Add dedicated tls-scanner for NROP operator#82110
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: mrniranjan The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds an NROP ML-KEM TLS scanner workflow, ownership metadata, and an OpenShift 5.0 nightly CI configuration with scanner settings and JUnit result handling. ChangesNROP TLS scanner
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Workflow as TLS scanner workflow
participant Cluster as NROP cluster setup
participant Scanner as tls-scanner-run
participant Reports as JUnit verification
Workflow->>Cluster: Deploy and configure NROP
Workflow->>Scanner: Run ML-KEM TLS scan
Scanner->>Reports: Verify JUnit reports
Suggested labels: Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
217f91c to
ec01a99
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/telcov10n-functional-cnf-compute-nrop-tls-scanner-workflow.yaml`:
- Around line 3-10: Add a post phase to the workflow alongside pre and test,
referencing an appropriate existing step or chain; preserve the current phases
and validate the step registry with make validate-step-registry.
- Around line 10-15: Update the tls-scanner-run workflow/ref configuration so it
sets the runner-consumed TLS_SCANNER_PQC_PASS variable to true, ensuring
tls-scanner-run-commands.sh adds --pqc-check. Remove or align the unused
PQC_CHECK declaration so the workflow’s configuration matches the variable
actually read by the runner and the documented ML-KEM validation runs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 0b44c111-86c7-4e47-a125-b65b755bf7f6
⛔ Files ignored due to path filters (1)
ci-operator/jobs/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main-periodics.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (4)
ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage.yamlci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/OWNERSci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/telcov10n-functional-cnf-compute-nrop-tls-scanner-workflow.metadata.jsonci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/telcov10n-functional-cnf-compute-nrop-tls-scanner-workflow.yaml
🚧 Files skipped from review as they are similar to previous changes (3)
- ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/telcov10n-functional-cnf-compute-nrop-tls-scanner-workflow.metadata.json
- ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/OWNERS
- ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage.yaml
ec01a99 to
7ebd61f
Compare
- Create telcov10n-functional-cnf-compute-nrop-tls-scanner workflow - Add e2e-telcov10n-nrop-tls-scanner-5-0-nightly job - Schedule: Sunday 09:00 UTC (safe 1hr buffer before/2hr after) - Fast ML-KEM validation without full e2e tests (~45 min) - PQC_CHECK=true for post-quantum cryptography validation - Scans openshift-numaresources namespace only - Relates to PLMPGM-7881 (ML-KEM validation requirement) - Runs on Sunday 08:00 UTC Assisted by: Claude Sonnet 4.5 Signed-off-by: Niranjan M.R <mniranja@redhat.com>
7ebd61f to
b2e0e05
Compare
There was a problem hiding this comment.
don't we need an analyser here for the results? IOW if the scanner found that the TLS adherance is not as expected are we sure that that would be reflected in the TLS scanner exit code?
|
@mrniranjan Thanks for addressing. Can we have a trial/rehearsal run with the TLS Scanner in place to ensure the goal of this PR is met? |
|
Yes, the scanner exit code DOES reflect TLS adherence failures. ...
|
|
@shajmakh i will provide the results as soon as cluster is available. |
…ble jobs Split openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage.yaml into: - openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage.yaml (stable: 4.14-4.22) - openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage-5-0.yaml (nightly 5.0 only) The releases: section for 5.0 nightly was being applied to all jobs in the original file, causing stable version jobs (4.14, 4.16, 4.18, 4.19, 4.20, 4.21, 4.22) to unnecessarily build the 5.0 nightly release, adding 30-40 minutes to each job. Impact: - Stable version jobs (7 total): No longer build 5.0 nightly (-30-40 min each) - 5.0 nightly jobs (2 total): Continue to build 5.0 nightly as needed - Total time saved: ~4-5 hours per week The 5.0-specific file contains both: - e2e-telcov10n-nrop-tests-5-0-nightly (full e2e tests) - e2e-telcov10n-nrop-tls-scanner-5-0-nightly (TLS scanner only) Signed-off-by: Niranjan M.R <mniranja@redhat.com>
|
/pj-rehearse periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-5-0-e2e-telcov10n-nrop-tls-scanner-5-0-nightly |
|
@eifrach: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Signed-off-by: Niranjan M.R <mniranja@redhat.com>
Use the below workaround to reuse existing namespaces set TLS_SCANNER_CLUSTER_LABEL: management Signed-off-by: Niranjan M.R <mniranja@redhat.com>
Signed-off-by: Niranjan M.R <mniranja@redhat.com>
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
@mrniranjan: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Assisted by: Claude Sonnet 4.5
Summary by CodeRabbit
Updates OpenShift CI/CD infrastructure for the NROP operator 5.0 by separating the 5.0 nightly schedules into a dedicated stage-5-0 config and adding a purpose-built TLS scanner job to satisfy the ML-KEM validation requirement without running full functional end-to-end tests.
e2e-telcov10n-nrop-tests-5-0-nightly) fromopenshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage.yaml, and introduces a newopenshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage-5-0.yamlthat contains both the NROP functional workflow job and the new TLS scanner job.e2e-telcov10n-nrop-tls-scanner-5-0-nightlyscheduled for Sundays (cron: 0 8 * * 0). It runs with nightly OCP (stream nightly, version "5.0") and targets onlyopenshift-numaresourcesviaSCAN_NAMESPACE. Post-quantum validation is enabled withPQC_CHECK: "true"and scanner sizing withSCANNER_CPU: "2", invokingtelcov10n-functional-cnf-compute-nrop-tls-scanner.telcov10n-functional-cnf-compute-nrop-tls-scannerworkflow that:tls-scanner-runwithTLS_SCANNER_PQC_PASS(default"true") to validate ML-KEM/post-quantum TLS behavior,telcov10n-verify-junit-reports), with job pass/fail driven by the scanner pod exit code.tls-scanner-toolbase image in the stage-5-0 config and updates TLS scanner ownership by adding explicitapproversto the TLS scannerOWNERSfile and populating workflow metadata with the same approvers.