From cc0691dc67a6a7fcc52d2576e4549cdf26106323 Mon Sep 17 00:00:00 2001 From: Wesley Hayutin Date: Thu, 25 Jun 2026 10:09:21 -0600 Subject: [PATCH] DNM: add tls and pqc checks for RHWA operators Signed-off-by: Wesley Hayutin --- ...8s-fence-agents-remediation-main__5.0.yaml | 134 +++++++++++++ ...e-agents-remediation-release-0.8__5.0.yaml | 134 +++++++++++++ ...achine-deletion-remediation-main__5.0.yaml | 138 ++++++++++++++ ...deletion-remediation-release-0.7__5.0.yaml | 138 ++++++++++++++ ...s-node-healthcheck-operator-main__5.0.yaml | 142 ++++++++++++++ ...ealthcheck-operator-release-0.12__5.0.yaml | 142 ++++++++++++++ ...s-node-maintenance-operator-main__5.0.yaml | 134 +++++++++++++ ...aintenance-operator-release-0.21__5.0.yaml | 134 +++++++++++++ ...dik8s-self-node-remediation-main__5.0.yaml | 134 +++++++++++++ ...lf-node-remediation-release-0.13__5.0.yaml | 134 +++++++++++++ ...nce-agents-remediation-main-periodics.yaml | 177 ++++++++++++++++++ ...ce-agents-remediation-main-presubmits.yaml | 176 +++++++++++++++++ ...nts-remediation-release-0.8-periodics.yaml | 177 ++++++++++++++++++ ...ts-remediation-release-0.8-presubmits.yaml | 176 +++++++++++++++++ ...e-deletion-remediation-main-periodics.yaml | 177 ++++++++++++++++++ ...-deletion-remediation-main-presubmits.yaml | 176 +++++++++++++++++ ...ion-remediation-release-0.7-periodics.yaml | 177 ++++++++++++++++++ ...on-remediation-release-0.7-presubmits.yaml | 176 +++++++++++++++++ ...e-healthcheck-operator-main-periodics.yaml | 177 ++++++++++++++++++ ...-healthcheck-operator-main-presubmits.yaml | 176 +++++++++++++++++ ...check-operator-release-0.12-periodics.yaml | 177 ++++++++++++++++++ ...heck-operator-release-0.12-presubmits.yaml | 176 +++++++++++++++++ ...e-maintenance-operator-main-periodics.yaml | 177 ++++++++++++++++++ ...-maintenance-operator-main-presubmits.yaml | 176 +++++++++++++++++ ...nance-operator-release-0.21-periodics.yaml | 177 ++++++++++++++++++ ...ance-operator-release-0.21-presubmits.yaml | 176 +++++++++++++++++ ...-self-node-remediation-main-periodics.yaml | 177 ++++++++++++++++++ ...self-node-remediation-main-presubmits.yaml | 176 +++++++++++++++++ ...de-remediation-release-0.13-periodics.yaml | 177 ++++++++++++++++++ ...e-remediation-release-0.13-presubmits.yaml | 176 +++++++++++++++++ 30 files changed, 4894 insertions(+) create mode 100644 ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-periodics.yaml create mode 100644 ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-periodics.yaml create mode 100644 ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-periodics.yaml create mode 100644 ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-periodics.yaml create mode 100644 ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-periodics.yaml create mode 100644 ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-periodics.yaml create mode 100644 ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-periodics.yaml create mode 100644 ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-periodics.yaml create mode 100644 ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-periodics.yaml create mode 100644 ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-periodics.yaml diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml index 54b0e91eb2cca..28d7be1ae2010 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: "5.0" + namespace: ocp + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,136 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls-pqc-readiness-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- always_run: false + as: tls13-adherence + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "false" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "false" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml index 78048bf5279b1..1ddf6690b8f2c 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: "5.0" + namespace: ocp + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,136 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls-pqc-readiness-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- always_run: false + as: tls13-adherence + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "false" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "false" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.8 org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml index 42b8d3562e46a..5f4368956137b 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: "5.0" + namespace: ocp + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -81,6 +85,140 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls-pqc-readiness-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- always_run: false + as: tls13-adherence + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "false" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "false" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml index f7a8db75ddfec..6b01c21f0a390 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: "5.0" + namespace: ocp + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -81,6 +85,140 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls-pqc-readiness-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- always_run: false + as: tls13-adherence + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "false" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "false" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.7 org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml index 9f552e4edd67d..a0d11d2a1b044 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: "5.0" + namespace: ocp + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -84,6 +88,144 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls-pqc-readiness-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- always_run: false + as: tls13-adherence + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml index a0fcbed82fb44..938c6251ee539 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: "5.0" + namespace: ocp + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -84,6 +88,144 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls-pqc-readiness-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- always_run: false + as: tls13-adherence + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.12 org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml index 84302a31fff69..b571e69b87687 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: "5.0" namespace: ocp tag: base + tls-scanner-tool: + name: "5.0" + namespace: ocp + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -88,6 +92,136 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls-pqc-readiness-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- always_run: false + as: tls13-adherence + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml index 159e623e2e127..9c20d211ffd91 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: "5.0" namespace: ocp tag: base + tls-scanner-tool: + name: "5.0" + namespace: ocp + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -88,6 +92,136 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls-pqc-readiness-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- always_run: false + as: tls13-adherence + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.21 org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml index f75376b74dbc4..6e00cc7894006 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: ubi-minimal namespace: ocp tag: "9" + tls-scanner-tool: + name: "5.0" + namespace: ocp + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -90,6 +94,136 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls-pqc-readiness-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- always_run: false + as: tls13-adherence + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml index d7c3e689c4fcb..689a552dc6110 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: ubi-minimal namespace: ocp tag: "9" + tls-scanner-tool: + name: "5.0" + namespace: ocp + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -90,6 +94,136 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls-pqc-readiness-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- always_run: false + as: tls13-adherence + optional: true + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.13 org: medik8s diff --git a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-periodics.yaml b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-periodics.yaml new file mode 100644 index 0000000000000..7cb79c290bab5 --- /dev/null +++ b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-periodics.yaml @@ -0,0 +1,177 @@ +periodics: +- agent: kubernetes + cluster: build07 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: main + org: medik8s + repo: fence-agents-remediation + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-fence-agents-remediation-main-5.0-tls-pqc-readiness-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build07 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: main + org: medik8s + repo: fence-agents-remediation + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-fence-agents-remediation-main-5.0-tls13-adherence-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml index e72add4fa52a4..de24dc6ef5ce2 100644 --- a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml @@ -831,3 +831,179 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-periodics.yaml b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-periodics.yaml new file mode 100644 index 0000000000000..cd07bd8470056 --- /dev/null +++ b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-periodics.yaml @@ -0,0 +1,177 @@ +periodics: +- agent: kubernetes + cluster: build06 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: release-0.8 + org: medik8s + repo: fence-agents-remediation + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-fence-agents-remediation-release-0.8-5.0-tls-pqc-readiness-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build06 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: release-0.8 + org: medik8s + repo: fence-agents-remediation + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-fence-agents-remediation-release-0.8-5.0-tls13-adherence-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml index 9d6cec4054bdd..af8c49606f52b 100644 --- a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml +++ b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml @@ -831,3 +831,179 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.8$ + - ^release-0\.8- + cluster: build07 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-release-0.8-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.8$ + - ^release-0\.8- + cluster: build07 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-release-0.8-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-periodics.yaml b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-periodics.yaml new file mode 100644 index 0000000000000..7b7cd6a22a650 --- /dev/null +++ b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-periodics.yaml @@ -0,0 +1,177 @@ +periodics: +- agent: kubernetes + cluster: build01 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: main + org: medik8s + repo: machine-deletion-remediation + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-machine-deletion-remediation-main-5.0-tls-pqc-readiness-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build01 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: main + org: medik8s + repo: machine-deletion-remediation + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-machine-deletion-remediation-main-5.0-tls13-adherence-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml index 42837ad80c879..c97c4e89aaa51 100644 --- a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml @@ -831,3 +831,179 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-periodics.yaml b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-periodics.yaml new file mode 100644 index 0000000000000..c593b030652f0 --- /dev/null +++ b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-periodics.yaml @@ -0,0 +1,177 @@ +periodics: +- agent: kubernetes + cluster: build11 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: release-0.7 + org: medik8s + repo: machine-deletion-remediation + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-machine-deletion-remediation-release-0.7-5.0-tls-pqc-readiness-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build11 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: release-0.7 + org: medik8s + repo: machine-deletion-remediation + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-machine-deletion-remediation-release-0.7-5.0-tls13-adherence-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml index db24c06ba4e64..4fcad531de96f 100644 --- a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml +++ b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml @@ -831,3 +831,179 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.7$ + - ^release-0\.7- + cluster: build01 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.7$ + - ^release-0\.7- + cluster: build01 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-periodics.yaml b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-periodics.yaml new file mode 100644 index 0000000000000..22696b675ec44 --- /dev/null +++ b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-periodics.yaml @@ -0,0 +1,177 @@ +periodics: +- agent: kubernetes + cluster: build09 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: main + org: medik8s + repo: node-healthcheck-operator + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-node-healthcheck-operator-main-5.0-tls-pqc-readiness-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build09 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: main + org: medik8s + repo: node-healthcheck-operator + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-node-healthcheck-operator-main-5.0-tls13-adherence-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml index e230e63dd1c3d..2e14a70613367 100644 --- a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml @@ -831,3 +831,179 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-periodics.yaml b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-periodics.yaml new file mode 100644 index 0000000000000..d7e68f8d8b531 --- /dev/null +++ b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-periodics.yaml @@ -0,0 +1,177 @@ +periodics: +- agent: kubernetes + cluster: build09 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: release-0.12 + org: medik8s + repo: node-healthcheck-operator + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-node-healthcheck-operator-release-0.12-5.0-tls-pqc-readiness-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build09 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: release-0.12 + org: medik8s + repo: node-healthcheck-operator + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-node-healthcheck-operator-release-0.12-5.0-tls13-adherence-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml index 9ff683410b00d..ec570bf0254ba 100644 --- a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml @@ -831,3 +831,179 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.12$ + - ^release-0\.12- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.12$ + - ^release-0\.12- + cluster: build10 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-periodics.yaml b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-periodics.yaml new file mode 100644 index 0000000000000..a2bc49b748c6c --- /dev/null +++ b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-periodics.yaml @@ -0,0 +1,177 @@ +periodics: +- agent: kubernetes + cluster: build09 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: main + org: medik8s + repo: node-maintenance-operator + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-node-maintenance-operator-main-5.0-tls-pqc-readiness-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build09 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: main + org: medik8s + repo: node-maintenance-operator + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-node-maintenance-operator-main-5.0-tls13-adherence-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml index 5388f2e4f2c9d..d69a0dcea49b4 100644 --- a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml @@ -831,3 +831,179 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-periodics.yaml b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-periodics.yaml new file mode 100644 index 0000000000000..eea00de9b2ba3 --- /dev/null +++ b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-periodics.yaml @@ -0,0 +1,177 @@ +periodics: +- agent: kubernetes + cluster: build09 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: release-0.21 + org: medik8s + repo: node-maintenance-operator + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-node-maintenance-operator-release-0.21-5.0-tls-pqc-readiness-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build09 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: release-0.21 + org: medik8s + repo: node-maintenance-operator + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-node-maintenance-operator-release-0.21-5.0-tls13-adherence-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml index 97abe94bdf4c2..8c543aa64389a 100644 --- a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml @@ -831,3 +831,179 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.21$ + - ^release-0\.21- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-release-0.21-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.21$ + - ^release-0\.21- + cluster: build10 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-release-0.21-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-periodics.yaml b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-periodics.yaml new file mode 100644 index 0000000000000..c981e309b337a --- /dev/null +++ b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-periodics.yaml @@ -0,0 +1,177 @@ +periodics: +- agent: kubernetes + cluster: build03 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: main + org: medik8s + repo: self-node-remediation + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-self-node-remediation-main-5.0-tls-pqc-readiness-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build03 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: main + org: medik8s + repo: self-node-remediation + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-self-node-remediation-main-5.0-tls13-adherence-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml index dd5b906b6a549..a470fc537bc96 100644 --- a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml @@ -831,3 +831,179 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build05 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build05 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-periodics.yaml b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-periodics.yaml new file mode 100644 index 0000000000000..ba37fdfd93204 --- /dev/null +++ b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-periodics.yaml @@ -0,0 +1,177 @@ +periodics: +- agent: kubernetes + cluster: build03 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: release-0.13 + org: medik8s + repo: self-node-remediation + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-self-node-remediation-release-0.13-5.0-tls-pqc-readiness-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build03 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + extra_refs: + - base_ref: release-0.13 + org: medik8s + repo: self-node-remediation + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-self-node-remediation-release-0.13-5.0-tls13-adherence-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-periodic + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml index 69a06b7105916..41f2886c42f5d 100644 --- a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml +++ b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml @@ -831,3 +831,179 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.13$ + - ^release-0\.13- + cluster: build05 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-release-0.13-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.13$ + - ^release-0\.13- + cluster: build05 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-release-0.13-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*)