Skip to content

AUTOSCALE-891: VPA: Add PQC ML-KEM CI test - #82247

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
shyadav10:vpa_tls
Jul 22, 2026
Merged

AUTOSCALE-891: VPA: Add PQC ML-KEM CI test#82247
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
shyadav10:vpa_tls

Conversation

@shyadav10

@shyadav10 shyadav10 commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Jira link: https://redhat.atlassian.net/browse/AUTOSCALE-891

Summary by CodeRabbit

  • Adds a TLS scanner build image and CI step to the OpenShift Vertical Pod Autoscaler operator’s AWS OLM end-to-end workflow.
  • Configures the scanner to run PQC ML-KEM checks with dedicated namespace and resource settings.

@coderabbitai

coderabbitai Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Walkthrough

The VPA operator CI configuration adds a tls-scanner-tool base image and enables the tls-scanner-run step in the e2e-aws-olm workflow with PQC, namespace, CPU, and memory settings.

Changes

TLS scanner CI integration

Layer / File(s) Summary
Add TLS scanner to AWS OLM workflow
ci-operator/config/openshift/vertical-pod-autoscaler-operator/...yaml
Adds the TLS scanner base image, scanner environment variables, and tls-scanner-run workflow step.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

Suggested labels: jira/valid-reference

Suggested reviewers: theobarberbany


Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name Status Explanation Resolution
Container-Privileges ❌ Error The added tls-scanner-run step creates a pod with privileged: true, hostNetwork: true, hostPID: true, and runAsUser: 0 in the default path. Remove or replace the step with a restricted scan path, then regenerate the ci-operator jobs so no added pod requests privileged, hostNetwork, or hostPID.
✅ Passed checks (14 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed Only ci-operator YAML changed; it adds a tls-scanner step/env and no Ginkgo titles or test names were added or modified.
Test Structure And Quality ✅ Passed Only ci-operator YAML changed; no Ginkgo test code was added or modified, so the test-structure checklist is not applicable.
Microshift Test Compatibility ✅ Passed PASS: The PR only changes ci-operator YAML to add a tls-scanner step; no new Ginkgo test code or MicroShift-sensitive APIs were added.
Single Node Openshift (Sno) Test Compatibility ✅ Passed PASS: PR adds a tls-scanner step, not a Ginkgo e2e test. The step scans pods/namespaces and has no multi-node or HA assumptions.
Topology-Aware Scheduling Compatibility ✅ Passed The PR only adds a CI test step/reference; the tls-scanner pod uses default scheduling and no node selectors, anti-affinity, spread constraints, or topology checks.
Ote Binary Stdout Contract ✅ Passed This PR only changes ci-operator YAML to add tls-scanner steps; no process-level code, suite setup, or stdout-writing binaries were modified.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The PR only wires in the existing tls-scanner CI step; no new Ginkgo test code, no hardcoded IPv4/host parsing, and scans cluster-internal targets via KUBECONFIG.
No-Weak-Crypto ✅ Passed Patch only adds tls-scanner-run env/step wiring; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons appear.
No-Sensitive-Data-In-Logs ✅ Passed The new tls-scanner step only logs non-sensitive values (cluster label, namespace filter, KUBECONFIG path, image, status); no passwords, tokens, PII, or hostnames found.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the change: adding a PQC ML-KEM CI test for VPA.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@openshift-ci
openshift-ci Bot requested review from jkyros and wangchen615 July 21, 2026 17:30
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@shyadav10: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
pull-ci-openshift-vertical-pod-autoscaler-operator-main-ci-bundle-vertical-pod-autoscaler-operator-bundle openshift/vertical-pod-autoscaler-operator presubmit Ci-operator config changed
pull-ci-openshift-vertical-pod-autoscaler-operator-main-e2e-aws-olm openshift/vertical-pod-autoscaler-operator presubmit Ci-operator config changed
pull-ci-openshift-vertical-pod-autoscaler-operator-main-e2e-aws-operator openshift/vertical-pod-autoscaler-operator presubmit Ci-operator config changed
pull-ci-openshift-vertical-pod-autoscaler-operator-main-e2e-aws-operator-actuation openshift/vertical-pod-autoscaler-operator presubmit Ci-operator config changed
pull-ci-openshift-vertical-pod-autoscaler-operator-main-e2e-aws-operator-components openshift/vertical-pod-autoscaler-operator presubmit Ci-operator config changed
pull-ci-openshift-vertical-pod-autoscaler-operator-main-e2e-aws-upgrade openshift/vertical-pod-autoscaler-operator presubmit Ci-operator config changed
pull-ci-openshift-vertical-pod-autoscaler-operator-main-ensure-commands-are-noops openshift/vertical-pod-autoscaler-operator presubmit Ci-operator config changed
pull-ci-openshift-vertical-pod-autoscaler-operator-main-images openshift/vertical-pod-autoscaler-operator presubmit Ci-operator config changed
pull-ci-openshift-vertical-pod-autoscaler-operator-main-lint openshift/vertical-pod-autoscaler-operator presubmit Ci-operator config changed
pull-ci-openshift-vertical-pod-autoscaler-operator-main-manifest-diff openshift/vertical-pod-autoscaler-operator presubmit Ci-operator config changed
pull-ci-openshift-vertical-pod-autoscaler-operator-main-scorecard openshift/vertical-pod-autoscaler-operator presubmit Ci-operator config changed
pull-ci-openshift-vertical-pod-autoscaler-operator-main-security openshift/vertical-pod-autoscaler-operator presubmit Ci-operator config changed
pull-ci-openshift-vertical-pod-autoscaler-operator-main-unit openshift/vertical-pod-autoscaler-operator presubmit Ci-operator config changed
pull-ci-openshift-vertical-pod-autoscaler-operator-main-verify-deps openshift/vertical-pod-autoscaler-operator presubmit Ci-operator config changed
pull-ci-openshift-vertical-pod-autoscaler-operator-main-yamllint openshift/vertical-pod-autoscaler-operator presubmit Ci-operator config changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@ci-operator/config/openshift/vertical-pod-autoscaler-operator/openshift-vertical-pod-autoscaler-operator-main.yaml`:
- Line 168: Regenerate the Prow job files affected by the tls-scanner-run entry
in the ci-operator configuration by running make update, ensuring the generated
files under ci-operator/jobs/openshift/vertical-pod-autoscaler-operator/ are
synchronized.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 7d14e175-272a-4cb4-b66f-184fc02fbc06

📥 Commits

Reviewing files that changed from the base of the PR and between 41cd60b and 1b830f1.

📒 Files selected for processing (1)
  • ci-operator/config/openshift/vertical-pod-autoscaler-operator/openshift-vertical-pod-autoscaler-operator-main.yaml

resources:
requests:
cpu: 100m
- ref: tls-scanner-run

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== file context =="
sed -n '140,200p' ci-operator/config/openshift/vertical-pod-autoscaler-operator/openshift-vertical-pod-autoscaler-operator-main.yaml

echo
echo "== relevant make targets / docs =="
rg -n "make update|ci-operator-config|jobs|registry-metadata|zz_generated_metadata|ci-operator/config/" Makefile .github . 2>/dev/null | head -n 200

echo
echo "== generated artifacts for this config =="
fd -a 'openshift-vertical-pod-autoscaler-operator-main.*' ci-operator/config/openshift/vertical-pod-autoscaler-operator 2>/dev/null || true
fd -a 'zz_generated_metadata*' ci-operator/config/openshift/vertical-pod-autoscaler-operator 2>/dev/null || true

echo
echo "== git status summary =="
git status --short

Repository: openshift/release

Length of output: 27173


🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo_dir='ci-operator/config/openshift/vertical-pod-autoscaler-operator'
echo "== config files =="
git ls-files "${repo_dir}" | sed -n '1,50p'

echo
echo "== generated job files for openshift/vertical-pod-autoscaler-operator =="
git ls-files 'ci-operator/jobs/openshift/vertical-pod-autoscaler-operator' | sed -n '1,50p'

echo
echo "== occurrences of tls-scanner-run =="
rg -n "tls-scanner-run" ci-operator ci-operator/jobs ci-operator/step-registry 2>/dev/null || true

echo
echo "== make update target =="
sed -n '68,80p' Makefile

Repository: openshift/release

Length of output: 25680


Regenerate the generated Prow jobs. Adding tls-scanner-run changes this ci-operator config, so run make update to keep the generated files under ci-operator/jobs/openshift/vertical-pod-autoscaler-operator/ in sync before merging.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/openshift/vertical-pod-autoscaler-operator/openshift-vertical-pod-autoscaler-operator-main.yaml`
at line 168, Regenerate the Prow job files affected by the tls-scanner-run entry
in the ci-operator configuration by running make update, ensuring the generated
files under ci-operator/jobs/openshift/vertical-pod-autoscaler-operator/ are
synchronized.

Sources: Coding guidelines, Learnings

@shyadav10

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-vertical-pod-autoscaler-operator-main-e2e-aws-olm

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@shyadav10: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@shyadav10 shyadav10 changed the title VPA: Add PQC ML-KEM CI test AUTOSCALE-891: VPA: Add PQC ML-KEM CI test Jul 21, 2026
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 21, 2026
@openshift-ci-robot

openshift-ci-robot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

@shyadav10: This pull request references AUTOSCALE-891 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Jira link: https://redhat.atlassian.net/browse/AUTOSCALE-891

Summary by CodeRabbit

  • Adds a TLS scanner build image and CI step to the OpenShift Vertical Pod Autoscaler operator’s AWS OLM end-to-end workflow.
  • Configures the scanner to run PQC ML-KEM checks with dedicated namespace and resource settings.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@joelsmith

Copy link
Copy Markdown
Contributor

/test rehearse-82247-pull-ci-openshift-vertical-pod-autoscaler-operator-main-e2e-aws-olm

@joelsmith

Copy link
Copy Markdown
Contributor

It looks like the test run never really got going.
/pj-rehearse pull-ci-openshift-vertical-pod-autoscaler-operator-main-e2e-aws-olm

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@joelsmith: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@shyadav10

Copy link
Copy Markdown
Contributor Author

/retest

@shyadav10

Copy link
Copy Markdown
Contributor Author

/pj-rehearse pull-ci-openshift-vertical-pod-autoscaler-operator-main-e2e-aws-olm

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@shyadav10: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-ci

openshift-ci Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

@shyadav10: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 22, 2026
@openshift-ci

openshift-ci Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: joelsmith, shyadav10

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 22, 2026
@shyadav10

Copy link
Copy Markdown
Contributor Author

/pj-rehearse ack

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@shyadav10: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Jul 22, 2026
@openshift-merge-bot
openshift-merge-bot Bot merged commit c1fb9cd into openshift:main Jul 22, 2026
15 checks passed
apahim pushed a commit to apahim/release that referenced this pull request Jul 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. rehearsals-ack Signifies that rehearsal jobs have been acknowledged

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants