From 16253e75f583ca545deefb43ec4243c6727c49fb Mon Sep 17 00:00:00 2001 From: Ayoub Mrini Date: Tue, 28 Jul 2026 16:15:33 +0200 Subject: [PATCH 1/6] WIP: trying tls-scanner with strict Intermediate profile on monitoring stack --- .../openshift-cluster-monitoring-operator-main.yaml | 11 +++++++++++ .../ipi-install-monitoringpvc-commands.sh | 6 ++++++ .../monitoringpvc/ipi-install-monitoringpvc-ref.yaml | 6 ++++++ 3 files changed, 23 insertions(+) diff --git a/ci-operator/config/openshift/cluster-monitoring-operator/openshift-cluster-monitoring-operator-main.yaml b/ci-operator/config/openshift/cluster-monitoring-operator/openshift-cluster-monitoring-operator-main.yaml index 189ff9605357e..3d99b2eb4cc9a 100644 --- a/ci-operator/config/openshift/cluster-monitoring-operator/openshift-cluster-monitoring-operator-main.yaml +++ b/ci-operator/config/openshift/cluster-monitoring-operator/openshift-cluster-monitoring-operator-main.yaml @@ -3,6 +3,10 @@ base_images: name: hypershift-operator namespace: hypershift tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -106,8 +110,15 @@ tests: steps: cluster_profile: openshift-org-aws env: + ENABLE_USER_WORKLOAD_MONITORING: "true" + PQC_CHECK: "true" + SCAN_NAMESPACE: openshift-monitoring,openshift-user-workload-monitoring + SCANNER_CPU: 500m + SCANNER_MEMORY: 1Gi TELEMETRY_ENABLED: "true" + TLS_PROFILE_TYPE: Intermediate test: + - ref: tls-scanner-run - as: test cli: latest commands: make test-e2e diff --git a/ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-commands.sh b/ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-commands.sh index 0c689cb815dc5..b0354fadb4b52 100755 --- a/ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-commands.sh +++ b/ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-commands.sh @@ -60,6 +60,12 @@ prometheusK8s: storage: ${STORAGE} EOF +if [[ "${ENABLE_USER_WORKLOAD_MONITORING}" == "true" ]]; then + cat >> "${PATCH}" << EOF +enableUserWorkload: true +EOF +fi + CONFIG_CONTENTS="$(echo "${CONFIG_CONTENTS}" | yq-go m - "${PATCH}")" yq-go w --style folded -i "${CONFIG}" 'data."config.yaml"' "${CONFIG_CONTENTS}" cat "${CONFIG}" diff --git a/ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-ref.yaml b/ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-ref.yaml index 3e1f22fcf2fa1..fab1f41e8be8b 100644 --- a/ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-ref.yaml +++ b/ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-ref.yaml @@ -16,5 +16,11 @@ ref: Enable persistent monitoring: * "false" - do not enable persistent monitoring, making this step a no-op. * "true" (default) - enable persistent monitoring. + - name: ENABLE_USER_WORKLOAD_MONITORING + default: "false" + documentation: |- + Enable user workload monitoring: + * "false" (default) - do not enable user workload monitoring. + * "true" - add enableUserWorkload: true to cluster-monitoring-config. documentation: |- The IPI install monitoringpvc step configures cluster-monitoring operator to save prometheus data in a persistent storage. This would ensure metrics are kept during upgrades. From 4553658ff7bf80956ccadc41bbc9bcfeea56f8d9 Mon Sep 17 00:00:00 2001 From: Ayoub Mrini Date: Wed, 29 Jul 2026 01:28:44 +0200 Subject: [PATCH 2/6] test --- .../step-registry/tls/scanner/run/tls-scanner-run-commands.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh index 3d7a3131a92fe..cfb661afe2284 100644 --- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh +++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh @@ -177,7 +177,7 @@ spec: - -c - | mkdir -p /results - /usr/local/bin/tls-scanner -j 4 ${SCANNER_ARGS} \ + /usr/local/bin/tls-scanner -j 50 ${SCANNER_ARGS} \ --json-file /results/results.json \ --csv-file /results/results.csv \ --junit-file /results/junit_tls_scan.xml \ From aa3c1e19c250e708c6a53344607710a4745b30bd Mon Sep 17 00:00:00 2001 From: Ayoub Mrini Date: Wed, 29 Jul 2026 09:51:38 +0200 Subject: [PATCH 3/6] wip --- .../step-registry/tls/scanner/run/tls-scanner-run-commands.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh index cfb661afe2284..babe73cb519e2 100644 --- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh +++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh @@ -177,7 +177,7 @@ spec: - -c - | mkdir -p /results - /usr/local/bin/tls-scanner -j 50 ${SCANNER_ARGS} \ + /usr/local/bin/tls-scanner -j 16 ${SCANNER_ARGS} \ --json-file /results/results.json \ --csv-file /results/results.csv \ --junit-file /results/junit_tls_scan.xml \ @@ -193,7 +193,7 @@ spec: cpu: "${scanner_cpu}" memory: ${scanner_memory} limits: - cpu: "${scanner_cpu}" + cpu: "2" memory: ${scanner_memory} securityContext: ${SECURITY_CONTEXT_YAML} From 7a551e24b6a27ea1215500a5f446d1e102313f9d Mon Sep 17 00:00:00 2001 From: Ayoub Mrini Date: Wed, 29 Jul 2026 11:58:52 +0200 Subject: [PATCH 4/6] with -j 16 INFO[2026-07-29T09:08:29Z] Running step e2e-agnostic-operator-tls-scanner-run. INFO[2026-07-29T09:31:32Z] Step e2e-agnostic-operator-tls-scanner-run succeeded after 23m2s. --- .../step-registry/tls/scanner/run/tls-scanner-run-commands.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh index babe73cb519e2..8c974ffa77006 100644 --- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh +++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh @@ -177,7 +177,7 @@ spec: - -c - | mkdir -p /results - /usr/local/bin/tls-scanner -j 16 ${SCANNER_ARGS} \ + /usr/local/bin/tls-scanner -j 32 ${SCANNER_ARGS} \ --json-file /results/results.json \ --csv-file /results/results.csv \ --junit-file /results/junit_tls_scan.xml \ From b2797976a1c1f335550a209e54b029a805371457 Mon Sep 17 00:00:00 2001 From: Ayoub Mrini Date: Wed, 29 Jul 2026 14:46:00 +0200 Subject: [PATCH 5/6] test --- .../step-registry/tls/scanner/run/tls-scanner-run-commands.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh index 8c974ffa77006..6390f36d38e21 100644 --- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh +++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh @@ -177,7 +177,7 @@ spec: - -c - | mkdir -p /results - /usr/local/bin/tls-scanner -j 32 ${SCANNER_ARGS} \ + /usr/local/bin/tls-scanner -j 4 ${SCANNER_ARGS} \ --json-file /results/results.json \ --csv-file /results/results.csv \ --junit-file /results/junit_tls_scan.xml \ From 2b34dbed86f0412869b351fb2de2055f91184a8d Mon Sep 17 00:00:00 2001 From: Ayoub Mrini Date: Wed, 29 Jul 2026 19:19:27 +0200 Subject: [PATCH 6/6] test --- .../step-registry/tls/scanner/run/tls-scanner-run-commands.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh index 6390f36d38e21..f67a42e30dc4d 100644 --- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh +++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh @@ -193,7 +193,7 @@ spec: cpu: "${scanner_cpu}" memory: ${scanner_memory} limits: - cpu: "2" + cpu: "4" memory: ${scanner_memory} securityContext: ${SECURITY_CONTEXT_YAML}