From d34133560fef86a4c85341be3fa266865d0e540b Mon Sep 17 00:00:00 2001 From: Arun Maurya Date: Wed, 19 Aug 2026 15:50:07 +0530 Subject: [PATCH] Add TLS adherence and PQC readiness jobs for secrets-store-csi-driver-operator Extend the existing tls-scanner coverage with weekly periodics and add tls-pqc-readiness jobs (presubmit + periodic), matching the ESO/operator-sdk TLS scanner patterns. --- ...ecrets-store-csi-driver-operator-main.yaml | 70 +++++++ ...re-csi-driver-operator-main-periodics.yaml | 174 ++++++++++++++++++ ...e-csi-driver-operator-main-presubmits.yaml | 86 +++++++++ 3 files changed, 330 insertions(+) diff --git a/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml b/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml index 5e87d8762891a..feedbc97ea048 100644 --- a/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml +++ b/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml @@ -329,6 +329,7 @@ tests: OO_INSTALL_NAMESPACE: openshift-cluster-csi-drivers OO_PACKAGE: secrets-store-csi-driver-operator OO_TARGET_NAMESPACES: '!all' + PQC_CHECK: "false" SCAN_NAMESPACE: openshift-cluster-csi-drivers SCANNER_CPU: "1" SCANNER_MEMORY: 1Gi @@ -339,6 +340,75 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: openshift-e2e-azure-csi-secrets-store +- as: tls-scanner-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: openshift-org-azure + dependencies: + OO_INDEX: ci-index-secrets-store-csi-driver-operator-bundle + SECRETS_STORE_E2E_PROVIDER_IMAGE: secrets-store-csi-driver-e2eprovider + env: + CLUSTERCSIDRIVER: secrets-store.csi.k8s.io + OO_CHANNEL: stable + OO_INSTALL_NAMESPACE: openshift-cluster-csi-drivers + OO_PACKAGE: secrets-store-csi-driver-operator + OO_TARGET_NAMESPACES: '!all' + PQC_CHECK: "false" + SCAN_NAMESPACE: openshift-cluster-csi-drivers + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + TRUECONDITIONS: SecretsStoreDriverNodeServiceControllerAvailable + test: + - ref: tls-13 + - ref: tls-scanner-run + workflow: openshift-e2e-azure-csi-secrets-store +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: openshift-org-azure + dependencies: + OO_INDEX: ci-index-secrets-store-csi-driver-operator-bundle + SECRETS_STORE_E2E_PROVIDER_IMAGE: secrets-store-csi-driver-e2eprovider + env: + CLUSTERCSIDRIVER: secrets-store.csi.k8s.io + OO_CHANNEL: stable + OO_INSTALL_NAMESPACE: openshift-cluster-csi-drivers + OO_PACKAGE: secrets-store-csi-driver-operator + OO_TARGET_NAMESPACES: '!all' + PQC_CHECK: "true" + SCAN_NAMESPACE: openshift-cluster-csi-drivers + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TRUECONDITIONS: SecretsStoreDriverNodeServiceControllerAvailable + test: + - ref: tls-13 + - ref: tls-scanner-run + workflow: openshift-e2e-azure-csi-secrets-store +- as: tls-pqc-readiness-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: openshift-org-azure + dependencies: + OO_INDEX: ci-index-secrets-store-csi-driver-operator-bundle + SECRETS_STORE_E2E_PROVIDER_IMAGE: secrets-store-csi-driver-e2eprovider + env: + CLUSTERCSIDRIVER: secrets-store.csi.k8s.io + OO_CHANNEL: stable + OO_INSTALL_NAMESPACE: openshift-cluster-csi-drivers + OO_PACKAGE: secrets-store-csi-driver-operator + OO_TARGET_NAMESPACES: '!all' + PQC_CHECK: "true" + SCAN_NAMESPACE: openshift-cluster-csi-drivers + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + TRUECONDITIONS: SecretsStoreDriverNodeServiceControllerAvailable + test: + - ref: tls-13 + - ref: tls-scanner-run + workflow: openshift-e2e-azure-csi-secrets-store zz_generated_metadata: branch: main org: openshift diff --git a/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml b/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml index e9df144af9bc1..c8062fe5e79a9 100644 --- a/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml +++ b/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml @@ -86,3 +86,177 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build03 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile.mustgather + - Dockerfile.openshift + extra_refs: + - base_ref: main + org: openshift + repo: secrets-store-csi-driver-operator + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile.mustgather + - Dockerfile.openshift + labels: + ci-operator.openshift.io/cloud: azure4 + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-azure + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-secrets-store-csi-driver-operator-main-tls-pqc-readiness-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-periodic + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build03 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile.mustgather + - Dockerfile.openshift + extra_refs: + - base_ref: main + org: openshift + repo: secrets-store-csi-driver-operator + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile.mustgather + - Dockerfile.openshift + labels: + ci-operator.openshift.io/cloud: azure4 + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-azure + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-secrets-store-csi-driver-operator-main-tls-scanner-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-scanner-periodic + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-presubmits.yaml b/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-presubmits.yaml index 1ed6de2577a9a..51ef8298a471d 100644 --- a/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-presubmits.yaml @@ -964,6 +964,92 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )security,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build08 + context: ci/prow/tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile.mustgather + - Dockerfile.openshift + labels: + ci-operator.openshift.io/cloud: azure4 + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-azure + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-secrets-store-csi-driver-operator-main-tls-pqc-readiness + optional: true + rerun_command: /test tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: false branches: