diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.22.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.22.yaml index 2a5580bc570b7..557c0223a8df8 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.22.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.23.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.23.yaml index 4cefb7b820a34..91197d720a7ce 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "false" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml index 5f801adaad86e..00e4b9913ebce 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "false" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.22.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.22.yaml index 33f9fd20211ac..57f2fe48b3383 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.22.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.8 org: medik8s diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml index e68f76fbf5e9c..f65b33543e9c1 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.8 org: medik8s diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml index 78048bf5279b1..68c461e65a07d 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.8 org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.22.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.22.yaml index 45fd763884b3d..269b1661cd01d 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.22.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: ubi namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -91,6 +95,39 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml index cfcdba9389264..ffa7c3c26c1b8 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: ubi namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -91,6 +95,74 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "false" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml index 4f6f6a0d969c2..89fb870e79c75 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: ubi namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -91,6 +95,74 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "false" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.22.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.22.yaml index 3a04059935bb8..35a5ade26a25f 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.22.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.22.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -81,6 +85,39 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.7 org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml index 0e3ffabd70ec0..e9fa4e556bc76 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -81,6 +85,39 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.7 org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml index f7a8db75ddfec..a4cf93755c934 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -81,6 +85,39 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.7 org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.22.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.22.yaml index f1c4b1baa9efe..1c8672cce19be 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.22.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.22.yaml @@ -7,6 +7,10 @@ base_images: name: claude-ai-helpers namespace: ci tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -101,6 +105,40 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG=quay.io/medik8s/self-node-remediation-operator-bundle:latest make bundle-run + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml index 927d3b322e14f..f865124b5b39a 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml @@ -7,6 +7,10 @@ base_images: name: claude-ai-helpers namespace: ci tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -101,6 +105,76 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG=quay.io/medik8s/self-node-remediation-operator-bundle:latest make bundle-run + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG=quay.io/medik8s/self-node-remediation-operator-bundle:latest make bundle-run + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml index aea324c0ca3ff..0e8a330966ddb 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml @@ -7,6 +7,10 @@ base_images: name: claude-ai-helpers namespace: ci tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -101,6 +105,76 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG=quay.io/medik8s/self-node-remediation-operator-bundle:latest make bundle-run + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG=quay.io/medik8s/self-node-remediation-operator-bundle:latest make bundle-run + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.22.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.22.yaml index 9c35fc84f9e49..cf915381d7ec9 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.22.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.22.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -84,6 +88,40 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.12 org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml index eba623116dfe1..a228b620f2903 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -84,6 +88,40 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.12 org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml index a0fcbed82fb44..cbcf8cc82d25a 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -84,6 +88,40 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.12 org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.22.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.22.yaml index 6fe529cd12b9d..efef3b7564597 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.22.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: "4.22" namespace: ocp tag: base + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -88,6 +92,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml index eaebc9c4aedfd..fda026dfc5a06 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: "4.23" namespace: ocp tag: base + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -88,6 +92,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml index a70988e1d8205..75665ba1a9e2f 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: "5.0" namespace: ocp tag: base + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -88,6 +92,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.22.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.22.yaml index 720b18222519c..a7916f9b7fdb1 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.22.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: "4.22" namespace: ocp tag: base + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -88,6 +92,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.21 org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml index de2bad83ca964..d3a69ba0957b6 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: "4.23" namespace: ocp tag: base + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -88,6 +92,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.21 org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml index 159e623e2e127..9e6ef4ff82669 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: "5.0" namespace: ocp tag: base + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -88,6 +92,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.21 org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.22.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.22.yaml index 81214f2645946..80df66cf51f98 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.22.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: ubi-minimal namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -90,6 +94,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml index 15ca0c19815e1..6ad3fc5fe0f7d 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: ubi-minimal namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -90,6 +94,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml index 4a2d71b0e590e..9494d1dced116 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: ubi-minimal namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -90,6 +94,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.22.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.22.yaml index d06bdc1ff0c92..8a32f0f8d86d1 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.22.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: ubi-minimal namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -90,6 +94,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.13 org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml index d8ba7a6e784b3..61e0d90acba30 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: ubi-minimal namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -90,6 +94,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.13 org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml index d7c3e689c4fcb..3195bdec85da6 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: ubi-minimal namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -90,6 +94,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.13 org: medik8s diff --git a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.22.yaml b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.22.yaml index 748c97e0d828d..a71e6b8246245 100644 --- a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.22.yaml +++ b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -117,6 +121,40 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: sbr-operator-system + PQC_CHECK: "true" + SCAN_NAMESPACE: sbr-operator-system + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + - env: SBR_AGENT_IMAGE + name: sbr-agent + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.23.yaml b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.23.yaml index 339cb5c56b963..db660c9d6c970 100644 --- a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -104,6 +108,76 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: sbr-operator-system + PQC_CHECK: "true" + SCAN_NAMESPACE: sbr-operator-system + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + - env: SBR_AGENT_IMAGE + name: sbr-agent + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: sbr-operator-system + PQC_CHECK: "false" + SCAN_NAMESPACE: sbr-operator-system + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + - env: SBR_AGENT_IMAGE + name: sbr-agent + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__5.0.yaml b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__5.0.yaml index 9afb07ca2f3ab..1d0c9e44dfb5c 100644 --- a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -104,6 +108,76 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: sbr-operator-system + PQC_CHECK: "true" + SCAN_NAMESPACE: sbr-operator-system + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + - env: SBR_AGENT_IMAGE + name: sbr-agent + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: sbr-operator-system + PQC_CHECK: "false" + SCAN_NAMESPACE: sbr-operator-system + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + - env: SBR_AGENT_IMAGE + name: sbr-agent + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-release-0.3__4.22.yaml b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-release-0.3__4.22.yaml index f62305131efe5..c8d875a1858f6 100644 --- a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-release-0.3__4.22.yaml +++ b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-release-0.3__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -117,6 +121,40 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: sbr-operator-system + PQC_CHECK: "true" + SCAN_NAMESPACE: sbr-operator-system + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + - env: SBR_AGENT_IMAGE + name: sbr-agent + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.3 org: medik8s diff --git a/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.23.yaml b/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.23.yaml new file mode 100644 index 0000000000000..e92c36f125114 --- /dev/null +++ b/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.23.yaml @@ -0,0 +1,61 @@ +base_images: + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool +build_root: + from_repository: true +releases: + latest: + release: + channel: stable + version: "4.23" +resources: + '*': + requests: + cpu: 500m + memory: 1000Mi +tests: +- as: tls13-adherence-all + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: openshift-workload-availability + OCP_VERSION: "423" + OO_CHANNEL: stable + OPERATORS: fence-agents-remediation,self-node-remediation,node-healthcheck-operator,node-maintenance-operator,machine-deletion-remediation,storage-based-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: openshift-workload-availability + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: medik8s-catalogsource + - ref: medik8s-operator-subscribe + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls-pqc-readiness-all + cron: 0 6 * * 3 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: openshift-workload-availability + OCP_VERSION: "423" + OO_CHANNEL: stable + OPERATORS: fence-agents-remediation,self-node-remediation,node-healthcheck-operator,node-maintenance-operator,machine-deletion-remediation,storage-based-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: openshift-workload-availability + test: + - ref: medik8s-catalogsource + - ref: medik8s-operator-subscribe + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +zz_generated_metadata: + branch: main + org: medik8s + repo: system-tests + variant: "4.23" diff --git a/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__5.0.yaml b/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__5.0.yaml new file mode 100644 index 0000000000000..451e68cd904d0 --- /dev/null +++ b/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__5.0.yaml @@ -0,0 +1,61 @@ +base_images: + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool +build_root: + from_repository: true +releases: + latest: + release: + channel: stable + version: "5.0" +resources: + '*': + requests: + cpu: 500m + memory: 1000Mi +tests: +- as: tls13-adherence-all + cron: 0 10 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: openshift-workload-availability + OCP_VERSION: "50" + OO_CHANNEL: stable + OPERATORS: fence-agents-remediation,self-node-remediation,node-healthcheck-operator,node-maintenance-operator,machine-deletion-remediation,storage-based-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: openshift-workload-availability + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: medik8s-catalogsource + - ref: medik8s-operator-subscribe + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls-pqc-readiness-all + cron: 0 10 * * 3 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: openshift-workload-availability + OCP_VERSION: "50" + OO_CHANNEL: stable + OPERATORS: fence-agents-remediation,self-node-remediation,node-healthcheck-operator,node-maintenance-operator,machine-deletion-remediation,storage-based-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: openshift-workload-availability + test: + - ref: medik8s-catalogsource + - ref: medik8s-operator-subscribe + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +zz_generated_metadata: + branch: main + org: medik8s + repo: system-tests + variant: "5.0" diff --git a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml index ee2d411de7321..1b503658fc2e3 100644 --- a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-main-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -554,6 +643,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1098,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml index 9d6cec4054bdd..82ea5c3f130aa 100644 --- a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml +++ b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.8$ + - ^release-0\.8- + cluster: build07 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-release-0.8-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -554,6 +643,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.8$ + - ^release-0\.8- + cluster: build07 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-release-0.8-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,92 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.8$ + - ^release-0\.8- + cluster: build07 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-release-0.8-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml index 059bf3f2b5d6e..00cca4c79f570 100644 --- a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-main-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -554,6 +643,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1098,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml index db24c06ba4e64..b824c1467f0a9 100644 --- a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml +++ b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.7$ + - ^release-0\.7- + cluster: build01 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -554,6 +643,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.7$ + - ^release-0\.7- + cluster: build01 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,92 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.7$ + - ^release-0\.7- + cluster: build01 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml index 5a9215260345a..9892c71a7b184 100644 --- a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-main-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -554,6 +643,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1098,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml index 9ff683410b00d..0df53cb1d4e85 100644 --- a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.12$ + - ^release-0\.12- + cluster: build10 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -554,6 +643,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.12$ + - ^release-0\.12- + cluster: build10 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,92 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.12$ + - ^release-0\.12- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml index f65870839d453..b32652ec83afa 100644 --- a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-main-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -554,6 +643,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1098,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml index 97abe94bdf4c2..c25532d6443c1 100644 --- a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.21$ + - ^release-0\.21- + cluster: build10 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-release-0.21-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -554,6 +643,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.21$ + - ^release-0\.21- + cluster: build10 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-release-0.21-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,92 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.21$ + - ^release-0\.21- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-release-0.21-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml index 441dfbc75290c..e0da4eb44fa82 100644 --- a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build05 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-main-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -554,6 +643,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build05 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build05 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1098,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build05 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build05 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml index 69a06b7105916..1f97c1fcd8d87 100644 --- a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml +++ b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.13$ + - ^release-0\.13- + cluster: build05 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-release-0.13-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -554,6 +643,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.13$ + - ^release-0\.13- + cluster: build05 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-release-0.13-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,92 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.13$ + - ^release-0\.13- + cluster: build05 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-release-0.13-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml index 2082b9d7f96ff..b77f8957ba224 100644 --- a/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml @@ -211,6 +211,96 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-openshift-e2e,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - cmd/sbr-agent/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-storage-based-remediation-main-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -422,6 +512,186 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-openshift-e2e,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - cmd/sbr-agent/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-storage-based-remediation-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - cmd/sbr-agent/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-storage-based-remediation-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -633,3 +903,183 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-openshift-e2e,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - cmd/sbr-agent/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-storage-based-remediation-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - cmd/sbr-agent/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-storage-based-remediation-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-release-0.3-presubmits.yaml b/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-release-0.3-presubmits.yaml index 76fe13d88c3d4..1c8d7107db32a 100644 --- a/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-release-0.3-presubmits.yaml +++ b/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-release-0.3-presubmits.yaml @@ -422,3 +422,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-openshift-e2e,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.3$ + - ^release-0\.3- + cluster: build09 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - cmd/sbr-agent/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-storage-based-remediation-release-0.3-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-periodics.yaml b/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-periodics.yaml index 1c26612bf73c9..7559ec84d4450 100644 --- a/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-periodics.yaml +++ b/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-periodics.yaml @@ -1031,3 +1031,343 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build01 + cron: 0 6 * * 3 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + extra_refs: + - base_ref: main + org: medik8s + repo: system-tests + sparse_checkout_files: + - .ci-operator.yaml + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-system-tests-main-4.23-tls-pqc-readiness-all + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-all + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build01 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + extra_refs: + - base_ref: main + org: medik8s + repo: system-tests + sparse_checkout_files: + - .ci-operator.yaml + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-system-tests-main-4.23-tls13-adherence-all + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-all + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build01 + cron: 0 10 * * 3 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + extra_refs: + - base_ref: main + org: medik8s + repo: system-tests + sparse_checkout_files: + - .ci-operator.yaml + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-system-tests-main-5.0-tls-pqc-readiness-all + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-all + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build01 + cron: 0 10 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + extra_refs: + - base_ref: main + org: medik8s + repo: system-tests + sparse_checkout_files: + - .ci-operator.yaml + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-system-tests-main-5.0-tls13-adherence-all + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-all + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator