Skip to content

Add dedicated tls-scanner for NROP operator#82110

Open
mrniranjan wants to merge 5 commits into
openshift:mainfrom
mrniranjan:nrop_tls_scanner
Open

Add dedicated tls-scanner for NROP operator#82110
mrniranjan wants to merge 5 commits into
openshift:mainfrom
mrniranjan:nrop_tls_scanner

Conversation

@mrniranjan

@mrniranjan mrniranjan commented Jul 17, 2026

Copy link
Copy Markdown
Contributor
  • Create telcov10n-functional-cnf-compute-nrop-tls-scanner workflow
  • Add e2e-telcov10n-nrop-tls-scanner-5-0-nightly job
  • Schedule: Sunday 09:00 UTC (safe 1hr buffer before/2hr after)
  • Fast ML-KEM validation without full e2e tests (~45 min)
  • PQC_CHECK=true for post-quantum cryptography validation
  • Scans openshift-numaresources namespace only
  • Relates to PLMPGM-7881 (ML-KEM validation requirement)
  • Runs on Sunday 08:00 UTC

Assisted by: Claude Sonnet 4.5

Summary by CodeRabbit

Updates OpenShift CI/CD infrastructure for the NROP operator 5.0 by separating the 5.0 nightly schedules into a dedicated stage-5-0 config and adding a purpose-built TLS scanner job to satisfy the ML-KEM validation requirement without running full functional end-to-end tests.

  • Nightly scheduling changes (5.0): Removes the previously scheduled 5.0 nightly functional job (e2e-telcov10n-nrop-tests-5-0-nightly) from openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage.yaml, and introduces a new openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage-5-0.yaml that contains both the NROP functional workflow job and the new TLS scanner job.
  • New TLS scanner nightly job (Sunday): Adds e2e-telcov10n-nrop-tls-scanner-5-0-nightly scheduled for Sundays (cron: 0 8 * * 0). It runs with nightly OCP (stream nightly, version "5.0") and targets only openshift-numaresources via SCAN_NAMESPACE. Post-quantum validation is enabled with PQC_CHECK: "true" and scanner sizing with SCANNER_CPU: "2", invoking telcov10n-functional-cnf-compute-nrop-tls-scanner.
  • New TLS scanner workflow: Adds telcov10n-functional-cnf-compute-nrop-tls-scanner workflow that:
    • provisions inventory and deploys/configures OCP + installs/configures the NROP operator,
    • runs tls-scanner-run with TLS_SCANNER_PQC_PASS (default "true") to validate ML-KEM/post-quantum TLS behavior,
    • verifies results in a post step by checking generated JUnit reports (telcov10n-verify-junit-reports), with job pass/fail driven by the scanner pod exit code.
  • CI plumbing/ownership: Defines the tls-scanner-tool base image in the stage-5-0 config and updates TLS scanner ownership by adding explicit approvers to the TLS scanner OWNERS file and populating workflow metadata with the same approvers.

@openshift-ci
openshift-ci Bot requested review from TimurMP and rdiazcam July 17, 2026 21:12
@mrniranjan
mrniranjan marked this pull request as draft July 17, 2026 21:12
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 17, 2026
@openshift-ci

openshift-ci Bot commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mrniranjan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 17, 2026
@coderabbitai

coderabbitai Bot commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

Adds an NROP ML-KEM TLS scanner workflow, ownership metadata, and an OpenShift 5.0 nightly CI configuration with scanner settings and JUnit result handling.

Changes

NROP TLS scanner

Layer / File(s) Summary
TLS scanner workflow definition
ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/*
Adds cluster preparation, NROP configuration, ML-KEM TLS scanning, JUnit verification, workflow metadata, and approvers.
OpenShift 5.0 scheduled configuration
ci-operator/config/openshift-kni/eco-ci-cd/...
Adds the nightly 5.0 candidate configuration and scheduled functional and TLS scanner jobs with NROP and scanner environment settings.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Workflow as TLS scanner workflow
  participant Cluster as NROP cluster setup
  participant Scanner as tls-scanner-run
  participant Reports as JUnit verification
  Workflow->>Cluster: Deploy and configure NROP
  Workflow->>Scanner: Run ML-KEM TLS scan
  Scanner->>Reports: Verify JUnit reports
Loading

Suggested labels: needs-ok-to-test

Suggested reviewers: dgoodwin, eifrach, rdiazcam, timurmp


Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name Status Explanation Resolution
Container-Privileges ❌ Error FAIL: the added tls-scanner job invokes tls-scanner-run, which creates a pod manifest with privileged: true, hostNetwork: true, hostPID: true, and runAsUser: 0 in host-mode. Use the restricted scanner path or refactor the workflow so it doesn’t create a privileged/root host-networked pod; avoid hostPID/hostNetwork/privileged unless explicitly justified.
✅ Passed checks (14 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the main change: adding a dedicated TLS scanner for the NROP operator.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed No Ginkgo test titles were added or modified; the PR only changes CI YAML/metadata, and targeted scans found no It/Describe/Context/When strings.
Test Structure And Quality ✅ Passed No Ginkgo test code was changed; the PR only touches CI config, step-registry metadata, workflow YAML, and generated periodic jobs.
Microshift Test Compatibility ✅ Passed No new Ginkgo tests were added; the PR only adds CI workflow/config, and the scanner workflow is CLI-based, not e2e code.
Single Node Openshift (Sno) Test Compatibility ✅ Passed PASS: The new telcov10n workflow only invokes tls-scanner-run; no Ginkgo tests or multi-node/HA assumptions were added, and no SNO-unsafe patterns were found.
Topology-Aware Scheduling Compatibility ✅ Passed PASS: changes are CI config and step-registry workflow only; no deployment/controller code or topology-sensitive scheduling fields were added.
Ote Binary Stdout Contract ✅ Passed PR only changes CI YAML/OWNERS metadata; no process-level binary code or stdout writes in main/init/TestMain/suite setup were introduced.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed New files add a workflow/job only; the scanner step uses cluster APIs and internal image streams, with no hardcoded IPv4 or public internet dependencies found.
No-Weak-Crypto ✅ Passed Changed files are YAML/metadata only; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret-comparison code appears.
No-Sensitive-Data-In-Logs ✅ Passed No secret/PII-bearing log statements were added; the new workflow only sets operational env vars and reuses non-sensitive scanner status logging.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/telcov10n-functional-cnf-compute-nrop-tls-scanner-workflow.yaml`:
- Around line 3-10: Add a post phase to the workflow alongside pre and test,
referencing an appropriate existing step or chain; preserve the current phases
and validate the step registry with make validate-step-registry.
- Around line 10-15: Update the tls-scanner-run workflow/ref configuration so it
sets the runner-consumed TLS_SCANNER_PQC_PASS variable to true, ensuring
tls-scanner-run-commands.sh adds --pqc-check. Remove or align the unused
PQC_CHECK declaration so the workflow’s configuration matches the variable
actually read by the runner and the documented ML-KEM validation runs.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 0b44c111-86c7-4e47-a125-b65b755bf7f6

📥 Commits

Reviewing files that changed from the base of the PR and between 217f91c and ec01a99.

⛔ Files ignored due to path filters (1)
  • ci-operator/jobs/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main-periodics.yaml is excluded by !ci-operator/jobs/**
📒 Files selected for processing (4)
  • ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage.yaml
  • ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/OWNERS
  • ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/telcov10n-functional-cnf-compute-nrop-tls-scanner-workflow.metadata.json
  • ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/telcov10n-functional-cnf-compute-nrop-tls-scanner-workflow.yaml
🚧 Files skipped from review as they are similar to previous changes (3)
  • ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/telcov10n-functional-cnf-compute-nrop-tls-scanner-workflow.metadata.json
  • ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/OWNERS
  • ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage.yaml

@mrniranjan
mrniranjan marked this pull request as ready for review July 20, 2026 05:26
@openshift-ci openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 20, 2026
@openshift-ci
openshift-ci Bot requested review from dgoodwin and eifrach July 20, 2026 05:26
@mrniranjan mrniranjan changed the title Add dedicated tls-scanner for NROP operator 5.0 Add dedicated tls-scanner for NROP operator Jul 20, 2026
- Create telcov10n-functional-cnf-compute-nrop-tls-scanner workflow
- Add e2e-telcov10n-nrop-tls-scanner-5-0-nightly job
- Schedule: Sunday 09:00 UTC (safe 1hr buffer before/2hr after)
- Fast ML-KEM validation without full e2e tests (~45 min)
- PQC_CHECK=true for post-quantum cryptography validation
- Scans openshift-numaresources namespace only
- Relates to PLMPGM-7881 (ML-KEM validation requirement)
- Runs on Sunday 08:00 UTC

Assisted by: Claude Sonnet 4.5
Signed-off-by: Niranjan M.R <mniranja@redhat.com>

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

don't we need an analyser here for the results? IOW if the scanner found that the TLS adherance is not as expected are we sure that that would be reflected in the TLS scanner exit code?

@shajmakh

Copy link
Copy Markdown
Contributor

@mrniranjan Thanks for addressing. Can we have a trial/rehearsal run with the TLS Scanner in place to ensure the goal of this PR is met?

@mrniranjan

mrniranjan commented Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

@shajmakh

Yes, the scanner exit code DOES reflect TLS adherence failures.

    /usr/local/bin/tls-scanner -j 4 ${SCANNER_ARGS} \
    --json-file /results/results.json \
    --csv-file /results/results.csv \
    --junit-file /results/junit_tls_scan.xml \
    --log-file /results/scan.log 2>&1 | tee /results/output.log
  SCAN_EXIT_CODE=${PIPESTATUS[0]}

...
exit ${SCAN_EXIT_CODE}

2. Pod Success Check (line 260-264):
 oc wait --for=jsonpath='{.status.phase}'=Succeeded pod/tls-scanner -n "${NAMESPACE}" --timeout=10m || {
     echo "Scanner did not complete successfully - timeout exceeded"
     oc describe pod/tls-scanner -n "${NAMESPACE}"
     exit 1
 }
  1. JUnit Results are also generated and checked by telcov10n-verify-junit-reports in the post phase

@mrniranjan

Copy link
Copy Markdown
Contributor Author

@shajmakh i will provide the results as soon as cluster is available.

…ble jobs

Split openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage.yaml into:
- openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage.yaml (stable: 4.14-4.22)
- openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage-5-0.yaml (nightly 5.0 only)

The releases: section for 5.0 nightly was being applied to all jobs in
the original file, causing stable version jobs (4.14, 4.16, 4.18, 4.19,
4.20, 4.21, 4.22) to unnecessarily build the 5.0 nightly release, adding
30-40 minutes to each job.

Impact:
- Stable version jobs (7 total): No longer build 5.0 nightly (-30-40 min each)
- 5.0 nightly jobs (2 total): Continue to build 5.0 nightly as needed
- Total time saved: ~4-5 hours per week

The 5.0-specific file contains both:
- e2e-telcov10n-nrop-tests-5-0-nightly (full e2e tests)
- e2e-telcov10n-nrop-tls-scanner-5-0-nightly (TLS scanner only)

Signed-off-by: Niranjan M.R <mniranja@redhat.com>
@eifrach

eifrach commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

/pj-rehearse periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-5-0-e2e-telcov10n-nrop-tls-scanner-5-0-nightly

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

@eifrach: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

Signed-off-by: Niranjan M.R <mniranja@redhat.com>
Use the below workaround to reuse existing namespaces
set TLS_SCANNER_CLUSTER_LABEL: management

Signed-off-by: Niranjan M.R <mniranja@redhat.com>
Signed-off-by: Niranjan M.R <mniranja@redhat.com>
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@mrniranjan: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-14 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-22 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-compact-prod-e2e-telcov10n-nrop-tests-compact-prod-4-22 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-compact-stage-e2e-telcov10n-nrop-tests-compact-stage-4-21 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-18 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-compact-stage-e2e-telcov10n-nrop-tests-compact-stage-4-22 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-5-0-e2e-telcov10n-nrop-tls-scanner-5-0-nightly N/A periodic Periodic changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-compact-prod-e2e-telcov10n-nrop-tests-compact-prod-4-20 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-compact-stage-e2e-telcov10n-nrop-tests-compact-5-0-nightly N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-prod-e2e-telcov10n-nrop-tests-prod-4-22 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-prod-e2e-telcov10n-nrop-tests-prod-4-18 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-prod-e2e-telcov10n-nrop-tests-prod-4-20 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-prod-e2e-telcov10n-nrop-tests-prod-4-19 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-prod-e2e-telcov10n-nrop-tests-prod-4-14 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-20 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-21 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-prod-e2e-telcov10n-nrop-tests-prod-4-21 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-5-0-e2e-telcov10n-nrop-tests-5-0-nightly N/A periodic Periodic changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-compact-prod-e2e-telcov10n-nrop-tests-compact-prod-4-21 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-compact-stage-e2e-telcov10n-nrop-tests-compact-stage-4-20 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-prod-e2e-telcov10n-nrop-tests-prod-4-16 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-19 N/A periodic Registry content changed
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-16 N/A periodic Registry content changed
Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@openshift-ci

openshift-ci Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

@mrniranjan: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/rehearse/periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-5-0-e2e-telcov10n-nrop-tls-scanner-5-0-nightly 38227b5 link unknown /pj-rehearse periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-5-0-e2e-telcov10n-nrop-tls-scanner-5-0-nightly

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants