Add tls-scanner-run to RHOAI e2e job - #82555
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThe RHOAI operator E2E pipeline now defines the TLS scanner image, sets PQC and scan namespace environment variables, and invokes the ChangesRHOAI E2E TLS scanner
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml (1)
126-127: 📐 Maintainability & Code Quality | 🔵 TrivialRegenerate and validate CI artifacts for the new post-step.
Adding
tls-scanner-runchanges the CI job structure, so runmake update/make registry-metadata && make ci-operator-config && make jobsand include the generated PR changes when submitting.
[maintainability和code_quality]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml` around lines 126 - 127, Regenerate the CI artifacts after adding the tls-scanner-run post-step by running make update, make registry-metadata && make ci-operator-config && make jobs, then include all resulting generated changes in the pull request.Sources: Coding guidelines, Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In
`@ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml`:
- Around line 126-127: Regenerate the CI artifacts after adding the
tls-scanner-run post-step by running make update, make registry-metadata && make
ci-operator-config && make jobs, then include all resulting generated changes in
the pull request.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: dd2cf08f-f231-4920-9089-effb787a082c
📒 Files selected for processing (1)
ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml
2778ba3 to
6f7f910
Compare
|
@ugiordan: |
6f7f910 to
08b9f11
Compare
|
@ugiordan: |
08b9f11 to
6887e15
Compare
|
/pj-rehearse |
|
@ugiordan: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
6887e15 to
fc2f7af
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml`:
- Line 161: Regenerate the derived CI metadata and Prow job artifacts after
adding the tls-scanner-run step to the CI configuration, ensuring the generated
outputs reflect the updated job definition before merging.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 5ec15594-08e6-4144-88c9-7c6a7207f3d1
📒 Files selected for processing (1)
ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml
| cpu: 2000m | ||
| memory: 3Gi | ||
| timeout: 3h0m0s | ||
| - ref: tls-scanner-run |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate target file =="
fd -a 'opendatahub-io-opendatahub-operator-main\.yaml$' . || true
echo "== target references =="
if [ -f ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml ]; then
wc -l ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml
sed -n '140,175p' ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml
fi
echo "== changed files/stat =="
git diff --stat || true
git diff -- ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml | sed -n '1,220p' || true
echo "== generated config status mentions =="
git ls-files ci-operator | sed -n '1,80p' | rg 'generated|metadata|config|jobs|Prow|Prow jobs|metadata' || true
rg -n "Generated|generated|Prow|make update|make registry-metadata|make ci-operator-config|make jobs|needs to|must be regenerated" README.md Makefile ci-operator/config 2>/dev/null | sed -n '1,220p' || trueRepository: openshift/release
Length of output: 37354
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== repository Makefile rules =="
if [ -f Makefile ]; then
sed -n '/registry-metadata/ci-operator-config/jobs/update/p' Makefile | sed -n '1,240p' || true
rg -n '^registry-metadata:|^ci-operator-config:|^jobs:|^update:' Makefile || true
fi
echo "== CI config related metadata files =="
rg -n "zz_generated_metadata|generated-metadata|metadata|prowing|Prow jobs|generated Prow jobs" ci-operator/config README.md Makefile 2>/dev/null || true
echo "== check whether target config has step in both diff and file =="
python3 - <<'PY'
from pathlib import Path
p=Path('ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml')
if p.exists():
text=p.read_text()
print('exists True')
for i,line in enumerate(text.splitlines(),1):
if 'tls-scanner-run' in line:
print(f'{i}:{line.strip()}')
print('total_lines', len(text.splitlines()))
else:
print('exists False')
PYRepository: openshift/release
Length of output: 50374
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== CI config related metadata files and generated artifacts =="
git ls-files | rg '(^ci-operator/config/.+/.*|Makefile|README\.md|zz_generated_metadata|generated.*metadata|.*Prow.*|.*jobs.*)' | sed -n '1,200p' || true
echo "== exact search for generated metadata/jobs wording =="
rg -n "generated metadata|zz_generated_metadata|Prow jobs|generated Prow|make update|make registry-metadata|make ci-operator-config|make jobs" . \
-g 'Makefile' -g 'README.md' -g '*ci-operator*' -g '*generated*' -g '*.yaml' -g '*.yml' | sed -n '1,240p' || true
echo "== diff around exact target line with context =="
git diff -- ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml | sed -n '1,260p' || trueRepository: openshift/release
Length of output: 47231
Validate generated CI artifacts for the new scan step.
This CI job has been modified, so regenerate/generate the derived CI metadata and Prow jobs before merging.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml`
at line 161, Regenerate the derived CI metadata and Prow job artifacts after
adding the tls-scanner-run step to the CI configuration, ensuring the generated
outputs reflect the updated job definition before merging.
Sources: Coding guidelines, Learnings
|
@ugiordan: |
|
/retest |
|
/hold |
openshift-ci
Bot
added
the
do-not-merge/hold
|
/test |
|
/test generated-config |
|
/hold cancel |
openshift-ci
Bot
removed
the
do-not-merge/hold
|
/rehearsals-ack |
|
/label rehearsals-ack |
|
@GowthamShanmugam: The label(s) DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Adds tls-scanner-run as a test step to the opendatahub-operator-rhoai-e2e job to enforce TLS compliance scanning on deployed RHOAI components. Configuration: - tls-scanner-tool base image from OCP 4.22 - Runs as final test step (blocks PR on failure, can be overridden) - PQC_CHECK: true (enable post-quantum crypto checks) - SCAN_NAMESPACE: redhat-ods-operator,redhat-ods-applications Follows the pattern from compliance-operator (PR openshift#78651). Reference: https://steps.ci.openshift.org/reference/tls-scanner-run Related: RHOAIENG-61076 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
fc2f7af to
8acc940
Compare
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/retest |
1 similar comment
|
/retest |
|
/pj-rehearse pull-ci-opendatahub-io-opendatahub-operator-main-opendatahub-operator-rhoai-e2e |
|
@GowthamShanmugam: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse ask |
|
@GowthamShanmugam: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-opendatahub-io-opendatahub-operator-main-opendatahub-operator-rhoai-e2e |
|
@ugiordan: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse ack |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: GowthamShanmugam, ugiordan The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/pj-rehearse ack |
|
@GowthamShanmugam: job(s): ask either don't exist or were not found to be affected, and cannot be rehearsed |
|
@GowthamShanmugam: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
@GowthamShanmugam: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
fb1c6c9
into
openshift:main
2 participants
Adds tls-scanner-run as a post-test step to the
opendatahub-operator-rhoai-e2ejob to scan for TLS configuration issues in deployed RHOAI components.Configuration
PQC_CHECK: "true"- enable post-quantum crypto checksSCAN_NAMESPACE: redhat-ods-operator,redhat-ods-applications- scan both RHOAI namespacesReference
Testing
The tls-scanner-run step executes after the e2e test completes and scans the deployed cluster for TLS configuration issues. Findings are reported as test failures if critical issues are detected.
Summary by CodeRabbit
Updates the OpenDataHub Operator RHOAI end-to-end prow job (
opendatahub-operator-rhoai-e2e) to runtls-scanner-runafter the e2e test completes. The job now enables post-quantum TLS scanning (PQC_CHECK: "true") and targets theredhat-ods-operatorandredhat-ods-applicationsnamespaces (SCAN_NAMESPACE). Critical TLS configuration findings from this scanner are reported as test failures. This change also adds thetls-scanner-toolimage to the job’s configuredbase_images.