.1

Generated presubmit job files via make ci-operator-prowgen

TLS Adherence Evaluation

The SMB operator in openshift/csi-operator already has TLS adherence through:

WithCSIConfigObserverController from library-go — watches cluster API server TLS profile

kube-rbac-proxy sidecars with ${TLS_CIPHER_SUITES} and ${TLS_MIN_VERSION} template variables

CSV annotation features.operators.openshift.io/tls-profiles: "true"

No csi-operator code changes are needed. This scanner job verifies the existing TLS implementation.

Job Details

Test name: tls-scanner-smb (triggered via /test tls-scanner-smb)

Manual only: always_run: false, optional: true

Cloud profile: openshift-org-azure

Workflow: openshift-e2e-azure-csi-smb (existing SMB e2e workflow)

Scan namespace: openshift-cluster-csi-drivers

Related PRs

STOR-2954, CNTRLPLANE-3625: Inject TLS from CVO to operators, update hypershift TLS based on CVO cluster-storage-operator#712 — TLS adherence pattern for CSI operators

STOR-3001: Add TLS scanner job to gcp-filestore-csi-driver-operator #81917 — TLS scanner for GCP Filestore (OLM pattern template)

Add TLS scanner job to csi-operator for AWS EBS #82134 — TLS scanner for AWS EBS in csi-operator

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-07-21T09:20:06Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

Walkthrough

Adds the tls-scanner-tool base image and optional tls-scanner-smb E2E jobs to the main, 4.23, 5.0, and 5.1 CSI operator configurations.

Changes

TLS scanner SMB pipeline

Layer / File(s)	Summary
TLS scanner image registration `ci-operator/config/openshift/csi-operator/openshift-csi-operator-release-5.0.yaml`	Defines the `tls-scanner-tool` base image for TLS scanner usage.
SMB scanner job wiring `ci-operator/config/openshift/csi-operator/openshift-csi-operator-main.yaml`, `...release-4.23.yaml`, `...release-5.0.yaml`, `...release-5.1.yaml`	Adds optional `tls-scanner-smb` jobs with SMB CSI operator settings, scanner resources, TLS 1.3 adherence settings, Samba availability conditions, and the Azure SMB workflow.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CI as ci-operator
  participant Operator as SMB CSI operator
  participant Services as Samba services
  participant Scanner as TLS scanner workflow
  CI->>Operator: Install SMB operator bundle
  Operator->>Services: Start controller and node services
  CI->>Services: Check service availability
  CI->>Scanner: Run tls-13 and tls-scanner-run

Possibly related PRs

openshift/release#82134: Adds a related TLS scanner CSI E2E job using the shared scanner test reference.
openshift/release#82216: Wires shared TLS scanner tooling into another operator workflow.
openshift/release#82232: Adds related TLS scanner image and test references to CI operator configuration.

Suggested labels: rehearsals-ack

Suggested reviewers: gnufied, dfajmon

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding a TLS scanner job for the SMB CSI driver operator.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The PR only adds static ci-operator job/config YAML; no Ginkgo It/Describe titles were added, and tls-scanner-smb is a fixed string.
Test Structure And Quality	✅ Passed	PR only changes ci-operator YAML job configs; no Ginkgo test code, assertions, or cluster-resource test logic to review.
Microshift Test Compatibility	✅ Passed	PR only adds ci-operator YAML job configs and generated presubmits; no new Go/Ginkgo test code or test bodies were added to evaluate for MicroShift.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only adds ci-operator job/config YAML; no new Ginkgo specs or test bodies were introduced, so there are no new SNO assumptions to check.
Topology-Aware Scheduling Compatibility	✅ Passed	Only CI presubmit config changed; no manifests/controllers or topology-sensitive scheduling fields were added, and the new job reuses existing Azure SMB workflow/test refs.
Ote Binary Stdout Contract	✅ Passed	Only ci-operator YAML was changed; no OTE binary entrypoints or stdout writes were modified.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only CI config/job entries were added; no Ginkgo test code, hardcoded IPv4 literals, or external-host dependencies were introduced.
No-Weak-Crypto	✅ Passed	No weak-crypto algorithms, custom crypto, or secret comparisons were added; the patch only wires CI YAML for the tls-scanner SMB job.
Container-Privileges	✅ Passed	New tls-scanner-smb job blocks only set env, deps, test refs, and workflow; no privileged/host*/SYS_ADMIN/allowPrivilegeEscalation settings appear.
No-Sensitive-Data-In-Logs	✅ Passed	Only CI job YAML was added; no logging/echo/debug statements or hardcoded secrets, tokens, PII, or hostnames were introduced.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci · 2026-07-21T09:20:23Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: RomanBednar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~ci-operator/config/openshift/csi-operator/OWNERS~~ [RomanBednar]
~~ci-operator/jobs/openshift/csi-operator/OWNERS~~ [RomanBednar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

RomanBednar · 2026-07-21T09:42:37Z

/pj-rehearse pull-ci-openshift-csi-operator-main-tls-scanner-smb

openshift-merge-bot · 2026-07-21T09:42:40Z

@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

RomanBednar · 2026-07-21T09:42:51Z

/pj-rehearse pull-ci-openshift-csi-operator-release-4.23-tls-scanner-smb

openshift-merge-bot · 2026-07-21T09:42:55Z

@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

RomanBednar · 2026-07-21T09:53:27Z

/pj-rehearse pull-ci-openshift-csi-operator-main-tls-scanner-smb

RomanBednar · 2026-07-21T09:53:34Z

/pj-rehearse pull-ci-openshift-csi-operator-release-4.23-tls-scanner-smb

openshift-merge-bot · 2026-07-21T09:54:10Z

@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-merge-bot · 2026-07-21T09:57:47Z

@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-merge-bot · 2026-07-21T09:58:04Z

@RomanBednar, pj-rehearse: unable prepare a candidate for rehearsal; rehearsals will not be run. This could be due to a branch that needs to be rebased. ERROR:

couldn't rebase candidate onto 1378dadf0fddd531c65186b27184032559949ffc due to conflicts

RomanBednar · 2026-07-21T10:11:36Z

/pj-rehearse pull-ci-openshift-csi-operator-main-tls-scanner-smb pull-ci-openshift-csi-operator-release-4.23-tls-scanner-smb

openshift-merge-bot · 2026-07-21T10:11:39Z

@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

RomanBednar · 2026-07-22T06:22:39Z

/pj-rehearse pull-ci-openshift-csi-operator-main-tls-scanner-smb pull-ci-openshift-csi-operator-release-4.23-tls-scanner-smb

openshift-merge-bot · 2026-07-22T06:22:43Z

@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-merge-bot · 2026-07-22T06:23:42Z

[REHEARSALNOTIFIER]
@RomanBednar: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-csi-operator-main-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed
pull-ci-openshift-csi-operator-release-4.23-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed
pull-ci-openshift-csi-operator-release-5.0-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed
pull-ci-openshift-csi-operator-release-5.1-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

openshift-merge-bot · 2026-07-22T06:26:30Z

[REHEARSALNOTIFIER]
@RomanBednar: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-csi-operator-main-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed
pull-ci-openshift-csi-operator-release-4.23-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed
pull-ci-openshift-csi-operator-release-5.0-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed
pull-ci-openshift-csi-operator-release-5.1-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

openshift-ci · 2026-07-22T09:22:18Z

@RomanBednar: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/openshift/csi-operator/main/tls-scanner-smb	`ce7560a`	link	unknown	`/pj-rehearse pull-ci-openshift-csi-operator-main-tls-scanner-smb`
ci/rehearse/openshift/csi-operator/release-4.23/tls-scanner-smb	`ce7560a`	link	unknown	`/pj-rehearse pull-ci-openshift-csi-operator-release-4.23-tls-scanner-smb`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 21, 2026

openshift-ci Bot requested review from dfajmon and gnufied July 21, 2026 09:20

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 21, 2026

RomanBednar force-pushed the feat/smb-tls-scanner branch from 5528a03 to eab25be Compare July 21, 2026 09:37

RomanBednar force-pushed the feat/smb-tls-scanner branch from eab25be to b85491b Compare July 21, 2026 09:52

RomanBednar force-pushed the feat/smb-tls-scanner branch from b85491b to ef37309 Compare July 21, 2026 10:10

This was referenced Jul 21, 2026

STOR-3001: add TLS scanner for vsphere problem detector #82214

Merged

AUTOSCALE-893: implement tls-scanner for cluster-autoscaler-operator #82216

Merged

AUTOSCALE-891: VPA: Add PQC ML-KEM CI test #82247

Merged

RomanBednar force-pushed the feat/smb-tls-scanner branch from ef37309 to a74c9ad Compare July 22, 2026 06:20

Add TLS scanner job to csi-operator for SMB

ce7560a

RomanBednar force-pushed the feat/smb-tls-scanner branch from a74c9ad to ce7560a Compare July 22, 2026 06:22

coderabbitai Bot mentioned this pull request Jul 22, 2026

Add TLS 1.3 adherence parameters to csi-operator TLS scanner job #82133

Open

Uh oh!

Conversation

RomanBednar commented Jul 21, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Jul 21, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

TLS Adherence Evaluation

Job Details

Related PRs

Uh oh!

coderabbitai Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

openshift-ci Bot commented Jul 21, 2026

Uh oh!

RomanBednar commented Jul 21, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 21, 2026

Uh oh!

RomanBednar commented Jul 21, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 21, 2026

Uh oh!

RomanBednar commented Jul 21, 2026

Uh oh!

RomanBednar commented Jul 21, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 21, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 21, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 21, 2026

Uh oh!

RomanBednar commented Jul 21, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 21, 2026

Uh oh!

RomanBednar commented Jul 22, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 22, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 22, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 22, 2026

Uh oh!

openshift-ci Bot commented Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

RomanBednar commented Jul 21, 2026 •

edited by coderabbitai Bot

Loading

openshift-ci-robot commented Jul 21, 2026 •

edited by atlassian Bot

Loading

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading