Skip to content

STOR-3001: add TLS scanner for vsphere problem detector - #82214

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
dfajmon:STOR-3001-tls-scanner-vsphere-problem-detector
Jul 28, 2026
Merged

STOR-3001: add TLS scanner for vsphere problem detector#82214
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
dfajmon:STOR-3001-tls-scanner-vsphere-problem-detector

Conversation

@dfajmon

@dfajmon dfajmon commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Add a TLS scanner CI job for the vsphere problem detector to verify TLS compliance.

Summary by CodeRabbit

Adds optional TLS compliance scanner coverage to the OpenShift CI configuration for the vSphere Problem Detector across the main, release-4.23, release-5.0, and release-5.1 streams.

  • Registers a new tls-scanner-tool base image (tls-scanner image in the tls-scanner namespace).
  • Introduces an optional tls-scanner-vsphere-problem-detector test workflow for the vsphere-elastic cluster profile that runs via the ipi-vsphere workflow.
  • The workflow executes the tls-13 and tls-scanner-run refs with TLS 1.3 adherence enabled (TLS_13_ENABLE_TLS_ADHERENCE: "true", TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents) and configures scanning for openshift-cluster-storage-operator (1 CPU, 1Gi memory).

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 21, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

@dfajmon: This pull request references STOR-3001 which is a valid jira issue.

Details

In response to this:

Add a TLS scanner CI job for the vsphere problem detector to verify TLS compliance.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
openshift-ci Bot requested review from RomanBednar and jsafrane July 21, 2026 12:28
@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 21, 2026
@coderabbitai

coderabbitai Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 33bd9e51-489e-4453-9583-ff340ebfe3f8

📥 Commits

Reviewing files that changed from the base of the PR and between 7ffbd67 and 88c905b.

⛔ Files ignored due to path filters (4)
  • ci-operator/jobs/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-main-presubmits.yaml is excluded by !ci-operator/jobs/**
  • ci-operator/jobs/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-release-4.23-presubmits.yaml is excluded by !ci-operator/jobs/**
  • ci-operator/jobs/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-release-5.0-presubmits.yaml is excluded by !ci-operator/jobs/**
  • ci-operator/jobs/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-release-5.1-presubmits.yaml is excluded by !ci-operator/jobs/**
📒 Files selected for processing (4)
  • ci-operator/config/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-main.yaml
  • ci-operator/config/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-release-4.23.yaml
  • ci-operator/config/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-release-5.0.yaml
  • ci-operator/config/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-release-5.1.yaml

Walkthrough

The vSphere Problem Detector CI configurations register the tls-scanner-tool image and add one optional TLS 1.3 adherence scanning workflow for the main configuration and releases 4.23, 5.0, and 5.1.

Changes

vSphere TLS scanner integration

Layer / File(s) Summary
TLS scanner image registration
ci-operator/config/openshift/vsphere-problem-detector/*
Adds the tls-scanner-tool base image from the tls-scanner namespace.
TLS scanning workflow wiring
ci-operator/config/openshift/vsphere-problem-detector/*
Adds optional tls-scanner-vsphere-problem-detector tests using vsphere-elastic, ipi-vsphere, scanner settings, TLS 1.3 adherence variables, and the tls-13 and tls-scanner-run test refs.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

Suggested reviewers: jsafrane, romanbednar

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: adding TLS scanner CI jobs for the vSphere problem detector.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed Only CI YAML/job configs changed; the new TLS scanner job/test names are static and no Ginkgo titles were added or modified.
Test Structure And Quality ✅ Passed PR only changes CI config/job YAMLs; no Ginkgo test code, assertions, setup/cleanup, or timeout logic was modified.
Microshift Test Compatibility ✅ Passed Only CI job YAML changed; no new Ginkgo tests or test bodies were added to assess for MicroShift compatibility.
Single Node Openshift (Sno) Test Compatibility ✅ Passed Only CI/job YAML changed; no Ginkgo test code or It/Describe/Context additions were added, so no SNO-specific test risk appears.
Topology-Aware Scheduling Compatibility ✅ Passed The PR only adds CI config and presubmit job files; no deployment manifests, controllers, or scheduling constraints were introduced.
Ote Binary Stdout Contract ✅ Passed Only ci-operator YAML/job config changed; no process-level code or stdout-writing paths like main/TestMain/BeforeSuite were touched.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed Commit only adds CI job/config YAML for tls-scanner; no new Ginkgo tests or IP/network logic were introduced.
No-Weak-Crypto ✅ Passed The PR only adds TLS-scanner CI config; the touched YAML contains no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or custom comparison logic.
Container-Privileges ✅ Passed The changed CI YAMLs contain no privileged, hostPID/Network/IPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs ✅ Passed PR only adds CI YAML for a TLS scanner job; no new log/print commands or sensitive literals were introduced.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@dfajmon

dfajmon commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-vsphere-problem-detector-main-tls-scanner-modern-profile-vsphere-problem-detector

@dfajmon

dfajmon commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-vsphere-problem-detector-main-tls-scanner-vsphere-problem-detector

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

1 similar comment
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@dfajmon

dfajmon commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@dfajmon

dfajmon commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-vsphere-problem-detector-main-tls-scanner-modern-profile-vsphere-problem-detector

@dfajmon

dfajmon commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-vsphere-problem-detector-main-tls-scanner-vsphere-problem-detector

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

1 similar comment
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@dfajmon

dfajmon commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-vsphere-problem-detector-main-tls-scanner-vsphere-problem-detector

@dfajmon

dfajmon commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-vsphere-problem-detector-main-tls-scanner-modern-profile-vsphere-problem-detector

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

1 similar comment
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@dfajmon
dfajmon force-pushed the STOR-3001-tls-scanner-vsphere-problem-detector branch from a06d6b3 to d03f3bb Compare July 22, 2026 06:17
@dfajmon

dfajmon commented Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-vsphere-problem-detector-main-tls-scanner-modern-profile-vsphere-problem-detector

@dfajmon

dfajmon commented Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-vsphere-problem-detector-main-tls-scanner-vsphere-problem-detector

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

1 similar comment
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@dfajmon
dfajmon force-pushed the STOR-3001-tls-scanner-vsphere-problem-detector branch from d03f3bb to d5c4a8f Compare July 22, 2026 09:26
@dfajmon

dfajmon commented Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-vsphere-problem-detector-main-tls-scanner-modern-profile-vsphere-problem-detector

@dfajmon

dfajmon commented Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-vsphere-problem-detector-main-tls-scanner-vsphere-problem-detector

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@dfajmon
dfajmon force-pushed the STOR-3001-tls-scanner-vsphere-problem-detector branch from d5c4a8f to 7ffbd67 Compare July 22, 2026 09:56
@dfajmon

dfajmon commented Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-vsphere-problem-detector-main-tls-scanner-vsphere-problem-detector

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@dfajmon

dfajmon commented Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-vsphere-problem-detector-main-tls-scanner-modern-profile-vsphere-problem-detector

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@dfajmon
dfajmon force-pushed the STOR-3001-tls-scanner-vsphere-problem-detector branch from 7ffbd67 to 88c905b Compare July 22, 2026 12:09
@dfajmon

dfajmon commented Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-vsphere-problem-detector-main-tls-scanner-vsphere-problem-detector

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@dfajmon: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
pull-ci-openshift-vsphere-problem-detector-main-tls-scanner-vsphere-problem-detector openshift/vsphere-problem-detector presubmit Presubmit changed
pull-ci-openshift-vsphere-problem-detector-release-4.23-tls-scanner-vsphere-problem-detector openshift/vsphere-problem-detector presubmit Presubmit changed
pull-ci-openshift-vsphere-problem-detector-release-5.0-tls-scanner-vsphere-problem-detector openshift/vsphere-problem-detector presubmit Presubmit changed
pull-ci-openshift-vsphere-problem-detector-release-5.1-tls-scanner-vsphere-problem-detector openshift/vsphere-problem-detector presubmit Presubmit changed
pull-ci-openshift-vsphere-problem-detector-main-e2e-vsphere openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-main-e2e-vsphere-csi-extended openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-main-e2e-vsphere-host-groups-ovn-techpreview openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-main-e2e-vsphere-zones openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-main-images openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-main-okd-scos-e2e-aws-ovn openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-main-okd-scos-images openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-main-security openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-main-unit openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-main-verify openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-main-verify-deps openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-release-4.23-e2e-vsphere openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-release-4.23-e2e-vsphere-csi-extended openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-release-4.23-e2e-vsphere-host-groups-ovn-techpreview openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-release-4.23-e2e-vsphere-zones openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-release-4.23-images openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-release-4.23-security openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-release-4.23-unit openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-release-4.23-verify openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-release-4.23-verify-deps openshift/vsphere-problem-detector presubmit Ci-operator config changed
pull-ci-openshift-vsphere-problem-detector-release-5.1-e2e-vsphere openshift/vsphere-problem-detector presubmit Ci-operator config changed

A total of 42 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs.

A full list of affected jobs can be found here

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@RomanBednar

Copy link
Copy Markdown
Contributor

/pj-rehearse pull-ci-openshift-vsphere-problem-detector-release-4.23-tls-scanner-vsphere-problem-detector

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@RomanBednar

Copy link
Copy Markdown
Contributor

/lgtm

After the jobs fail successfully you can ack the rehearsals and the PR will merge.

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 22, 2026
@openshift-ci

openshift-ci Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dfajmon, RomanBednar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@dfajmon

dfajmon commented Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-vsphere-problem-detector-main-tls-scanner-vsphere-problem-detector

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-ci

openshift-ci Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

@dfajmon: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/rehearse/openshift/vsphere-problem-detector/release-4.23/tls-scanner-vsphere-problem-detector 88c905b link unknown /pj-rehearse pull-ci-openshift-vsphere-problem-detector-release-4.23-tls-scanner-vsphere-problem-detector
ci/rehearse/openshift/vsphere-problem-detector/main/tls-scanner-vsphere-problem-detector 88c905b link unknown /pj-rehearse pull-ci-openshift-vsphere-problem-detector-main-tls-scanner-vsphere-problem-detector

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@dfajmon

dfajmon commented Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse ack
failing rehearse is expected

@dfajmon

dfajmon commented Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse ack

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: your /pj-rehearse request was not processed because the request waited in queue for longer than 5 minutes. Please retry in a few minutes.

1 similar comment
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: your /pj-rehearse request was not processed because the request waited in queue for longer than 5 minutes. Please retry in a few minutes.

@dfajmon

dfajmon commented Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse ack

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: your /pj-rehearse request was not processed because the request waited in queue for longer than 5 minutes. Please retry in a few minutes.

@dfajmon

dfajmon commented Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

/pj-rehearse ack

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@dfajmon: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Jul 28, 2026
@openshift-merge-bot
openshift-merge-bot Bot merged commit e1b1080 into openshift:main Jul 28, 2026
16 of 18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. rehearsals-ack Signifies that rehearsal jobs have been acknowledged

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants