diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml index 6ae72b658810a..907f9cfb9afa4 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml @@ -11,6 +11,10 @@ base_images: name: hypershift-tests namespace: hypershift tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -307,6 +311,34 @@ tests: requests: cpu: 100m workflow: ingress-vsphere-static-metallb +- always_run: false + as: tls-scanner-gatewayapi + optional: true + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + steps: + cluster_profile: openshift-org-aws + env: + COMPONENT_FILTER: tls-scanner-gatewayapi + FEATURE_SET: TechPreviewNoUpgrade + GATEWAY_NAME: tls-scanner-gatewayapi + SCAN_NAMESPACE: openshift-ingress + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - as: setup-gateway + cli: latest + commands: make gatewayapi-tls-scanner-setup + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m + - ref: tls-scanner-run + workflow: ipi-aws - always_run: false as: e2e-aws-ovn-techpreview optional: true diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml index 371625589410d..75332c20d3da2 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml @@ -11,6 +11,10 @@ base_images: name: hypershift-tests namespace: hypershift tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -280,6 +284,34 @@ tests: requests: cpu: 100m workflow: ingress-vsphere-static-metallb +- always_run: false + as: tls-scanner-gatewayapi + optional: true + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + steps: + cluster_profile: openshift-org-aws + env: + COMPONENT_FILTER: tls-scanner-gatewayapi + FEATURE_SET: TechPreviewNoUpgrade + GATEWAY_NAME: tls-scanner-gatewayapi + SCAN_NAMESPACE: openshift-ingress + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - as: setup-gateway + cli: latest + commands: make gatewayapi-tls-scanner-setup + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m + - ref: tls-scanner-run + workflow: ipi-aws - always_run: false as: e2e-aws-ovn-techpreview optional: true diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml index 20f4b5b8c6416..63fec2ef77755 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml @@ -11,6 +11,10 @@ base_images: name: hypershift-tests namespace: hypershift tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -281,6 +285,34 @@ tests: requests: cpu: 100m workflow: ingress-vsphere-static-metallb +- always_run: false + as: tls-scanner-gatewayapi + optional: true + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + steps: + cluster_profile: openshift-org-aws + env: + COMPONENT_FILTER: tls-scanner-gatewayapi + FEATURE_SET: TechPreviewNoUpgrade + GATEWAY_NAME: tls-scanner-gatewayapi + SCAN_NAMESPACE: openshift-ingress + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - as: setup-gateway + cli: latest + commands: make gatewayapi-tls-scanner-setup + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m + - ref: tls-scanner-run + workflow: ipi-aws - always_run: false as: e2e-aws-ovn-techpreview optional: true diff --git a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml index 8aa82e44c6d06..3ecaaa71b3d3c 100644 --- a/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml +++ b/ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml @@ -11,6 +11,10 @@ base_images: name: hypershift-tests namespace: hypershift tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -280,6 +284,34 @@ tests: requests: cpu: 100m workflow: ingress-vsphere-static-metallb +- always_run: false + as: tls-scanner-gatewayapi + optional: true + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + steps: + cluster_profile: openshift-org-aws + env: + COMPONENT_FILTER: tls-scanner-gatewayapi + FEATURE_SET: TechPreviewNoUpgrade + GATEWAY_NAME: tls-scanner-gatewayapi + SCAN_NAMESPACE: openshift-ingress + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: tls-13 + - as: setup-gateway + cli: latest + commands: make gatewayapi-tls-scanner-setup + env: + - name: GATEWAY_NAME + from: src + resources: + requests: + cpu: 100m + - ref: tls-scanner-run + workflow: ipi-aws - always_run: false as: e2e-aws-ovn-techpreview optional: true diff --git a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml index 677c451dfb846..e0b35ceb5ec5e 100644 --- a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml +++ b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml @@ -2944,6 +2944,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )okd-scos-images,?($|\s.*) + - agent: kubernetes + always_run: false + annotations: + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + branches: + - ^master$ + - ^master- + cluster: build03 + context: ci/prow/tls-scanner-gatewayapi + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cluster-ingress-operator-master-tls-scanner-gatewayapi + optional: true + rerun_command: /test tls-scanner-gatewayapi + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-gatewayapi + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-gatewayapi,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yaml b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yaml index c009ed8431cae..c059a2305cb65 100644 --- a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yaml +++ b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yaml @@ -2372,6 +2372,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )images,?($|\s.*) + - agent: kubernetes + always_run: false + annotations: + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + branches: + - ^release-4\.23$ + - ^release-4\.23- + cluster: build11 + context: ci/prow/tls-scanner-gatewayapi + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cluster-ingress-operator-release-4.23-tls-scanner-gatewayapi + optional: true + rerun_command: /test tls-scanner-gatewayapi + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-gatewayapi + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-gatewayapi,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0-presubmits.yaml b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0-presubmits.yaml index a3766c0678068..e74cb6643b8a0 100644 --- a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0-presubmits.yaml +++ b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0-presubmits.yaml @@ -2371,6 +2371,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )images,?($|\s.*) + - agent: kubernetes + always_run: false + annotations: + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + branches: + - ^release-5\.0$ + - ^release-5\.0- + cluster: build10 + context: ci/prow/tls-scanner-gatewayapi + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cluster-ingress-operator-release-5.0-tls-scanner-gatewayapi + optional: true + rerun_command: /test tls-scanner-gatewayapi + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-gatewayapi + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-gatewayapi,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1-presubmits.yaml b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1-presubmits.yaml index a9adcc7271eb4..6822712fed63f 100644 --- a/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1-presubmits.yaml +++ b/ci-operator/jobs/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1-presubmits.yaml @@ -2372,6 +2372,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )images,?($|\s.*) + - agent: kubernetes + always_run: false + annotations: + pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$ + branches: + - ^release-5\.1$ + - ^release-5\.1- + cluster: build10 + context: ci/prow/tls-scanner-gatewayapi + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cluster-ingress-operator-release-5.1-tls-scanner-gatewayapi + optional: true + rerun_command: /test tls-scanner-gatewayapi + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-gatewayapi + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scanner-gatewayapi,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml b/ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml index 962465de31798..96795c35eecdc 100644 --- a/ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml +++ b/ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml @@ -12,6 +12,13 @@ ref: - name: SCAN_NAMESPACE default: "" documentation: "Comma-separated list of namespaces to scan. Empty means scan all namespaces." + - name: COMPONENT_FILTER + default: "" + documentation: |- + Comma-separated list of component names to scan, matched against each pod's + "app", "component", or "app.kubernetes.io/name" label (in that order). Empty + scans all pods in the selected namespace(s). Use this to exclude unrelated + workloads sharing a namespace with the component under test. - name: PQC_CHECK default: "false" documentation: "Set to 'true' to check post-quantum cryptography readiness (scanner will only check TLS 1.3 and mlkem/mlkem25519 support)." diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh index 3d7a3131a92fe..a89cb71a136ad 100644 --- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh +++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh @@ -50,6 +50,11 @@ run_tls_scan() { SCANNER_ARGS="--all-pods" fi + if [[ -n "${COMPONENT_FILTER:-}" ]]; then + SCANNER_ARGS="${SCANNER_ARGS} --component-filter ${COMPONENT_FILTER}" + echo "Component filter: ${COMPONENT_FILTER}" + fi + # Enable post-quantum cryptography checks only during the dedicated PQC pass. # On the first (TLS compliance) pass, PQC_CHECK is ignored so normal compliance # results are produced. The second pass sets TLS_SCANNER_PQC_PASS=true. diff --git a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml index d7d22f177e0aa..85ec02cab1c91 100644 --- a/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml +++ b/ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml @@ -7,6 +7,15 @@ ref: - name: SCAN_NAMESPACE default: "" documentation: "Comma-separated list of namespaces to scan. Empty means scan all namespaces." + - name: COMPONENT_FILTER + default: "" + documentation: |- + Comma-separated list of component names to scan, matched against each pod's + "app", "component", or "app.kubernetes.io/name" label (in that order). Empty + scans all pods in the selected namespace(s). Use this to exclude unrelated + workloads sharing a namespace with the component under test (e.g. Gateway + API pods sharing openshift-ingress with the non-adherent router-default + pods). - name: PQC_CHECK default: "false" documentation: "Set to 'true' to check post-quantum cryptography readiness (scanner will only check TLS 1.3 and mlkem/mlkem25519 support)."