From 69c5263093175ba631ff533788a08382d8c0a302 Mon Sep 17 00:00:00 2001 From: Ayoub Mrini Date: Thu, 13 Aug 2026 17:29:02 +0200 Subject: [PATCH 1/2] CMO: add TLS scanner step to e2e-agnostic-operator presubmit Add the tls-scanner-run step (strict Intermediate profile) to the e2e-agnostic-operator test so it executes on every PR. While the scanner already runs as a periodic, having it in a presubmit catches TLS regressions before merge instead of after. The step scans both the Platform (openshift-monitoring) and UWM (openshift-user-workload-monitoring) stacks and adds ~10 minutes to the job. The scanner only needs to run in CMO CI, not in operand-specific ones (Prometheus, Alertmanager), since all TLS configuration is applied on the CMO side. Add ipi-install-monitoring-uwm to the ipi-conf-aws chain. The step generates install-time manifests to enable the full UWM stack (UWM + UWM Alertmanager). It defaults to off and is a no-op unless ENABLE_USER_WORKLOAD_MONITORING is set to true. --- ...hift-cluster-monitoring-operator-main.yaml | 13 ++++++ .../ipi/conf/aws/ipi-conf-aws-chain.yaml | 1 + .../ipi/install/monitoring-uwm/OWNERS | 25 +++++++++++ .../ipi-install-monitoring-uwm-commands.sh | 42 +++++++++++++++++++ ...i-install-monitoring-uwm-ref.metadata.json | 31 ++++++++++++++ .../ipi-install-monitoring-uwm-ref.yaml | 20 +++++++++ 6 files changed, 132 insertions(+) create mode 100644 ci-operator/step-registry/ipi/install/monitoring-uwm/OWNERS create mode 100755 ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-commands.sh create mode 100644 ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.metadata.json create mode 100644 ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.yaml diff --git a/ci-operator/config/openshift/cluster-monitoring-operator/openshift-cluster-monitoring-operator-main.yaml b/ci-operator/config/openshift/cluster-monitoring-operator/openshift-cluster-monitoring-operator-main.yaml index 189ff9605357e..6bb4112d1e71d 100644 --- a/ci-operator/config/openshift/cluster-monitoring-operator/openshift-cluster-monitoring-operator-main.yaml +++ b/ci-operator/config/openshift/cluster-monitoring-operator/openshift-cluster-monitoring-operator-main.yaml @@ -3,6 +3,10 @@ base_images: name: hypershift-operator namespace: hypershift tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool build_root: from_repository: true images: @@ -106,8 +110,17 @@ tests: steps: cluster_profile: openshift-org-aws env: + ENABLE_USER_WORKLOAD_MONITORING: "true" + PQC_CHECK: "true" + SCAN_NAMESPACE: openshift-monitoring,openshift-user-workload-monitoring + SCANNER_CPU_LIMIT: "4" + SCANNER_CPU_REQUEST: 500m + SCANNER_MEM_LIMIT: 4Gi + SCANNER_MEM_REQUEST: 1Gi TELEMETRY_ENABLED: "true" + TLS_PROFILE_TYPE: Intermediate test: + - ref: tls-scanner-run - as: test cli: latest commands: make test-e2e diff --git a/ci-operator/step-registry/ipi/conf/aws/ipi-conf-aws-chain.yaml b/ci-operator/step-registry/ipi/conf/aws/ipi-conf-aws-chain.yaml index b190af15a46dd..0ec98094083df 100644 --- a/ci-operator/step-registry/ipi/conf/aws/ipi-conf-aws-chain.yaml +++ b/ci-operator/step-registry/ipi/conf/aws/ipi-conf-aws-chain.yaml @@ -6,5 +6,6 @@ chain: - ref: ipi-conf-aws - ref: ipi-conf-aws-byo-ipv4-pool-public - ref: ipi-install-monitoringpvc + - ref: ipi-install-monitoring-uwm documentation: |- The IPI configure step chain generates the install-config.yaml file based on the cluster profile and optional input files. diff --git a/ci-operator/step-registry/ipi/install/monitoring-uwm/OWNERS b/ci-operator/step-registry/ipi/install/monitoring-uwm/OWNERS new file mode 100644 index 0000000000000..32d7adde2d4e1 --- /dev/null +++ b/ci-operator/step-registry/ipi/install/monitoring-uwm/OWNERS @@ -0,0 +1,25 @@ +approvers: +- arajkumar +- bison +- dgrisonnet +- fpetkovski +- jan--f +- philipgough +- prashbnair +- raptorsun +- simonpasquier +- slashpai +- sthaha +options: {} +reviewers: +- arajkumar +- bison +- dgrisonnet +- fpetkovski +- jan--f +- philipgough +- prashbnair +- raptorsun +- simonpasquier +- slashpai +- sthaha diff --git a/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-commands.sh b/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-commands.sh new file mode 100755 index 0000000000000..f9b1a365933be --- /dev/null +++ b/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-commands.sh @@ -0,0 +1,42 @@ +#!/bin/bash +set -euo pipefail + +if [[ "${ENABLE_USER_WORKLOAD_MONITORING}" != "true" ]]; then + echo "ENABLE_USER_WORKLOAD_MONITORING is not 'true', nothing to do." + exit 0 +fi + +CONFIG="${SHARED_DIR}/manifest_cluster-monitoring-config.yaml" +PATCH="${SHARED_DIR}/cluster-monitoring-config.yaml.uwm-patch" + +if ! test -e "${CONFIG}"; then + cat > "${CONFIG}" << EOF +apiVersion: v1 +kind: ConfigMap +metadata: + name: cluster-monitoring-config + namespace: openshift-monitoring +data: + config.yaml: +EOF +fi + +cat > "${PATCH}" << EOF +enableUserWorkload: true +EOF + +CONFIG_CONTENTS="$(yq-go r "${CONFIG}" 'data."config.yaml"')" +CONFIG_CONTENTS="$(echo "${CONFIG_CONTENTS}" | yq-go m - "${PATCH}")" +yq-go w --style folded -i "${CONFIG}" 'data."config.yaml"' "${CONFIG_CONTENTS}" + +cat > "${SHARED_DIR}/manifest_user-workload-monitoring-config.yaml" << EOF +apiVersion: v1 +kind: ConfigMap +metadata: + name: user-workload-monitoring-config + namespace: openshift-user-workload-monitoring +data: + config.yaml: | + alertmanager: + enabled: true +EOF diff --git a/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.metadata.json b/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.metadata.json new file mode 100644 index 0000000000000..6029444216d20 --- /dev/null +++ b/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.metadata.json @@ -0,0 +1,31 @@ +{ + "path": "ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.yaml", + "owners": { + "approvers": [ + "arajkumar", + "bison", + "dgrisonnet", + "fpetkovski", + "jan--f", + "philipgough", + "prashbnair", + "raptorsun", + "simonpasquier", + "slashpai", + "sthaha" + ], + "reviewers": [ + "arajkumar", + "bison", + "dgrisonnet", + "fpetkovski", + "jan--f", + "philipgough", + "prashbnair", + "raptorsun", + "simonpasquier", + "slashpai", + "sthaha" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.yaml b/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.yaml new file mode 100644 index 0000000000000..9a93effa18cca --- /dev/null +++ b/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.yaml @@ -0,0 +1,20 @@ +ref: + as: ipi-install-monitoring-uwm + from_image: + namespace: ocp + name: "4.22" + tag: upi-installer + commands: ipi-install-monitoring-uwm-commands.sh + resources: + requests: + cpu: 100m + memory: 100Mi + env: + - name: ENABLE_USER_WORKLOAD_MONITORING + default: "false" + documentation: |- + Enable user workload monitoring: + * "false" (default) - do not enable user workload monitoring, making this step a no-op. + * "true" - enable user workload monitoring and user workload alertmanager. + documentation: |- + The IPI install monitoring-uwm step configures cluster-monitoring-operator to enable user workload monitoring and user workload alertmanager. It patches cluster-monitoring-config and creates user-workload-monitoring-config as install-time manifests. From f35e4a47ae8355be46b1799fdca72fa3a4a71b54 Mon Sep 17 00:00:00 2001 From: Ayoub Mrini Date: Thu, 13 Aug 2026 17:29:33 +0200 Subject: [PATCH 2/2] monitoring: sync step-registry OWNERS Update OWNERS for ipi-install-monitoringpvc and ipi-install-monitoring-uwm. --- .../ipi/install/monitoring-uwm/OWNERS | 22 +++++----------- ...i-install-monitoring-uwm-ref.metadata.json | 26 ++++++------------- .../ipi/install/monitoringpvc/OWNERS | 22 +++++----------- ...pi-install-monitoringpvc-ref.metadata.json | 26 ++++++------------- 4 files changed, 28 insertions(+), 68 deletions(-) diff --git a/ci-operator/step-registry/ipi/install/monitoring-uwm/OWNERS b/ci-operator/step-registry/ipi/install/monitoring-uwm/OWNERS index 32d7adde2d4e1..6ff1f5341c6a1 100644 --- a/ci-operator/step-registry/ipi/install/monitoring-uwm/OWNERS +++ b/ci-operator/step-registry/ipi/install/monitoring-uwm/OWNERS @@ -1,25 +1,15 @@ approvers: -- arajkumar -- bison -- dgrisonnet -- fpetkovski +- danielmellado - jan--f -- philipgough -- prashbnair -- raptorsun +- machine424 +- marioferh - simonpasquier - slashpai -- sthaha options: {} reviewers: -- arajkumar -- bison -- dgrisonnet -- fpetkovski +- danielmellado - jan--f -- philipgough -- prashbnair -- raptorsun +- machine424 +- marioferh - simonpasquier - slashpai -- sthaha diff --git a/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.metadata.json b/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.metadata.json index 6029444216d20..8228450608715 100644 --- a/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.metadata.json +++ b/ci-operator/step-registry/ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.metadata.json @@ -2,30 +2,20 @@ "path": "ipi/install/monitoring-uwm/ipi-install-monitoring-uwm-ref.yaml", "owners": { "approvers": [ - "arajkumar", - "bison", - "dgrisonnet", - "fpetkovski", + "danielmellado", "jan--f", - "philipgough", - "prashbnair", - "raptorsun", + "machine424", + "marioferh", "simonpasquier", - "slashpai", - "sthaha" + "slashpai" ], "reviewers": [ - "arajkumar", - "bison", - "dgrisonnet", - "fpetkovski", + "danielmellado", "jan--f", - "philipgough", - "prashbnair", - "raptorsun", + "machine424", + "marioferh", "simonpasquier", - "slashpai", - "sthaha" + "slashpai" ] } } \ No newline at end of file diff --git a/ci-operator/step-registry/ipi/install/monitoringpvc/OWNERS b/ci-operator/step-registry/ipi/install/monitoringpvc/OWNERS index 32d7adde2d4e1..6ff1f5341c6a1 100644 --- a/ci-operator/step-registry/ipi/install/monitoringpvc/OWNERS +++ b/ci-operator/step-registry/ipi/install/monitoringpvc/OWNERS @@ -1,25 +1,15 @@ approvers: -- arajkumar -- bison -- dgrisonnet -- fpetkovski +- danielmellado - jan--f -- philipgough -- prashbnair -- raptorsun +- machine424 +- marioferh - simonpasquier - slashpai -- sthaha options: {} reviewers: -- arajkumar -- bison -- dgrisonnet -- fpetkovski +- danielmellado - jan--f -- philipgough -- prashbnair -- raptorsun +- machine424 +- marioferh - simonpasquier - slashpai -- sthaha diff --git a/ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-ref.metadata.json b/ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-ref.metadata.json index 6ba7d897f480e..36284a492b8ec 100644 --- a/ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-ref.metadata.json +++ b/ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-ref.metadata.json @@ -2,30 +2,20 @@ "path": "ipi/install/monitoringpvc/ipi-install-monitoringpvc-ref.yaml", "owners": { "approvers": [ - "arajkumar", - "bison", - "dgrisonnet", - "fpetkovski", + "danielmellado", "jan--f", - "philipgough", - "prashbnair", - "raptorsun", + "machine424", + "marioferh", "simonpasquier", - "slashpai", - "sthaha" + "slashpai" ], "reviewers": [ - "arajkumar", - "bison", - "dgrisonnet", - "fpetkovski", + "danielmellado", "jan--f", - "philipgough", - "prashbnair", - "raptorsun", + "machine424", + "marioferh", "simonpasquier", - "slashpai", - "sthaha" + "slashpai" ] } } \ No newline at end of file