From c800a7672cceebe15a38dbf7acb9da9279fc0fd0 Mon Sep 17 00:00:00 2001 From: Joao Fula Date: Mon, 10 Aug 2026 12:42:39 +0200 Subject: [PATCH 1/5] OLS-3353 Add tls-scan presubmit job for lightspeed-service --- .../openshift-lightspeed-service-main.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml b/ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml index e793ef770439f..c6ee445e7f942 100644 --- a/ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml +++ b/ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml @@ -31,6 +31,11 @@ tests: container: from: src skip_if_only_changed: ^docs/|\.md$|^\.tekton/|^\.github/|^hack/|^(?:.*/)?(?:\.gitignore|\.snyk|\.dockerignore|OWNERS|PROJECT|LICENSE)$ +- as: tls-scan + commands: make install-deps && make tls-scan + container: + from: src + skip_if_only_changed: ^docs/|\.md$|^\.tekton/|^\.github/|^hack/|^(?:.*/)?(?:\.gitignore|\.snyk|\.dockerignore|OWNERS|PROJECT|LICENSE)$ - as: unit commands: | export CODECOV_TOKEN=$(cat /tmp/secret/CODECOV_TOKEN) From a12dbcecefabd7e22975c38fca95b533bf45133e Mon Sep 17 00:00:00 2001 From: Joao Fula Date: Mon, 10 Aug 2026 13:06:50 +0200 Subject: [PATCH 2/5] running make jobs --- ...ft-lightspeed-service-main-presubmits.yaml | 65 +++++++++++++++++++ 1 file changed, 65 insertions(+) diff --git a/ci-operator/jobs/openshift/lightspeed-service/openshift-lightspeed-service-main-presubmits.yaml b/ci-operator/jobs/openshift/lightspeed-service/openshift-lightspeed-service-main-presubmits.yaml index 3beb04b913b2d..66c3110518f6b 100644 --- a/ci-operator/jobs/openshift/lightspeed-service/openshift-lightspeed-service-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/lightspeed-service/openshift-lightspeed-service-main-presubmits.yaml @@ -470,6 +470,71 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )security,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build12 + context: ci/prow/tls-scan + decorate: true + decoration_config: + sparse_checkout_files: + - Containerfile + labels: + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-lightspeed-service-main-tls-scan + rerun_command: /test tls-scan + skip_if_only_changed: ^docs/|\.md$|^\.tekton/|^\.github/|^hack/|^(?:.*/)?(?:\.gitignore|\.snyk|\.dockerignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --report-credentials-file=/etc/report/credentials + - --target=tls-scan + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-scan,?($|\s.*) - agent: kubernetes always_run: false branches: From 3b49b0280c90c8f73ff888b3111c03a60b6f1518 Mon Sep 17 00:00:00 2001 From: Joao Fula Date: Tue, 11 Aug 2026 10:52:54 +0200 Subject: [PATCH 3/5] OLS-3353 use pre-built image for tls-scanner instead of podman The tls-scan CI step was failing because podman cannot create containers inside unprivileged Prow test pods (exit code 125). Build a tls-scan-src image via ci-operator that layers the scanner binary from the QE image onto src, so the script finds it pre-installed and skips the podman extraction path. Co-Authored-By: Claude Opus 4.6 --- .../openshift-lightspeed-service-main.yaml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml b/ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml index c6ee445e7f942..66192641cbe50 100644 --- a/ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml +++ b/ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml @@ -2,12 +2,17 @@ build_root: project_image: dockerfile_literal: | FROM registry.ci.openshift.org/ocp/ubi-python-311:9 - USER 0 - RUN dnf install -y podman images: items: - dockerfile_path: Containerfile to: lightspeed-service-api + - dockerfile_literal: | + FROM quay.io/openshift-lightspeed/ols-qe:tls-scanner AS scanner + FROM src + COPY --from=scanner /usr/local/bin/tls-scanner /usr/local/bin/tls-scanner + COPY --from=scanner /opt/testssl /opt/testssl + from: src + to: tls-scan-src promotion: to: - namespace: ols @@ -34,7 +39,7 @@ tests: - as: tls-scan commands: make install-deps && make tls-scan container: - from: src + from: tls-scan-src skip_if_only_changed: ^docs/|\.md$|^\.tekton/|^\.github/|^hack/|^(?:.*/)?(?:\.gitignore|\.snyk|\.dockerignore|OWNERS|PROJECT|LICENSE)$ - as: unit commands: | From f880b2c1fc9e5d4dc9c7a6778289610b9e25e6f9 Mon Sep 17 00:00:00 2001 From: Joao Fula Date: Tue, 11 Aug 2026 11:04:42 +0200 Subject: [PATCH 4/5] OLS-3353 restore build_root USER 0 and podman install MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous commit incorrectly removed USER 0 and podman from build_root, which is shared by all test steps (verify, unit, integration). Restore them — only the tls-scan step needs the new tls-scan-src image. Co-Authored-By: Claude Opus 4.6 --- .../lightspeed-service/openshift-lightspeed-service-main.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml b/ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml index 66192641cbe50..c79cfd4b434a2 100644 --- a/ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml +++ b/ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml @@ -2,6 +2,8 @@ build_root: project_image: dockerfile_literal: | FROM registry.ci.openshift.org/ocp/ubi-python-311:9 + USER 0 + RUN dnf install -y podman images: items: - dockerfile_path: Containerfile From 2957f3e07c9ff6fd16cc01b74f256b04261d5554 Mon Sep 17 00:00:00 2001 From: Joao Fula Date: Thu, 13 Aug 2026 09:34:51 +0200 Subject: [PATCH 5/5] removing k8s envs removing byok changes --- .../lightspeed-service/openshift-lightspeed-service-main.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml b/ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml index c79cfd4b434a2..c99c92126a324 100644 --- a/ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml +++ b/ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml @@ -39,7 +39,8 @@ tests: from: src skip_if_only_changed: ^docs/|\.md$|^\.tekton/|^\.github/|^hack/|^(?:.*/)?(?:\.gitignore|\.snyk|\.dockerignore|OWNERS|PROJECT|LICENSE)$ - as: tls-scan - commands: make install-deps && make tls-scan + commands: unset KUBERNETES_SERVICE_HOST KUBERNETES_SERVICE_PORT && make install-deps + && make tls-scan container: from: tls-scan-src skip_if_only_changed: ^docs/|\.md$|^\.tekton/|^\.github/|^hack/|^(?:.*/)?(?:\.gitignore|\.snyk|\.dockerignore|OWNERS|PROJECT|LICENSE)$