Skip to content

NE-2821: Add tls-scanner job for TLS1.3 on Gateway API #82586

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rikatz wants to merge 1 commit into
base: main
Choose a base branch
from
Open

NE-2821: Add tls-scanner job for TLS1.3 on Gateway API #82586

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions .../config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,10 @@ base_images:
name: hypershift-tests
namespace: hypershift
tag: latest
tls-scanner-tool:
name: tls-scanner
namespace: tls-scanner
tag: tls-scanner-tool
build_root:
from_repository: true
images:
Expand Down Expand Up @@ -307,6 +311,34 @@ tests:
requests:
cpu: 100m
workflow: ingress-vsphere-static-metallb
- always_run: false

@gcs278 gcs278 Jul 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Future follow up: Might be good to eventually have a intermediate test for completeness. We are only testing modern via the tls-13 step, but intermediate is untested.

as: tls-scanner-gatewayapi

@gcs278 gcs278 Jul 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit up to you, but generally all of our jobs have aws/gcp/azure. Also, adding -modern makes it more distinguished incase we decide to add an -intermediate in the future.

Suggested change
as: tls-scanner-gatewayapi
as: tls-scanner-aws-gatewayapi-modern

Not blocking - just a thought.

optional: true
pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
steps:
cluster_profile: openshift-org-aws
env:
COMPONENT_FILTER: tls-scanner-gatewayapi
FEATURE_SET: TechPreviewNoUpgrade
GATEWAY_NAME: tls-scanner-gatewayapi
SCAN_NAMESPACE: openshift-ingress
SCANNER_CPU: "1"
SCANNER_MEMORY: 1Gi
TLS_13_ENABLE_TLS_ADHERENCE: "true"
TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents
test:
- ref: tls-13
- as: setup-gateway
cli: latest
commands: make gatewayapi-tls-scanner-setup
env:
- name: GATEWAY_NAME
from: src
resources:
requests:
cpu: 100m
- ref: tls-scanner-run
workflow: ipi-aws
Comment on lines +314 to +341

@coderabbitai coderabbitai Bot Jul 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Regenerate CI configuration for all new jobs.

Each branch adds the same structural tls-scanner-gatewayapi job without generated Prow-job/metadata changes. Run make update once after all edits and commit its output.

  • ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml#L314-L341: regenerate output for the master job.
  • ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml#L287-L314: regenerate output for the 4.23 job.
  • ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml#L288-L315: regenerate output for the 5.0 job.
  • ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml#L287-L314: regenerate output for the 5.1 job.
📍 Affects 4 files
  • ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml#L314-L341 (this comment)
  • ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml#L287-L314
  • ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml#L288-L315
  • ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml#L287-L314
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml`
around lines 314 - 341, Regenerate CI metadata for the new
tls-scanner-gatewayapi job by running make update once after all edits, then
commit the generated output. Apply this for the master job
(ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master.yaml:314-341),
4.23 job
(ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml:287-314),
5.0 job
(ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml:288-315),
and 5.1 job
(ci-operator/config/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml:287-314).

Source: Coding guidelines

@gcs278 gcs278 Jul 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rikatz do you need to do a make update?

@gcs278 gcs278 Jul 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is a pretty minimal workflow - you won't get loki, must-gathers, etc..

any reason not to use openshift-e2e-aws-ovn-tls-13 which does adds the extra debugging tools? You'd remove you -ref: tls-13 as well since this already includes it.

- always_run: false
as: e2e-aws-ovn-techpreview
optional: true
Expand Down
32 changes: 32 additions & 0 deletions ...g/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,10 @@ base_images:
name: hypershift-tests
namespace: hypershift
tag: latest
tls-scanner-tool:
name: tls-scanner
namespace: tls-scanner
tag: tls-scanner-tool
build_root:
from_repository: true
images:
Expand Down Expand Up @@ -280,6 +284,34 @@ tests:
requests:
cpu: 100m
workflow: ingress-vsphere-static-metallb
- always_run: false
as: tls-scanner-gatewayapi
optional: true
pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
steps:
cluster_profile: openshift-org-aws
env:
COMPONENT_FILTER: tls-scanner-gatewayapi
FEATURE_SET: TechPreviewNoUpgrade
GATEWAY_NAME: tls-scanner-gatewayapi
SCAN_NAMESPACE: openshift-ingress
SCANNER_CPU: "1"
SCANNER_MEMORY: 1Gi
TLS_13_ENABLE_TLS_ADHERENCE: "true"
TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents
test:
- ref: tls-13
- as: setup-gateway
cli: latest
commands: make gatewayapi-tls-scanner-setup
env:
- name: GATEWAY_NAME
from: src
resources:
requests:
cpu: 100m
- ref: tls-scanner-run
workflow: ipi-aws
- always_run: false
as: e2e-aws-ovn-techpreview
optional: true
Expand Down
32 changes: 32 additions & 0 deletions ...ig/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.0.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,10 @@ base_images:
name: hypershift-tests
namespace: hypershift
tag: latest
tls-scanner-tool:
name: tls-scanner
namespace: tls-scanner
tag: tls-scanner-tool
build_root:
from_repository: true
images:
Expand Down Expand Up @@ -281,6 +285,34 @@ tests:
requests:
cpu: 100m
workflow: ingress-vsphere-static-metallb
- always_run: false
as: tls-scanner-gatewayapi
optional: true
pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
steps:
cluster_profile: openshift-org-aws
env:
COMPONENT_FILTER: tls-scanner-gatewayapi
FEATURE_SET: TechPreviewNoUpgrade
GATEWAY_NAME: tls-scanner-gatewayapi
SCAN_NAMESPACE: openshift-ingress
SCANNER_CPU: "1"
SCANNER_MEMORY: 1Gi
TLS_13_ENABLE_TLS_ADHERENCE: "true"
TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents
test:
- ref: tls-13
- as: setup-gateway
cli: latest
commands: make gatewayapi-tls-scanner-setup
env:
- name: GATEWAY_NAME
from: src
resources:
requests:
cpu: 100m
- ref: tls-scanner-run
workflow: ipi-aws
Comment thread
coderabbitai[bot] marked this conversation as resolved.
- always_run: false
as: e2e-aws-ovn-techpreview
optional: true
Expand Down
32 changes: 32 additions & 0 deletions ...ig/openshift/cluster-ingress-operator/openshift-cluster-ingress-operator-release-5.1.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,10 @@ base_images:
name: hypershift-tests
namespace: hypershift
tag: latest
tls-scanner-tool:
name: tls-scanner
namespace: tls-scanner
tag: tls-scanner-tool
build_root:
from_repository: true
images:
Expand Down Expand Up @@ -280,6 +284,34 @@ tests:
requests:
cpu: 100m
workflow: ingress-vsphere-static-metallb
- always_run: false
as: tls-scanner-gatewayapi
optional: true
pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
steps:
cluster_profile: openshift-org-aws
env:
COMPONENT_FILTER: tls-scanner-gatewayapi
FEATURE_SET: TechPreviewNoUpgrade
GATEWAY_NAME: tls-scanner-gatewayapi
SCAN_NAMESPACE: openshift-ingress
SCANNER_CPU: "1"
SCANNER_MEMORY: 1Gi
TLS_13_ENABLE_TLS_ADHERENCE: "true"
TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents
test:
- ref: tls-13
- as: setup-gateway
cli: latest
commands: make gatewayapi-tls-scanner-setup
env:
- name: GATEWAY_NAME
from: src
resources:
requests:
cpu: 100m
- ref: tls-scanner-run
workflow: ipi-aws
- always_run: false
as: e2e-aws-ovn-techpreview
optional: true
Expand Down
87 changes: 87 additions & 0 deletions ...nshift/cluster-ingress-operator/openshift-cluster-ingress-operator-master-presubmits.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2944,6 +2944,93 @@ presubmits:
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )okd-scos-images,?($|\s.*)
- agent: kubernetes
always_run: false
annotations:
pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
branches:
- ^master$
- ^master-
cluster: build03
context: ci/prow/tls-scanner-gatewayapi
decorate: true
decoration_config:
sparse_checkout_files:
- .ci-operator.yaml
- Dockerfile
labels:
ci-operator.openshift.io/cloud: aws
ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
name: pull-ci-openshift-cluster-ingress-operator-master-tls-scanner-gatewayapi
optional: true
rerun_command: /test tls-scanner-gatewayapi
spec:
containers:
- args:
- --gcs-upload-secret=/secrets/gcs/service-account.json
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
- --lease-server-credentials-file=/etc/boskos/credentials
- --report-credentials-file=/etc/report/credentials
- --secret-dir=/secrets/ci-pull-credentials
- --target=tls-scanner-gatewayapi
command:
- ci-operator
env:
- name: HTTP_SERVER_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
imagePullPolicy: Always
name: ""
ports:
- containerPort: 8080
name: http
resources:
requests:
cpu: 10m
volumeMounts:
- mountPath: /etc/boskos
name: boskos
readOnly: true
- mountPath: /secrets/ci-pull-credentials
name: ci-pull-credentials
readOnly: true
- mountPath: /secrets/gcs
name: gcs-credentials
readOnly: true
- mountPath: /secrets/manifest-tool
name: manifest-tool-local-pusher
readOnly: true
- mountPath: /etc/pull-secret
name: pull-secret
readOnly: true
- mountPath: /etc/report
name: result-aggregator
readOnly: true
serviceAccountName: ci-operator
volumes:
- name: boskos
secret:
items:
- key: credentials
path: credentials
secretName: boskos-credentials
- name: ci-pull-credentials
secret:
secretName: ci-pull-credentials
- name: manifest-tool-local-pusher
secret:
secretName: manifest-tool-local-pusher
- name: pull-secret
secret:
secretName: registry-pull-credentials
- name: result-aggregator
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )tls-scanner-gatewayapi,?($|\s.*)
- agent: kubernetes
always_run: true
branches:
Expand Down
87 changes: 87 additions & 0 deletions .../cluster-ingress-operator/openshift-cluster-ingress-operator-release-4.23-presubmits.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2372,6 +2372,93 @@ presubmits:
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )images,?($|\s.*)
- agent: kubernetes
always_run: false
annotations:
pipeline_skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|OWNERS_ALIASES|PROJECT|LICENSE)$
branches:
- ^release-4\.23$
- ^release-4\.23-
cluster: build11
context: ci/prow/tls-scanner-gatewayapi
decorate: true
decoration_config:
sparse_checkout_files:
- .ci-operator.yaml
- Dockerfile
labels:
ci-operator.openshift.io/cloud: aws
ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws
ci.openshift.io/generator: prowgen
pj-rehearse.openshift.io/can-be-rehearsed: "true"
name: pull-ci-openshift-cluster-ingress-operator-release-4.23-tls-scanner-gatewayapi
optional: true
rerun_command: /test tls-scanner-gatewayapi
spec:
containers:
- args:
- --gcs-upload-secret=/secrets/gcs/service-account.json
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
- --lease-server-credentials-file=/etc/boskos/credentials
- --report-credentials-file=/etc/report/credentials
- --secret-dir=/secrets/ci-pull-credentials
- --target=tls-scanner-gatewayapi
command:
- ci-operator
env:
- name: HTTP_SERVER_IP
valueFrom:
fieldRef:
fieldPath: status.podIP
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
imagePullPolicy: Always
name: ""
ports:
- containerPort: 8080
name: http
resources:
requests:
cpu: 10m
volumeMounts:
- mountPath: /etc/boskos
name: boskos
readOnly: true
- mountPath: /secrets/ci-pull-credentials
name: ci-pull-credentials
readOnly: true
- mountPath: /secrets/gcs
name: gcs-credentials
readOnly: true
- mountPath: /secrets/manifest-tool
name: manifest-tool-local-pusher
readOnly: true
- mountPath: /etc/pull-secret
name: pull-secret
readOnly: true
- mountPath: /etc/report
name: result-aggregator
readOnly: true
serviceAccountName: ci-operator
volumes:
- name: boskos
secret:
items:
- key: credentials
path: credentials
secretName: boskos-credentials
- name: ci-pull-credentials
secret:
secretName: ci-pull-credentials
- name: manifest-tool-local-pusher
secret:
secretName: manifest-tool-local-pusher
- name: pull-secret
secret:
secretName: registry-pull-credentials
- name: result-aggregator
secret:
secretName: result-aggregator
trigger: (?m)^/test( | .* )tls-scanner-gatewayapi,?($|\s.*)
- agent: kubernetes
always_run: true
branches:
Expand Down
Loading