CNF-26477: oran-o2ims: extract wait-for-tls-pods into step-registry ref - #83194
CNF-26477: oran-o2ims: extract wait-for-tls-pods into step-registry ref#83194rauhersu wants to merge 10 commits into
Conversation
Signed-off-by: Raul Hernandez <rauherna@redhat.com>
- Add a wait-for-server-pods inline step to the install-bundle-tls-scan test that dynamically discovers TLS-serving services via the service.beta.openshift.io/serving-cert-secret-name annotation, waits for their backing pods to become Ready, and verifies that service-ca TLS secrets exist before the tls-scanner runs. This avoids hardcoding server names. - Move operator.substitutions under the bundle item where it belongs, making the pullspec override explicitly scoped to the operator-bundle.
…space The scanner always runs in a dedicated tls-scanner namespace. When scanning pods with NetworkPolicies restricting ingress to same-namespace traffic (e.g. oran-o2ims servers), the TLS handshake probes are blocked, producing false NO_TLS results. Add a SCANNER_NAMESPACE env var that deploys the scanner pod into an existing namespace instead, reusing the OWNS_NAMESPACE=false pattern already used by the HyperShift management-cluster path. Set SCANNER_NAMESPACE=oran-o2ims in the install-bundle-tls-scan test so the scanner satisfies the oran-o2ims NetworkPolicy rules. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Raúl Hernández <rauherna@redhat.com>
Add the install-bundle-tls-scan test with TLS Adherence (StrictAllComponents) and tls-scanner to the release-4.22 config, matching the main branch configuration. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Raúl Hernández <rauherna@redhat.com>
Add install-bundle-tls-scan-periodic to both main (Fridays 03:00 UTC) and release-4.22 (Mondays 03:00 UTC) configurations. The periodic jobs are identical to the on-demand variants but run on a cron schedule. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Raúl Hernández <rauherna@redhat.com>
Set PQC_CHECK=true across all TLS scan pipelines (on-demand and periodic) for main and release-4.22. This enables post-quantum cryptography readiness checks (TLS 1.3 + mlkem/mlkem25519 support). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Raúl Hernández <rauherna@redhat.com>
- Fail the step if the Inventory CR is not created within 5 minutes instead of silently falling through to the scanner - Fail the step if any TLS service pod does not become ready - Fail the step if any TLS serving cert secret is missing - Switch pipe-based while loops to here-strings to avoid subshell scoping issues with failure tracking Applies to all 4 wait-for-server-pods script copies (on-demand and periodic jobs for main and release-4.22). Script deduplication tracked in CNF-26477. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Raúl Hernández <rauherna@redhat.com>
Extract the ~80-line wait-for-server-pods inline script that was duplicated 4 times (on-demand and periodic jobs for main and release-4.22) into a shared step-registry ref at ci-operator/step-registry/oran-o2ims/wait-for-tls-pods/. The ref waits for the Inventory CR, discovers TLS-annotated services, verifies pod readiness and TLS secret presence, and fails the step on any error. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Raúl Hernández <rauherna@redhat.com>
openshift-ci-robot
added
the
jira/valid-reference
|
@rauhersu: This pull request references CNF-26477 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @rauhersu. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
WalkthroughAdded ORAN O2IMS TLS readiness validation, shared scanner namespace support, and on-demand and periodic AWS TLS scan jobs for main and release 4.22 configurations. ChangesORAN O2IMS TLS scanning
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant AWSCluster
participant OperatorBundle
participant ORANO2IMSReadiness
participant TLSScanner
AWSCluster->>OperatorBundle: Install operator bundle
OperatorBundle->>ORANO2IMSReadiness: Create Inventory and TLS resources
ORANO2IMSReadiness->>AWSCluster: Verify ready pods and TLS secrets
AWSCluster->>TLSScanner: Run TLS 1.3 and PQC scans
Possibly related PRs
🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: rauhersu The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/hold We depend on this PR: #82154 |
openshift-ci
Bot
added
the
do-not-merge/hold
openshift-ci
Bot
added
the
do-not-merge/invalid-owners-file
|
The OWNERS file contains untrusted users, which makes it INVALID. The following users are mentioned in OWNERS file(s) but are untrusted for the following reasons. One way to make the user trusted is to add them as members of the openshift org. You can then trigger verification by writing
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/oran-o2ims/wait-for-tls-pods/oran-o2ims-wait-for-tls-pods-commands.sh`:
- Around line 70-76: Update the secret check in the wait-for-TLS-pods loop to
poll each configured service-ca secret until it exists or the existing deadline
expires, rather than calling oc get secret only once. Keep the current success
output, and set FAILED only after the polling deadline is reached; use the
existing deadline and polling conventions in the script.
In `@ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh`:
- Around line 9-16: Update the externally owned namespace flow in
tls-scanner-run-commands.sh to create and use a scanner-specific service account
instead of the namespace’s default service account. Change the later
cluster-admin binding to target that account, track the run-scoped binding, and
ensure cleanup removes the binding and scanner service account while preserving
existing namespace ownership behavior.
- Around line 9-16: Update the scanner run flow to use a unique per-run pod
identity when jobs share SCANNER_NAMESPACE, rather than the fixed tls-scanner
name. Propagate that identity through every pod creation, lookup, wait, result
retrieval, RBAC/cluster-admin operation, purge, and cleanup path; alternatively
enforce single-flight execution per namespace.
In `@ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml`:
- Around line 10-15: Update the SCANNER_NAMESPACE documentation and the
top-level scanner documentation to describe its security contract: deployments
use the existing namespace with non-host, PodSecurity-restricted pods, without
hostNetwork, hostPID, root, privileged mode, or privileged SCC. Document that
management-cluster scans use SCAN_NAMESPACE as the deployment namespace when
TLS_SCANNER_CLUSTER_LABEL=management.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 1a71483b-7401-4653-ab94-c5b80fdea45c
⛔ Files ignored due to path filters (4)
ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main-periodics.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main-presubmits.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22-periodics.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (7)
ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yamlci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yamlci-operator/step-registry/oran-o2ims/wait-for-tls-pods/OWNERSci-operator/step-registry/oran-o2ims/wait-for-tls-pods/oran-o2ims-wait-for-tls-pods-commands.shci-operator/step-registry/oran-o2ims/wait-for-tls-pods/oran-o2ims-wait-for-tls-pods-ref.yamlci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.shci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml
|
[REHEARSALNOTIFIER]
A total of 135 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
2 participants
Summary
wait-for-server-podsinline script into a shared step-registry ref atci-operator/step-registry/oran-o2ims/wait-for-tls-pods/mainandrelease-4.22) with- ref: oran-o2ims-wait-for-tls-podsDepends on: #82154
Test plan
ci-operator-registryvalidation passesgenerated-configcheck passesinstall-bundle-tls-scansucceedsJira: CNF-26477
🤖 Generated with Claude Code
Summary by CodeRabbit
mainandrelease-4.22CI.oran-o2ims-wait-for-tls-podsstep.SCANNER_NAMESPACEwithout creating or deleting that namespace.