WIP: trying tls-scanner with strict Intermediate profile on monitoring stack

ci-operator/config/openshift/cluster-monitoring-operator/openshift-cluster-monitoring-operator-main.yaml

@@ -3,6 +3,10 @@ base_images:
     name: hypershift-operator
     namespace: hypershift
     tag: latest
+  tls-scanner-tool:
+    name: tls-scanner
+    namespace: tls-scanner
+    tag: tls-scanner-tool
 build_root:
   from_repository: true
 images:
@@ -106,8 +110,15 @@ tests:
   steps:
     cluster_profile: openshift-org-aws
     env:
+      ENABLE_USER_WORKLOAD_MONITORING: "true"
+      PQC_CHECK: "true"
+      SCAN_NAMESPACE: openshift-monitoring,openshift-user-workload-monitoring
+      SCANNER_CPU: 500m
+      SCANNER_MEMORY: 1Gi
       TELEMETRY_ENABLED: "true"
+      TLS_PROFILE_TYPE: Intermediate
     test:
+    - ref: tls-scanner-run
     - as: test
       cli: latest
       commands: make test-e2e

ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-commands.sh

@@ -60,6 +60,12 @@ prometheusK8s:
           storage: ${STORAGE}
 EOF
 
+if [[ "${ENABLE_USER_WORKLOAD_MONITORING}" == "true" ]]; then
+  cat >> "${PATCH}" << EOF
+enableUserWorkload: true
+EOF
+fi
+
 CONFIG_CONTENTS="$(echo "${CONFIG_CONTENTS}" | yq-go m - "${PATCH}")"
 yq-go w --style folded -i "${CONFIG}" 'data."config.yaml"' "${CONFIG_CONTENTS}"
 cat "${CONFIG}"

ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-ref.yaml

@@ -16,5 +16,11 @@ ref:
         Enable persistent monitoring:
         * "false" - do not enable persistent monitoring, making this step a no-op.
         * "true" (default) - enable persistent monitoring.
+    - name: ENABLE_USER_WORKLOAD_MONITORING
+      default: "false"
+      documentation: |-
+        Enable user workload monitoring:
+        * "false" (default) - do not enable user workload monitoring.
+        * "true" - add enableUserWorkload: true to cluster-monitoring-config.
   documentation: |-
     The IPI install monitoringpvc step configures cluster-monitoring operator to save prometheus data in a persistent storage. This would ensure metrics are kept during upgrades.

ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh

@@ -193,7 +193,7 @@ spec:
         cpu: "${scanner_cpu}"
         memory: ${scanner_memory}
       limits:
-        cpu: "${scanner_cpu}"
+        cpu: "4"
         memory: ${scanner_memory}
     securityContext:
 ${SECURITY_CONTEXT_YAML}