STOR-3001: add TLS scanner for vsphere problem detector

[dfajmon]

move the tls scanner to cso repo as we need it there for testing

Summary by CodeRabbit

• Moves the vSphere problem detector’s TLS scanner CI coverage into the Cluster Storage Operator configuration.
• Adds the tls-scanner-tool base image and an optional vSphere TLS scanner job across main, 4.23, 5.0, and 5.1 Cluster Storage Operator CI configurations.
• Removes the corresponding image and test job from the vSphere problem detector CI configurations.

[openshift-ci-robot]

@dfajmon: This pull request references STOR-3001 which is a valid jira issue.

Details

In response to this:

move the tls scanner to cso repo as we need it there for testing

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: e3234710-4e25-41cf-aba9-fc97fd6028cc

📥 Commits

Reviewing files that changed from the base of the PR and between 811465a and 2c8de2a.

⛔ Files ignored due to path filters (8)

• ci-operator/jobs/openshift/cluster-storage-operator/openshift-cluster-storage-operator-main-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/cluster-storage-operator/openshift-cluster-storage-operator-release-4.23-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/cluster-storage-operator/openshift-cluster-storage-operator-release-5.0-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/cluster-storage-operator/openshift-cluster-storage-operator-release-5.1-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-main-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-release-4.23-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-release-5.0-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-release-5.1-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (8)

• ci-operator/config/openshift/cluster-storage-operator/openshift-cluster-storage-operator-main.yaml
• ci-operator/config/openshift/cluster-storage-operator/openshift-cluster-storage-operator-release-4.23.yaml
• ci-operator/config/openshift/cluster-storage-operator/openshift-cluster-storage-operator-release-5.0.yaml
• ci-operator/config/openshift/cluster-storage-operator/openshift-cluster-storage-operator-release-5.1.yaml
• ci-operator/config/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-main.yaml
• ci-operator/config/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-release-4.23.yaml
• ci-operator/config/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-release-5.0.yaml
• ci-operator/config/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-release-5.1.yaml

💤 Files with no reviewable changes (4)

• ci-operator/config/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-release-5.1.yaml
• ci-operator/config/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-release-5.0.yaml
• ci-operator/config/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-release-4.23.yaml
• ci-operator/config/openshift/vsphere-problem-detector/openshift-vsphere-problem-detector-main.yaml

---

Walkthrough

The TLS scanner base image and optional vSphere test are added to cluster-storage-operator configurations and removed from corresponding vsphere-problem-detector configurations for main and release branches.

Changes

TLS scanner workflow relocation

Layer / File(s)	Summary
Add TLS scanner workflow ci-operator/config/openshift/cluster-storage-operator/*	Adds the tls-scanner-tool base image and optional tls-scanner-vsphere-problem-detector job using the vsphere-elastic profile, TLS scanner settings, tls-13, tls-scanner-run, and ipi-vsphere.
Remove previous workflow wiring ci-operator/config/openshift/vsphere-problem-detector/*	Removes the TLS scanner base image and optional test job from main and release configurations.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• openshift/release#82553: Wires the same TLS scanner image and test ref into cluster-monitoring-operator CI.
• openshift/release#82555: Adds the same TLS scanner image and test ref to an RHOAI e2e job.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding the TLS scanner job for the vSphere problem detector under STOR-3001.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only changes CI YAML job configs; no Go/Ginkgo test titles were added or modified.
Test Structure And Quality	✅ Passed	PASS: PR only changes ci-operator YAML; no .go or _test.go files were modified, so no Ginkgo test blocks to assess.
Microshift Test Compatibility	✅ Passed	PR only changes ci-operator YAML/job configs; no Go/Ginkgo test files were added or modified, so MicroShift compatibility is not implicated.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only updates generated ci-operator/job YAMLs; no Go/Ginkgo test code was added or changed, so SNO test-compatibility review is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Only CI/operator job config changed; no deployment manifests, controllers, or scheduling fields were added.
Ote Binary Stdout Contract	✅ Passed	The PR only changes ci-operator/prow YAML; no OTE binary process-level code or stdout logging was modified.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only ci-operator YAML was added; the tls-scanner/tls-13 refs are existing step-registry steps with no IPv4 or public-internet assumptions.
No-Weak-Crypto	✅ Passed	Only CI YAML/job wiring changed; no MD5/SHA1/DES/RC4/3DES/custom crypto or secret comparisons were added.
Container-Privileges	✅ Passed	No changed CI config contains privileged, hostPID/hostNetwork/hostIPC, SYS_ADMIN, root, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	Diff only adds CI test/base-image YAML; no log statements or sensitive fields appeared in added lines.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dfajmon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/cluster-storage-operator/OWNERS [dfajmon]
• ci-operator/config/openshift/vsphere-problem-detector/OWNERS [dfajmon]
• ci-operator/jobs/openshift/cluster-storage-operator/OWNERS [dfajmon]
• ci-operator/jobs/openshift/vsphere-problem-detector/OWNERS [dfajmon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@dfajmon: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-cluster-storage-operator-main-tls-scanner-vsphere-problem-detector	openshift/cluster-storage-operator	presubmit	Presubmit changed
pull-ci-openshift-cluster-storage-operator-release-4.23-tls-scanner-vsphere-problem-detector	openshift/cluster-storage-operator	presubmit	Presubmit changed
pull-ci-openshift-cluster-storage-operator-release-5.0-tls-scanner-vsphere-problem-detector	openshift/cluster-storage-operator	presubmit	Presubmit changed
pull-ci-openshift-cluster-storage-operator-release-5.1-tls-scanner-vsphere-problem-detector	openshift/cluster-storage-operator	presubmit	Presubmit changed
pull-ci-openshift-cluster-storage-operator-release-5.1-e2e-aws-csi	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-e2e-aws-ovn	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-e2e-aws-ovn-upgrade	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-e2e-azure-csi	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-e2e-azure-file-csi	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-e2e-azure-manual-oidc	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-e2e-azure-ovn	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-e2e-gcp-csi	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-e2e-gcp-manual-oidc	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-e2e-gcp-ovn	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-e2e-ibmcloud-csi	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-e2e-openstack	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-e2e-openstack-cinder-csi	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-e2e-openstack-manila-csi	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-e2e-openstack-parallel	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-e2e-ovn-vsphere	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-e2e-vsphere-csi	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-hypershift-aws-e2e-external	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-hypershift-e2e-aks	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-hypershift-e2e-openstack-aws-csi-cinder	openshift/cluster-storage-operator	presubmit	Ci-operator config changed
pull-ci-openshift-cluster-storage-operator-release-5.1-hypershift-e2e-openstack-aws-csi-manila	openshift/cluster-storage-operator	presubmit	Ci-operator config changed

A total of 162 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs.

A full list of affected jobs can be found here
Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@dfajmon: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.