ci: re-enable tls-scanner as best_effort post step for RHOAI e2e

[ugiordan]

Summary

Re-enables the TLS scanner check for RHOAI that was reverted in #82675.

What changed vs the original PR #82555:

• tls-scanner-run is now a post step with best_effort: true instead of a blocking test step. This means it reports findings in CI artifacts without blocking PR merges while we confirm all legitimate violations are gone.
• PQC_CHECK: "true" and SCAN_NAMESPACE env vars are preserved (same as original).
• tls-scanner-tool base image re-added.

Why it was reverted (#82675):

The scanner flagged two categories of non-TLS endpoints:

1. rhods-operator-catalog port 50051: OLM file-based catalog gRPC server, plain-text by design in CI — not a compliance violation, not a production endpoint.
2. rhods-operator port 8080: metrics endpoint — fixed by opendatahub-operator#3888 (SecureServing for metrics, merged 2026-07-30). This should no longer appear.

Plan:

1. Land this PR with best_effort: true — scanner runs, reports, does not block.
2. Verify the only remaining finding is the catalog gRPC (expected/excluded) and the operator metrics endpoint is clean.
3. Once confirmed clean, promote tls-scanner-run back to a required step in a follow-up PR.

Reverts the revert of #82555 with the blocking behavior fixed.

/cc @Gowtham-Shanmugasundaram @davidebianchi

Summary by CodeRabbit

• Updates the OpenShift 4.20 CI configuration for the opendatahub-operator repository.
• Replaces GCP-based E2E workflows with AWS cluster-claim workflows for standard and RHOAI variants.
• Adds installation, preflight, E2E, and image-mirror jobs for both operator variants.
• Re-enables the RHOAI TLS scanner as a non-blocking post step with best_effort: true.
• Preserves PQC_CHECK and SCAN_NAMESPACE and restores the tls-scanner-tool image.
• Updates CI images, Go 1.26 build settings, caching, image substitutions, and image-mirror filtering.

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 98068cc8-1886-4471-8825-9f2cece65f60

📥 Commits

Reviewing files that changed from the base of the PR and between 18b0c15 and 15a2a08.

📒 Files selected for processing (1)

• ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml

---

Walkthrough

The CI configuration now targets OpenShift 4.20, builds standard and RHOAI operator artifacts, runs AWS-based E2E workflows, adds RHOAI TLS scanning, and mirrors variant-specific images with changed-file filtering.

Changes

Operator CI 4.20

Layer / File(s)	Summary
Build inputs and operator outputs ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml	The configuration uses RHEL 9 Go 1.26, build caching, new SDK and TLS scanner images, OpenShift 4.20, and standard and RHOAI image and bundle outputs.
AWS cluster-claim validation ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml	The E2E workflows use AWS cluster claims for standard and RHOAI variants. They install bundles, run E2E commands, perform preflight and image-mirror setup, and run RHOAI TLS scanning.
Variant image mirroring ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml	The standard image-mirror job filters changed files. A postsubmit RHOAI image-mirror job publishes the RHOAI release version.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant AWSClusterClaim
  participant OpenShift420Cluster
  participant OperatorBundle
  participant E2ERunner
  participant TLSScanner
  AWSClusterClaim->>OpenShift420Cluster: Provision cluster
  OpenShift420Cluster->>OperatorBundle: Install standard or RHOAI bundle
  OperatorBundle->>E2ERunner: Start E2E commands
  E2ERunner->>OpenShift420Cluster: Execute tests
  OpenShift420Cluster->>TLSScanner: Run RHOAI TLS scan

Loading

Possibly related PRs

• openshift/release#82154: Adds related TLS scanner images and workflow configuration.
• openshift/release#82659: Adds TLS scanning jobs and scanner images for another operator.

Suggested reviewers: davidebianchi, rinaldodev

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: re-enabling the RHOAI TLS scanner as a best-effort post step for E2E tests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The only changed file is CI YAML. Added job and step names are static, and the patch contains no Ginkgo title calls or dynamic test-name interpolation.
Test Structure And Quality	✅ Passed	The PR changes only one CI YAML file; it adds no Ginkgo source or It blocks, so the listed Ginkgo test-quality requirements are not applicable.
Microshift Test Compatibility	✅ Passed	The commit changes only one YAML CI configuration file (+140/-30) and adds no Go or Ginkgo e2e tests, so MicroShift test compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only one CI YAML file; no Go files or new Ginkgo It/Describe/Context/When tests were added, so the SNO test check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR changes only one CI YAML file. It adds CI images, bundles, cluster-claim workflows, and scanner steps, with no deployment manifests, controllers, replicas, affinity, topology, selectors, tol...
Ote Binary Stdout Contract	✅ Passed	The commit changes only one CI YAML file. It adds no OTE binary or Go process-level code, and its commands invoke operator-sdk, make e2e-test, and tls-scanner-run only.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit changes only CI YAML; it adds no Ginkgo declarations or test files, so this compatibility check is not applicable.
No-Weak-Crypto	✅ Passed	The PR changes only CI YAML. Exact searches found no MD5, SHA1, DES, 3DES, RC4, Blowfish, or ECB usage, crypto APIs, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The sole changed YAML file has no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root-user settings; referenced generic-claim and RBAC steps also have none.
No-Sensitive-Data-In-Logs	✅ Passed	The only changed file adds CI commands and a scanner reference; it contains no echo, printenv, tracing, or literal credentials, and secret usage is by named references only.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ugiordan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/opendatahub-io/opendatahub-operator/OWNERS [ugiordan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ugiordan]

Closing to reopen from a properly rebased branch — fork was stale causing a dirty base.

[openshift-merge-bot]

@ugiordan, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

couldn't prepare candidate: couldn't rebase candidate onto 18b0c157e83315a7d4fa756af0176427eee755a0 due to conflicts

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.