From 3441a0b4dc57cb9220fb862533c33ed970bfb85e Mon Sep 17 00:00:00 2001 From: JonahSussman Date: Thu, 13 Aug 2026 12:12:59 -0400 Subject: [PATCH 1/9] medik8s: add TLS 1.3 / PQC scanner CI for all operators Wire the TLS scanner into CI for all six medik8s operators (FAR, SNR, NHC, NMO, MDR, SBR) on both the 5.0 and 4.23 payloads, as part of the OCP 5.0 TLS compliance effort (RHWA-555). Per operator: two non-blocking presubmits (tls13-adherence and tls-pqc-readiness) auto-run via run_if_changed on TLS-relevant paths. Each installs the PR's bundle, patches the APIServer to Modern (ref: tls-13), and runs the scanner (ref: tls-scanner-run). Consolidated weekly periodics live under ci-operator/config/medik8s/system-tests (main only): tls13-adherence-all and tls-pqc-readiness-all install all six operators on a single cluster from the stable OLM catalog and scan once each -- 4 weekly cluster provisions total rather than one per operator. The scanner base image uses the version-independent tls-scanner pin, so the same declaration works for both 4.23 and 5.0. Signed-off-by: JonahSussman --- ...s-fence-agents-remediation-main__4.23.yaml | 70 ++++++++++++++++++ ...8s-fence-agents-remediation-main__5.0.yaml | 70 ++++++++++++++++++ ...-agents-remediation-release-0.8__4.23.yaml | 70 ++++++++++++++++++ ...e-agents-remediation-release-0.8__5.0.yaml | 70 ++++++++++++++++++ ...chine-deletion-remediation-main__4.23.yaml | 68 +++++++++++++++++ ...achine-deletion-remediation-main__5.0.yaml | 72 ++++++++++++++++++ ...eletion-remediation-release-0.7__4.23.yaml | 68 +++++++++++++++++ ...deletion-remediation-release-0.7__5.0.yaml | 72 ++++++++++++++++++ ...-node-healthcheck-operator-main__4.23.yaml | 70 ++++++++++++++++++ ...s-node-healthcheck-operator-main__5.0.yaml | 74 +++++++++++++++++++ ...althcheck-operator-release-0.12__4.23.yaml | 70 ++++++++++++++++++ ...ealthcheck-operator-release-0.12__5.0.yaml | 74 +++++++++++++++++++ ...-node-maintenance-operator-main__4.23.yaml | 66 +++++++++++++++++ ...s-node-maintenance-operator-main__5.0.yaml | 70 ++++++++++++++++++ ...intenance-operator-release-0.21__4.23.yaml | 66 +++++++++++++++++ ...aintenance-operator-release-0.21__5.0.yaml | 70 ++++++++++++++++++ ...ik8s-self-node-remediation-main__4.23.yaml | 66 +++++++++++++++++ ...dik8s-self-node-remediation-main__5.0.yaml | 70 ++++++++++++++++++ ...f-node-remediation-release-0.13__4.23.yaml | 66 +++++++++++++++++ ...lf-node-remediation-release-0.13__5.0.yaml | 70 ++++++++++++++++++ ...-storage-based-remediation-main__4.23.yaml | 74 +++++++++++++++++++ ...s-storage-based-remediation-main__5.0.yaml | 74 +++++++++++++++++++ .../medik8s-system-tests-main__4.23.yaml | 61 +++++++++++++++ .../medik8s-system-tests-main__5.0.yaml | 61 +++++++++++++++ 24 files changed, 1662 insertions(+) create mode 100644 ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.23.yaml create mode 100644 ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__5.0.yaml diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.23.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.23.yaml index 4cefb7b820a34..b4dff8ede7c24 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "false" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml index 5f801adaad86e..d03abc2133ecb 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "false" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml index e68f76fbf5e9c..cdc38e4e79912 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "false" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.8 org: medik8s diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml index 78048bf5279b1..b5e116c191815 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "false" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.8 org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml index cfcdba9389264..a6f31e410005d 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml @@ -91,6 +91,74 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "false" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml index 4f6f6a0d969c2..7850cb2972433 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: ubi namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -91,6 +95,74 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "false" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml index 0e3ffabd70ec0..07b4e62c33164 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml @@ -81,6 +81,74 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "false" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.7 org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml index f7a8db75ddfec..393e2b64da111 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -81,6 +85,74 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "false" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.7 org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml index 927d3b322e14f..f42f76f5b4c5e 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml @@ -101,6 +101,76 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG=quay.io/medik8s/self-node-remediation-operator-bundle:latest make bundle-run + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG=quay.io/medik8s/self-node-remediation-operator-bundle:latest make bundle-run + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml index aea324c0ca3ff..629343e29ac95 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml @@ -7,6 +7,10 @@ base_images: name: claude-ai-helpers namespace: ci tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -101,6 +105,76 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG=quay.io/medik8s/self-node-remediation-operator-bundle:latest make bundle-run + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG=quay.io/medik8s/self-node-remediation-operator-bundle:latest make bundle-run + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml index eba623116dfe1..e620518827099 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml @@ -84,6 +84,76 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.12 org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml index a0fcbed82fb44..0f5af35d84a07 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -84,6 +88,76 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.12 org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml index eaebc9c4aedfd..35f1f906efa3c 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml @@ -88,6 +88,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml index a70988e1d8205..271f579ea9f2d 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: "5.0" namespace: ocp tag: base + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -88,6 +92,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml index de2bad83ca964..0e36fdebafb17 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml @@ -88,6 +88,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.21 org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml index 159e623e2e127..e93294c3ac3e8 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: "5.0" namespace: ocp tag: base + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -88,6 +92,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "false" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.21 org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml index 15ca0c19815e1..60655201877b6 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml @@ -90,6 +90,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml index 4a2d71b0e590e..b4d2b2acee4e5 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: ubi-minimal namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -90,6 +94,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml index d8ba7a6e784b3..2b45477b89dcb 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml @@ -90,6 +90,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.13 org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml index d7c3e689c4fcb..1624b568292ec 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: ubi-minimal namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -90,6 +94,72 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.13 org: medik8s diff --git a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.23.yaml b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.23.yaml index 339cb5c56b963..04217a3ea7d27 100644 --- a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -104,6 +108,76 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: sbr-operator-system + PQC_CHECK: "true" + SCAN_NAMESPACE: sbr-operator-system + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + - env: SBR_AGENT_IMAGE + name: sbr-agent + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: sbr-operator-system + PQC_CHECK: "false" + SCAN_NAMESPACE: sbr-operator-system + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + - env: SBR_AGENT_IMAGE + name: sbr-agent + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__5.0.yaml b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__5.0.yaml index 9afb07ca2f3ab..44dc2eeb39702 100644 --- a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__5.0.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -104,6 +108,76 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: sbr-operator-system + PQC_CHECK: "true" + SCAN_NAMESPACE: sbr-operator-system + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + - env: SBR_AGENT_IMAGE + name: sbr-agent + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls13-adherence + optional: true + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: sbr-operator-system + PQC_CHECK: "false" + SCAN_NAMESPACE: sbr-operator-system + SCANNER_CPU: "2" + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + - env: SBR_AGENT_IMAGE + name: sbr-agent + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.23.yaml b/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.23.yaml new file mode 100644 index 0000000000000..e92c36f125114 --- /dev/null +++ b/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.23.yaml @@ -0,0 +1,61 @@ +base_images: + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool +build_root: + from_repository: true +releases: + latest: + release: + channel: stable + version: "4.23" +resources: + '*': + requests: + cpu: 500m + memory: 1000Mi +tests: +- as: tls13-adherence-all + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: openshift-workload-availability + OCP_VERSION: "423" + OO_CHANNEL: stable + OPERATORS: fence-agents-remediation,self-node-remediation,node-healthcheck-operator,node-maintenance-operator,machine-deletion-remediation,storage-based-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: openshift-workload-availability + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: medik8s-catalogsource + - ref: medik8s-operator-subscribe + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls-pqc-readiness-all + cron: 0 6 * * 3 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: openshift-workload-availability + OCP_VERSION: "423" + OO_CHANNEL: stable + OPERATORS: fence-agents-remediation,self-node-remediation,node-healthcheck-operator,node-maintenance-operator,machine-deletion-remediation,storage-based-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: openshift-workload-availability + test: + - ref: medik8s-catalogsource + - ref: medik8s-operator-subscribe + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +zz_generated_metadata: + branch: main + org: medik8s + repo: system-tests + variant: "4.23" diff --git a/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__5.0.yaml b/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__5.0.yaml new file mode 100644 index 0000000000000..a2c7d0bdfae91 --- /dev/null +++ b/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__5.0.yaml @@ -0,0 +1,61 @@ +base_images: + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool +build_root: + from_repository: true +releases: + latest: + release: + channel: stable + version: "5.0" +resources: + '*': + requests: + cpu: 500m + memory: 1000Mi +tests: +- as: tls13-adherence-all + cron: 0 6 * * 1 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: openshift-workload-availability + OCP_VERSION: "50" + OO_CHANNEL: stable + OPERATORS: fence-agents-remediation,self-node-remediation,node-healthcheck-operator,node-maintenance-operator,machine-deletion-remediation,storage-based-remediation + PQC_CHECK: "false" + SCAN_NAMESPACE: openshift-workload-availability + TLS_13_ENABLE_TLS_ADHERENCE: "true" + TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents + test: + - ref: medik8s-catalogsource + - ref: medik8s-operator-subscribe + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +- as: tls-pqc-readiness-all + cron: 0 6 * * 3 + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: openshift-workload-availability + OCP_VERSION: "50" + OO_CHANNEL: stable + OPERATORS: fence-agents-remediation,self-node-remediation,node-healthcheck-operator,node-maintenance-operator,machine-deletion-remediation,storage-based-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: openshift-workload-availability + test: + - ref: medik8s-catalogsource + - ref: medik8s-operator-subscribe + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws +zz_generated_metadata: + branch: main + org: medik8s + repo: system-tests + variant: "5.0" From 35bef5fe685da7cd7b9c7aca9bec8c1ef71e8244 Mon Sep 17 00:00:00 2001 From: JonahSussman Date: Thu, 13 Aug 2026 12:12:59 -0400 Subject: [PATCH 2/9] medik8s: regenerate CI jobs for TLS scanner Generated by make jobs (ci-operator-prowgen + sanitize-prow-jobs). Do not edit by hand. Signed-off-by: JonahSussman --- ...ce-agents-remediation-main-presubmits.yaml | 356 +++++++++++++++++ ...ts-remediation-release-0.8-presubmits.yaml | 356 +++++++++++++++++ ...-deletion-remediation-main-presubmits.yaml | 356 +++++++++++++++++ ...on-remediation-release-0.7-presubmits.yaml | 356 +++++++++++++++++ ...-healthcheck-operator-main-presubmits.yaml | 356 +++++++++++++++++ ...heck-operator-release-0.12-presubmits.yaml | 356 +++++++++++++++++ ...-maintenance-operator-main-presubmits.yaml | 356 +++++++++++++++++ ...ance-operator-release-0.21-presubmits.yaml | 356 +++++++++++++++++ ...self-node-remediation-main-presubmits.yaml | 356 +++++++++++++++++ ...e-remediation-release-0.13-presubmits.yaml | 356 +++++++++++++++++ ...age-based-remediation-main-presubmits.yaml | 360 ++++++++++++++++++ .../medik8s-system-tests-main-periodics.yaml | 340 +++++++++++++++++ 12 files changed, 4260 insertions(+) diff --git a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml index ee2d411de7321..5a7f7c1980729 100644 --- a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml index 9d6cec4054bdd..825327f1f8da2 100644 --- a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml +++ b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.8$ + - ^release-0\.8- + cluster: build07 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-release-0.8-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.8$ + - ^release-0\.8- + cluster: build07 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-release-0.8-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.8$ + - ^release-0\.8- + cluster: build07 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-release-0.8-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.8$ + - ^release-0\.8- + cluster: build07 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-release-0.8-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml index 059bf3f2b5d6e..b5497909975df 100644 --- a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml index db24c06ba4e64..7518ea52fe603 100644 --- a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml +++ b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.7$ + - ^release-0\.7- + cluster: build01 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.7$ + - ^release-0\.7- + cluster: build01 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.7$ + - ^release-0\.7- + cluster: build01 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.7$ + - ^release-0\.7- + cluster: build01 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml index 5a9215260345a..deade958ef61b 100644 --- a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml index 9ff683410b00d..f1b50deef9449 100644 --- a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.12$ + - ^release-0\.12- + cluster: build10 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.12$ + - ^release-0\.12- + cluster: build10 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.12$ + - ^release-0\.12- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.12$ + - ^release-0\.12- + cluster: build10 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml index f65870839d453..612547c864ba0 100644 --- a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml index 97abe94bdf4c2..63ee2182bb7ae 100644 --- a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.21$ + - ^release-0\.21- + cluster: build10 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-release-0.21-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.21$ + - ^release-0\.21- + cluster: build10 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-release-0.21-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.21$ + - ^release-0\.21- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-release-0.21-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.21$ + - ^release-0\.21- + cluster: build10 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-release-0.21-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml index 441dfbc75290c..1182e1d7de0c5 100644 --- a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build05 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build05 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build05 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build05 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml index 69a06b7105916..66fe45bb2dc8a 100644 --- a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml +++ b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml @@ -554,6 +554,184 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.13$ + - ^release-0\.13- + cluster: build05 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-release-0.13-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.13$ + - ^release-0\.13- + cluster: build05 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-release-0.13-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -831,3 +1009,181 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.13$ + - ^release-0\.13- + cluster: build05 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-release-0.13-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.13$ + - ^release-0\.13- + cluster: build05 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-release-0.13-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml index 2082b9d7f96ff..5d2cfde2f7d70 100644 --- a/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml @@ -422,6 +422,186 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-openshift-e2e,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - cmd/sbr-agent/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-storage-based-remediation-main-4.23-tls-pqc-readiness + optional: true + rerun_command: /test 4.23-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.23-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - cmd/sbr-agent/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + job-release: "4.23" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-storage-based-remediation-main-4.23-tls13-adherence + optional: true + rerun_command: /test 4.23-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -633,3 +813,183 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-openshift-e2e,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - cmd/sbr-agent/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-storage-based-remediation-main-5.0-tls-pqc-readiness + optional: true + rerun_command: /test 5.0-tls-pqc-readiness + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/5.0-tls13-adherence + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - cmd/sbr-agent/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + job-release: "5.0" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-storage-based-remediation-main-5.0-tls13-adherence + optional: true + rerun_command: /test 5.0-tls13-adherence + run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-periodics.yaml b/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-periodics.yaml index 1c26612bf73c9..f8c09094c9edb 100644 --- a/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-periodics.yaml +++ b/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-periodics.yaml @@ -1031,3 +1031,343 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build01 + cron: 0 6 * * 3 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + extra_refs: + - base_ref: main + org: medik8s + repo: system-tests + sparse_checkout_files: + - .ci-operator.yaml + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-system-tests-main-4.23-tls-pqc-readiness-all + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-all + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build01 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + extra_refs: + - base_ref: main + org: medik8s + repo: system-tests + sparse_checkout_files: + - .ci-operator.yaml + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.23" + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-system-tests-main-4.23-tls13-adherence-all + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-all + - --variant=4.23 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build01 + cron: 0 6 * * 3 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + extra_refs: + - base_ref: main + org: medik8s + repo: system-tests + sparse_checkout_files: + - .ci-operator.yaml + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-system-tests-main-5.0-tls-pqc-readiness-all + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-all + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator +- agent: kubernetes + cluster: build01 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + extra_refs: + - base_ref: main + org: medik8s + repo: system-tests + sparse_checkout_files: + - .ci-operator.yaml + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "5.0" + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-medik8s-system-tests-main-5.0-tls13-adherence-all + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls13-adherence-all + - --variant=5.0 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator From 0c5b613d6079dafef8481c2c8f2b31007ddd5414 Mon Sep 17 00:00:00 2001 From: JonahSussman Date: Tue, 18 Aug 2026 11:49:35 -0400 Subject: [PATCH 3/9] medik8s: declare tls-scanner-tool base image for 4.23 scanner jobs The tls-scanner-run step-registry ref has a hard dependency on the tls-scanner-tool image (PULL_SPEC_TLS_SCANNER_TOOL). Eight 4.23 configs run the scanner without declaring that base image, so the step fails at runtime with 'could not determine image pull spec for image tls-scanner-tool'. Add the version-independent tls-scanner pin to each. Signed-off-by: JonahSussman --- .../medik8s-machine-deletion-remediation-main__4.23.yaml | 4 ++++ ...edik8s-machine-deletion-remediation-release-0.7__4.23.yaml | 4 ++++ .../medik8s-node-healthcheck-operator-main__4.23.yaml | 4 ++++ .../medik8s-node-healthcheck-operator-release-0.12__4.23.yaml | 4 ++++ .../medik8s-node-maintenance-operator-main__4.23.yaml | 4 ++++ .../medik8s-node-maintenance-operator-release-0.21__4.23.yaml | 4 ++++ .../medik8s-self-node-remediation-main__4.23.yaml | 4 ++++ .../medik8s-self-node-remediation-release-0.13__4.23.yaml | 4 ++++ 8 files changed, 32 insertions(+) diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml index a6f31e410005d..3b35eecda1908 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: ubi namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml index 07b4e62c33164..5198ba900819d 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml index f42f76f5b4c5e..c8082d9a4cc3c 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml @@ -7,6 +7,10 @@ base_images: name: claude-ai-helpers namespace: ci tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml index e620518827099..96f00b1f71bea 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml index 35f1f906efa3c..9454405a9694c 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: "4.23" namespace: ocp tag: base + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml index 0e36fdebafb17..a05ba7594a920 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: "4.23" namespace: ocp tag: base + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml index 60655201877b6..bc9335a84ca31 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: ubi-minimal namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml index 2b45477b89dcb..a155530ca107d 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml @@ -3,6 +3,10 @@ base_images: name: ubi-minimal namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true From e45fc54b72359abb6858612eee031f3f9430c8d3 Mon Sep 17 00:00:00 2001 From: JonahSussman Date: Tue, 18 Aug 2026 11:50:56 -0400 Subject: [PATCH 4/9] medik8s: run TLS scanner presubmits on all non-trivial changes The scanner presubmits only auto-ran on a narrow file list (cmd/main.go, go.mod/sum, controller-runtime-common vendor dir), so real code changes skipped the scan. Switch them to the skip_if_only_changed pattern already used by the other presubmits in these configs, so they run on any change except docs/markdown/OWNERS/etc. They stay optional (non-blocking). Signed-off-by: JonahSussman --- .../medik8s-fence-agents-remediation-main__4.23.yaml | 4 ++-- .../medik8s-fence-agents-remediation-main__5.0.yaml | 4 ++-- .../medik8s-fence-agents-remediation-release-0.8__4.23.yaml | 4 ++-- .../medik8s-fence-agents-remediation-release-0.8__5.0.yaml | 4 ++-- .../medik8s-machine-deletion-remediation-main__4.23.yaml | 4 ++-- .../medik8s-machine-deletion-remediation-main__5.0.yaml | 4 ++-- ...edik8s-machine-deletion-remediation-release-0.7__4.23.yaml | 4 ++-- ...medik8s-machine-deletion-remediation-release-0.7__5.0.yaml | 4 ++-- .../medik8s-node-healthcheck-operator-main__4.23.yaml | 4 ++-- .../medik8s-node-healthcheck-operator-main__5.0.yaml | 4 ++-- .../medik8s-node-healthcheck-operator-release-0.12__4.23.yaml | 4 ++-- .../medik8s-node-healthcheck-operator-release-0.12__5.0.yaml | 4 ++-- .../medik8s-node-maintenance-operator-main__4.23.yaml | 4 ++-- .../medik8s-node-maintenance-operator-main__5.0.yaml | 4 ++-- .../medik8s-node-maintenance-operator-release-0.21__4.23.yaml | 4 ++-- .../medik8s-node-maintenance-operator-release-0.21__5.0.yaml | 4 ++-- .../medik8s-self-node-remediation-main__4.23.yaml | 4 ++-- .../medik8s-self-node-remediation-main__5.0.yaml | 4 ++-- .../medik8s-self-node-remediation-release-0.13__4.23.yaml | 4 ++-- .../medik8s-self-node-remediation-release-0.13__5.0.yaml | 4 ++-- .../medik8s-storage-based-remediation-main__4.23.yaml | 4 ++-- .../medik8s-storage-based-remediation-main__5.0.yaml | 4 ++-- 22 files changed, 44 insertions(+), 44 deletions(-) diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.23.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.23.yaml index b4dff8ede7c24..91197d720a7ce 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.23.yaml @@ -95,7 +95,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -127,7 +127,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml index d03abc2133ecb..00e4b9913ebce 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml @@ -95,7 +95,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -127,7 +127,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml index cdc38e4e79912..424b55b7ebcfa 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml @@ -95,7 +95,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -127,7 +127,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml index b5e116c191815..972a30eb44d44 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml @@ -95,7 +95,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -127,7 +127,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml index 3b35eecda1908..ffa7c3c26c1b8 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.23.yaml @@ -97,7 +97,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -130,7 +130,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml index 7850cb2972433..89fb870e79c75 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__5.0.yaml @@ -97,7 +97,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -130,7 +130,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml index 5198ba900819d..f1a0140bfda78 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml @@ -87,7 +87,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -120,7 +120,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml index 393e2b64da111..0ddd882768c83 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml @@ -87,7 +87,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -120,7 +120,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml index c8082d9a4cc3c..f865124b5b39a 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.23.yaml @@ -107,7 +107,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -141,7 +141,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml index 629343e29ac95..0e8a330966ddb 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__5.0.yaml @@ -107,7 +107,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -141,7 +141,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml index 96f00b1f71bea..098ae2454e780 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml @@ -90,7 +90,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -124,7 +124,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml index 0f5af35d84a07..7dd61b79e2f82 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml @@ -90,7 +90,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -124,7 +124,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml index 9454405a9694c..fda026dfc5a06 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.23.yaml @@ -94,7 +94,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -126,7 +126,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml index 271f579ea9f2d..75665ba1a9e2f 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__5.0.yaml @@ -94,7 +94,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -126,7 +126,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml index a05ba7594a920..53ba9296d1f67 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml @@ -94,7 +94,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -126,7 +126,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml index e93294c3ac3e8..6f4168e5eb58a 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml @@ -94,7 +94,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -126,7 +126,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml index bc9335a84ca31..6ad3fc5fe0f7d 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.23.yaml @@ -96,7 +96,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -128,7 +128,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml index b4d2b2acee4e5..9494d1dced116 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__5.0.yaml @@ -96,7 +96,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -128,7 +128,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml index a155530ca107d..acbb05dd80098 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml @@ -96,7 +96,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -128,7 +128,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml index 1624b568292ec..3213511e3194d 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml @@ -96,7 +96,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -128,7 +128,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.23.yaml b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.23.yaml index 04217a3ea7d27..db660c9d6c970 100644 --- a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.23.yaml +++ b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.23.yaml @@ -110,7 +110,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -144,7 +144,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: diff --git a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__5.0.yaml b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__5.0.yaml index 44dc2eeb39702..1d0c9e44dfb5c 100644 --- a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__5.0.yaml +++ b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__5.0.yaml @@ -110,7 +110,7 @@ tests: workflow: ipi-aws - as: tls-pqc-readiness optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: @@ -144,7 +144,7 @@ tests: workflow: ipi-aws - as: tls13-adherence optional: true - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ steps: cluster_profile: medik8s-aws env: From 924fed44b5bf92233b19cf7bc8cc85ceef3d1154 Mon Sep 17 00:00:00 2001 From: JonahSussman Date: Tue, 18 Aug 2026 11:51:33 -0400 Subject: [PATCH 5/9] medik8s: stagger 5.0 TLS periodics to avoid cluster collision The 4.23 and 5.0 all-operators TLS periodics shared identical crons (Mon/Wed 06:00), so both versions would provision AWS clusters at the same instant. Shift the 5.0 periodics to 10:00 to spread the load. Signed-off-by: JonahSussman --- .../medik8s/system-tests/medik8s-system-tests-main__5.0.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__5.0.yaml b/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__5.0.yaml index a2c7d0bdfae91..451e68cd904d0 100644 --- a/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__5.0.yaml +++ b/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__5.0.yaml @@ -17,7 +17,7 @@ resources: memory: 1000Mi tests: - as: tls13-adherence-all - cron: 0 6 * * 1 + cron: 0 10 * * 1 steps: cluster_profile: medik8s-aws env: @@ -37,7 +37,7 @@ tests: - ref: tls-scanner-run workflow: ipi-aws - as: tls-pqc-readiness-all - cron: 0 6 * * 3 + cron: 0 10 * * 3 steps: cluster_profile: medik8s-aws env: From 5c38202fd8e1893eecd1ff2fd17c2d808d3d97f1 Mon Sep 17 00:00:00 2001 From: JonahSussman Date: Tue, 18 Aug 2026 11:56:58 -0400 Subject: [PATCH 6/9] medik8s: regenerate CI jobs for trigger broadening and cron stagger Regenerated with 'make jobs' after switching the TLS scanner presubmits from a narrow run_if_changed list to skip_if_only_changed, and staggering the 5.0 all-operators periodics to 10:00. Signed-off-by: JonahSussman --- .../medik8s-fence-agents-remediation-main-presubmits.yaml | 8 ++++---- ...s-fence-agents-remediation-release-0.8-presubmits.yaml | 8 ++++---- ...ik8s-machine-deletion-remediation-main-presubmits.yaml | 8 ++++---- ...chine-deletion-remediation-release-0.7-presubmits.yaml | 8 ++++---- ...medik8s-node-healthcheck-operator-main-presubmits.yaml | 8 ++++---- ...node-healthcheck-operator-release-0.12-presubmits.yaml | 8 ++++---- ...medik8s-node-maintenance-operator-main-presubmits.yaml | 8 ++++---- ...node-maintenance-operator-release-0.21-presubmits.yaml | 8 ++++---- .../medik8s-self-node-remediation-main-presubmits.yaml | 8 ++++---- ...k8s-self-node-remediation-release-0.13-presubmits.yaml | 8 ++++---- ...medik8s-storage-based-remediation-main-presubmits.yaml | 8 ++++---- .../system-tests/medik8s-system-tests-main-periodics.yaml | 4 ++-- 12 files changed, 46 insertions(+), 46 deletions(-) diff --git a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml index 5a7f7c1980729..9b106ced23223 100644 --- a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml @@ -576,7 +576,7 @@ presubmits: name: pull-ci-medik8s-fence-agents-remediation-main-4.23-tls-pqc-readiness optional: true rerun_command: /test 4.23-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -665,7 +665,7 @@ presubmits: name: pull-ci-medik8s-fence-agents-remediation-main-4.23-tls13-adherence optional: true rerun_command: /test 4.23-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1031,7 +1031,7 @@ presubmits: name: pull-ci-medik8s-fence-agents-remediation-main-5.0-tls-pqc-readiness optional: true rerun_command: /test 5.0-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1120,7 +1120,7 @@ presubmits: name: pull-ci-medik8s-fence-agents-remediation-main-5.0-tls13-adherence optional: true rerun_command: /test 5.0-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: diff --git a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml index 825327f1f8da2..0425cbef61705 100644 --- a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml +++ b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml @@ -576,7 +576,7 @@ presubmits: name: pull-ci-medik8s-fence-agents-remediation-release-0.8-4.23-tls-pqc-readiness optional: true rerun_command: /test 4.23-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -665,7 +665,7 @@ presubmits: name: pull-ci-medik8s-fence-agents-remediation-release-0.8-4.23-tls13-adherence optional: true rerun_command: /test 4.23-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1031,7 +1031,7 @@ presubmits: name: pull-ci-medik8s-fence-agents-remediation-release-0.8-5.0-tls-pqc-readiness optional: true rerun_command: /test 5.0-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1120,7 +1120,7 @@ presubmits: name: pull-ci-medik8s-fence-agents-remediation-release-0.8-5.0-tls13-adherence optional: true rerun_command: /test 5.0-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: diff --git a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml index b5497909975df..cb40a8e325568 100644 --- a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml @@ -576,7 +576,7 @@ presubmits: name: pull-ci-medik8s-machine-deletion-remediation-main-4.23-tls-pqc-readiness optional: true rerun_command: /test 4.23-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -665,7 +665,7 @@ presubmits: name: pull-ci-medik8s-machine-deletion-remediation-main-4.23-tls13-adherence optional: true rerun_command: /test 4.23-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1031,7 +1031,7 @@ presubmits: name: pull-ci-medik8s-machine-deletion-remediation-main-5.0-tls-pqc-readiness optional: true rerun_command: /test 5.0-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1120,7 +1120,7 @@ presubmits: name: pull-ci-medik8s-machine-deletion-remediation-main-5.0-tls13-adherence optional: true rerun_command: /test 5.0-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: diff --git a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml index 7518ea52fe603..c5bc0cb852718 100644 --- a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml +++ b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml @@ -576,7 +576,7 @@ presubmits: name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-4.23-tls-pqc-readiness optional: true rerun_command: /test 4.23-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -665,7 +665,7 @@ presubmits: name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-4.23-tls13-adherence optional: true rerun_command: /test 4.23-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1031,7 +1031,7 @@ presubmits: name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-5.0-tls-pqc-readiness optional: true rerun_command: /test 5.0-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1120,7 +1120,7 @@ presubmits: name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-5.0-tls13-adherence optional: true rerun_command: /test 5.0-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: diff --git a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml index deade958ef61b..0f781b93d382b 100644 --- a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml @@ -576,7 +576,7 @@ presubmits: name: pull-ci-medik8s-node-healthcheck-operator-main-4.23-tls-pqc-readiness optional: true rerun_command: /test 4.23-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -665,7 +665,7 @@ presubmits: name: pull-ci-medik8s-node-healthcheck-operator-main-4.23-tls13-adherence optional: true rerun_command: /test 4.23-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1031,7 +1031,7 @@ presubmits: name: pull-ci-medik8s-node-healthcheck-operator-main-5.0-tls-pqc-readiness optional: true rerun_command: /test 5.0-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1120,7 +1120,7 @@ presubmits: name: pull-ci-medik8s-node-healthcheck-operator-main-5.0-tls13-adherence optional: true rerun_command: /test 5.0-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: diff --git a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml index f1b50deef9449..5a3b3ffe1f0d6 100644 --- a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml @@ -576,7 +576,7 @@ presubmits: name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-4.23-tls-pqc-readiness optional: true rerun_command: /test 4.23-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -665,7 +665,7 @@ presubmits: name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-4.23-tls13-adherence optional: true rerun_command: /test 4.23-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1031,7 +1031,7 @@ presubmits: name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-5.0-tls-pqc-readiness optional: true rerun_command: /test 5.0-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1120,7 +1120,7 @@ presubmits: name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-5.0-tls13-adherence optional: true rerun_command: /test 5.0-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: diff --git a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml index 612547c864ba0..6bc202a298dfa 100644 --- a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml @@ -576,7 +576,7 @@ presubmits: name: pull-ci-medik8s-node-maintenance-operator-main-4.23-tls-pqc-readiness optional: true rerun_command: /test 4.23-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -665,7 +665,7 @@ presubmits: name: pull-ci-medik8s-node-maintenance-operator-main-4.23-tls13-adherence optional: true rerun_command: /test 4.23-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1031,7 +1031,7 @@ presubmits: name: pull-ci-medik8s-node-maintenance-operator-main-5.0-tls-pqc-readiness optional: true rerun_command: /test 5.0-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1120,7 +1120,7 @@ presubmits: name: pull-ci-medik8s-node-maintenance-operator-main-5.0-tls13-adherence optional: true rerun_command: /test 5.0-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: diff --git a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml index 63ee2182bb7ae..3fb6ffbec900f 100644 --- a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml @@ -576,7 +576,7 @@ presubmits: name: pull-ci-medik8s-node-maintenance-operator-release-0.21-4.23-tls-pqc-readiness optional: true rerun_command: /test 4.23-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -665,7 +665,7 @@ presubmits: name: pull-ci-medik8s-node-maintenance-operator-release-0.21-4.23-tls13-adherence optional: true rerun_command: /test 4.23-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1031,7 +1031,7 @@ presubmits: name: pull-ci-medik8s-node-maintenance-operator-release-0.21-5.0-tls-pqc-readiness optional: true rerun_command: /test 5.0-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1120,7 +1120,7 @@ presubmits: name: pull-ci-medik8s-node-maintenance-operator-release-0.21-5.0-tls13-adherence optional: true rerun_command: /test 5.0-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: diff --git a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml index 1182e1d7de0c5..23942c30659e4 100644 --- a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml @@ -576,7 +576,7 @@ presubmits: name: pull-ci-medik8s-self-node-remediation-main-4.23-tls-pqc-readiness optional: true rerun_command: /test 4.23-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -665,7 +665,7 @@ presubmits: name: pull-ci-medik8s-self-node-remediation-main-4.23-tls13-adherence optional: true rerun_command: /test 4.23-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1031,7 +1031,7 @@ presubmits: name: pull-ci-medik8s-self-node-remediation-main-5.0-tls-pqc-readiness optional: true rerun_command: /test 5.0-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1120,7 +1120,7 @@ presubmits: name: pull-ci-medik8s-self-node-remediation-main-5.0-tls13-adherence optional: true rerun_command: /test 5.0-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: diff --git a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml index 66fe45bb2dc8a..61906da072242 100644 --- a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml +++ b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml @@ -576,7 +576,7 @@ presubmits: name: pull-ci-medik8s-self-node-remediation-release-0.13-4.23-tls-pqc-readiness optional: true rerun_command: /test 4.23-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -665,7 +665,7 @@ presubmits: name: pull-ci-medik8s-self-node-remediation-release-0.13-4.23-tls13-adherence optional: true rerun_command: /test 4.23-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1031,7 +1031,7 @@ presubmits: name: pull-ci-medik8s-self-node-remediation-release-0.13-5.0-tls-pqc-readiness optional: true rerun_command: /test 5.0-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -1120,7 +1120,7 @@ presubmits: name: pull-ci-medik8s-self-node-remediation-release-0.13-5.0-tls13-adherence optional: true rerun_command: /test 5.0-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: diff --git a/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml index 5d2cfde2f7d70..cd2749d5094ff 100644 --- a/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml @@ -445,7 +445,7 @@ presubmits: name: pull-ci-medik8s-storage-based-remediation-main-4.23-tls-pqc-readiness optional: true rerun_command: /test 4.23-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -535,7 +535,7 @@ presubmits: name: pull-ci-medik8s-storage-based-remediation-main-4.23-tls13-adherence optional: true rerun_command: /test 4.23-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -836,7 +836,7 @@ presubmits: name: pull-ci-medik8s-storage-based-remediation-main-5.0-tls-pqc-readiness optional: true rerun_command: /test 5.0-tls-pqc-readiness - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: @@ -926,7 +926,7 @@ presubmits: name: pull-ci-medik8s-storage-based-remediation-main-5.0-tls13-adherence optional: true rerun_command: /test 5.0-tls13-adherence - run_if_changed: ^(cmd/main\.go|go\.mod|go\.sum|vendor/github\.com/openshift/controller-runtime-common/) + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ spec: containers: - args: diff --git a/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-periodics.yaml b/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-periodics.yaml index f8c09094c9edb..7559ec84d4450 100644 --- a/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-periodics.yaml +++ b/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-periodics.yaml @@ -1203,7 +1203,7 @@ periodics: secretName: result-aggregator - agent: kubernetes cluster: build01 - cron: 0 6 * * 3 + cron: 0 10 * * 3 decorate: true decoration_config: sparse_checkout_files: @@ -1288,7 +1288,7 @@ periodics: secretName: result-aggregator - agent: kubernetes cluster: build01 - cron: 0 6 * * 1 + cron: 0 10 * * 1 decorate: true decoration_config: sparse_checkout_files: From ff757bf1c75ed60937015b094cdde2af42b375d8 Mon Sep 17 00:00:00 2001 From: JonahSussman Date: Thu, 20 Aug 2026 02:17:17 -0400 Subject: [PATCH 7/9] medik8s: restrict TLS 1.3 adherence scans to main branch configs TLS 1.3 adherence (TLSAdherence) is a 5.0 GA release blocker, not yet required on release branches shipping pre-5.0. Running it there before each operator's TLS integration PR is backported produces noise, not signal. Keep it on main-branch configs only; keep PQC readiness scans on both main and release branches since that requirement has been mandatory since OCP 4.22. Signed-off-by: JonahSussman --- ...-agents-remediation-release-0.8__4.23.yaml | 34 ---- ...e-agents-remediation-release-0.8__5.0.yaml | 34 ---- ...eletion-remediation-release-0.7__4.23.yaml | 35 ---- ...deletion-remediation-release-0.7__5.0.yaml | 35 ---- ...althcheck-operator-release-0.12__4.23.yaml | 36 ---- ...ealthcheck-operator-release-0.12__5.0.yaml | 36 ---- ...intenance-operator-release-0.21__4.23.yaml | 34 ---- ...aintenance-operator-release-0.21__5.0.yaml | 34 ---- ...f-node-remediation-release-0.13__4.23.yaml | 34 ---- ...lf-node-remediation-release-0.13__5.0.yaml | 34 ---- ...ts-remediation-release-0.8-presubmits.yaml | 178 ------------------ ...on-remediation-release-0.7-presubmits.yaml | 178 ------------------ ...heck-operator-release-0.12-presubmits.yaml | 178 ------------------ ...ance-operator-release-0.21-presubmits.yaml | 178 ------------------ ...e-remediation-release-0.13-presubmits.yaml | 178 ------------------ 15 files changed, 1236 deletions(-) diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml index 424b55b7ebcfa..f65b33543e9c1 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml @@ -125,40 +125,6 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: ipi-aws -- as: tls13-adherence - optional: true - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - steps: - cluster_profile: medik8s-aws - env: - BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com - OPERATOR_NAMESPACE: far-install - PQC_CHECK: "false" - SCAN_NAMESPACE: far-install - SCANNER_CPU: "2" - TLS_13_ENABLE_TLS_ADHERENCE: "true" - TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents - test: - - as: install-operator - cli: latest - commands: | - make create-ns - oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false - oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged - BUNDLE_IMG="$OO_BUNDLE" make bundle-run - dependencies: - - env: OO_BUNDLE - name: my-bundle - env: - - name: OPERATOR_NAMESPACE - from: src - resources: - requests: - cpu: 100m - memory: 200Mi - - ref: tls-13 - - ref: tls-scanner-run - workflow: ipi-aws zz_generated_metadata: branch: release-0.8 org: medik8s diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml index 972a30eb44d44..68c461e65a07d 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml @@ -125,40 +125,6 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: ipi-aws -- as: tls13-adherence - optional: true - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - steps: - cluster_profile: medik8s-aws - env: - BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com - OPERATOR_NAMESPACE: far-install - PQC_CHECK: "false" - SCAN_NAMESPACE: far-install - SCANNER_CPU: "2" - TLS_13_ENABLE_TLS_ADHERENCE: "true" - TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents - test: - - as: install-operator - cli: latest - commands: | - make create-ns - oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false - oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged - BUNDLE_IMG="$OO_BUNDLE" make bundle-run - dependencies: - - env: OO_BUNDLE - name: my-bundle - env: - - name: OPERATOR_NAMESPACE - from: src - resources: - requests: - cpu: 100m - memory: 200Mi - - ref: tls-13 - - ref: tls-scanner-run - workflow: ipi-aws zz_generated_metadata: branch: release-0.8 org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml index f1a0140bfda78..e9fa4e556bc76 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.23.yaml @@ -118,41 +118,6 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: ipi-aws -- as: tls13-adherence - optional: true - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - steps: - cluster_profile: medik8s-aws - env: - BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com - INSTALL_NAMESPACE: mdr-install - PQC_CHECK: "false" - SCAN_NAMESPACE: mdr-install - SCANNER_CPU: "2" - TLS_13_ENABLE_TLS_ADHERENCE: "true" - TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents - test: - - as: install-operator - cli: latest - commands: | - oc create namespace "$INSTALL_NAMESPACE" - oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false - oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged - operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" - oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager - dependencies: - - env: OO_BUNDLE - name: machine-deletion-remediation-bundle - env: - - name: INSTALL_NAMESPACE - from: operator-sdk - resources: - requests: - cpu: 100m - memory: 200Mi - - ref: tls-13 - - ref: tls-scanner-run - workflow: ipi-aws zz_generated_metadata: branch: release-0.7 org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml index 0ddd882768c83..a4cf93755c934 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__5.0.yaml @@ -118,41 +118,6 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: ipi-aws -- as: tls13-adherence - optional: true - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - steps: - cluster_profile: medik8s-aws - env: - BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com - INSTALL_NAMESPACE: mdr-install - PQC_CHECK: "false" - SCAN_NAMESPACE: mdr-install - SCANNER_CPU: "2" - TLS_13_ENABLE_TLS_ADHERENCE: "true" - TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents - test: - - as: install-operator - cli: latest - commands: | - oc create namespace "$INSTALL_NAMESPACE" - oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false - oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged - operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" - oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager - dependencies: - - env: OO_BUNDLE - name: machine-deletion-remediation-bundle - env: - - name: INSTALL_NAMESPACE - from: operator-sdk - resources: - requests: - cpu: 100m - memory: 200Mi - - ref: tls-13 - - ref: tls-scanner-run - workflow: ipi-aws zz_generated_metadata: branch: release-0.7 org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml index 098ae2454e780..a228b620f2903 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.23.yaml @@ -122,42 +122,6 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: ipi-aws -- as: tls13-adherence - optional: true - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - steps: - cluster_profile: medik8s-aws - env: - BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com - INSTALL_NAMESPACE: nhc-install - PQC_CHECK: "false" - SCAN_NAMESPACE: nhc-install - SCANNER_CPU: "2" - TLS_13_ENABLE_TLS_ADHERENCE: "true" - TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents - test: - - as: install-operator - cli: latest - commands: | - oc create namespace "$INSTALL_NAMESPACE" - oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false - oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged - operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest - operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" - oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager - dependencies: - - env: OO_BUNDLE - name: my-bundle - env: - - name: INSTALL_NAMESPACE - from: operator-sdk - resources: - requests: - cpu: 100m - memory: 200Mi - - ref: tls-13 - - ref: tls-scanner-run - workflow: ipi-aws zz_generated_metadata: branch: release-0.12 org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml index 7dd61b79e2f82..cbcf8cc82d25a 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__5.0.yaml @@ -122,42 +122,6 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: ipi-aws -- as: tls13-adherence - optional: true - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - steps: - cluster_profile: medik8s-aws - env: - BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com - INSTALL_NAMESPACE: nhc-install - PQC_CHECK: "false" - SCAN_NAMESPACE: nhc-install - SCANNER_CPU: "2" - TLS_13_ENABLE_TLS_ADHERENCE: "true" - TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents - test: - - as: install-operator - cli: latest - commands: | - oc create namespace "$INSTALL_NAMESPACE" - oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false - oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged - operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest - operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" - oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager - dependencies: - - env: OO_BUNDLE - name: my-bundle - env: - - name: INSTALL_NAMESPACE - from: operator-sdk - resources: - requests: - cpu: 100m - memory: 200Mi - - ref: tls-13 - - ref: tls-scanner-run - workflow: ipi-aws zz_generated_metadata: branch: release-0.12 org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml index 53ba9296d1f67..d3a69ba0957b6 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.23.yaml @@ -124,40 +124,6 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: ipi-aws -- as: tls13-adherence - optional: true - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - steps: - cluster_profile: medik8s-aws - env: - BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com - OPERATOR_NAMESPACE: nmo-install - PQC_CHECK: "false" - SCAN_NAMESPACE: nmo-install - SCANNER_CPU: "2" - TLS_13_ENABLE_TLS_ADHERENCE: "true" - TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents - test: - - as: install-operator - cli: latest - commands: | - oc create namespace "$OPERATOR_NAMESPACE" - oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false - oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged - BUNDLE_IMG="$OO_BUNDLE" make bundle-run - dependencies: - - env: OO_BUNDLE - name: my-bundle - env: - - name: OPERATOR_NAMESPACE - from: src - resources: - requests: - cpu: 100m - memory: 200Mi - - ref: tls-13 - - ref: tls-scanner-run - workflow: ipi-aws zz_generated_metadata: branch: release-0.21 org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml index 6f4168e5eb58a..9e6ef4ff82669 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__5.0.yaml @@ -124,40 +124,6 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: ipi-aws -- as: tls13-adherence - optional: true - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - steps: - cluster_profile: medik8s-aws - env: - BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com - OPERATOR_NAMESPACE: nmo-install - PQC_CHECK: "false" - SCAN_NAMESPACE: nmo-install - SCANNER_CPU: "2" - TLS_13_ENABLE_TLS_ADHERENCE: "true" - TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents - test: - - as: install-operator - cli: latest - commands: | - oc create namespace "$OPERATOR_NAMESPACE" - oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false - oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged - BUNDLE_IMG="$OO_BUNDLE" make bundle-run - dependencies: - - env: OO_BUNDLE - name: my-bundle - env: - - name: OPERATOR_NAMESPACE - from: src - resources: - requests: - cpu: 100m - memory: 200Mi - - ref: tls-13 - - ref: tls-scanner-run - workflow: ipi-aws zz_generated_metadata: branch: release-0.21 org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml index acbb05dd80098..61e0d90acba30 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.23.yaml @@ -126,40 +126,6 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: ipi-aws -- as: tls13-adherence - optional: true - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - steps: - cluster_profile: medik8s-aws - env: - BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com - OPERATOR_NAMESPACE: self-node-remediation - PQC_CHECK: "false" - SCAN_NAMESPACE: self-node-remediation - SCANNER_CPU: "2" - TLS_13_ENABLE_TLS_ADHERENCE: "true" - TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents - test: - - as: install-operator - cli: latest - commands: | - make create-ns - oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false - oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged - BUNDLE_IMG="$OO_BUNDLE" make bundle-run - dependencies: - - env: OO_BUNDLE - name: self-node-remediation-bundle - env: - - name: OPERATOR_NAMESPACE - from: src - resources: - requests: - cpu: 100m - memory: 200Mi - - ref: tls-13 - - ref: tls-scanner-run - workflow: ipi-aws zz_generated_metadata: branch: release-0.13 org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml index 3213511e3194d..3195bdec85da6 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__5.0.yaml @@ -126,40 +126,6 @@ tests: - ref: tls-13 - ref: tls-scanner-run workflow: ipi-aws -- as: tls13-adherence - optional: true - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - steps: - cluster_profile: medik8s-aws - env: - BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com - OPERATOR_NAMESPACE: self-node-remediation - PQC_CHECK: "false" - SCAN_NAMESPACE: self-node-remediation - SCANNER_CPU: "2" - TLS_13_ENABLE_TLS_ADHERENCE: "true" - TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents - test: - - as: install-operator - cli: latest - commands: | - make create-ns - oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false - oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged - BUNDLE_IMG="$OO_BUNDLE" make bundle-run - dependencies: - - env: OO_BUNDLE - name: self-node-remediation-bundle - env: - - name: OPERATOR_NAMESPACE - from: src - resources: - requests: - cpu: 100m - memory: 200Mi - - ref: tls-13 - - ref: tls-scanner-run - workflow: ipi-aws zz_generated_metadata: branch: release-0.13 org: medik8s diff --git a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml index 0425cbef61705..03178cacff7be 100644 --- a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml +++ b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml @@ -643,95 +643,6 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) - - agent: kubernetes - always_run: false - branches: - - ^release-0\.8$ - - ^release-0\.8- - cluster: build07 - context: ci/prow/4.23-tls13-adherence - decorate: true - decoration_config: - sparse_checkout_files: - - .ci-operator.yaml - - Dockerfile - labels: - ci-operator.openshift.io/cloud: aws - ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws - ci-operator.openshift.io/variant: "4.23" - ci.openshift.io/generator: prowgen - job-release: "4.23" - pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-medik8s-fence-agents-remediation-release-0.8-4.23-tls13-adherence - optional: true - rerun_command: /test 4.23-tls13-adherence - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - spec: - containers: - - args: - - --gcs-upload-secret=/secrets/gcs/service-account.json - - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --lease-server-credentials-file=/etc/boskos/credentials - - --report-credentials-file=/etc/report/credentials - - --secret-dir=/secrets/ci-pull-credentials - - --target=tls13-adherence - - --variant=4.23 - command: - - ci-operator - env: - - name: HTTP_SERVER_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest - imagePullPolicy: Always - name: "" - ports: - - containerPort: 8080 - name: http - resources: - requests: - cpu: 10m - volumeMounts: - - mountPath: /etc/boskos - name: boskos - readOnly: true - - mountPath: /secrets/ci-pull-credentials - name: ci-pull-credentials - readOnly: true - - mountPath: /secrets/gcs - name: gcs-credentials - readOnly: true - - mountPath: /secrets/manifest-tool - name: manifest-tool-local-pusher - readOnly: true - - mountPath: /etc/pull-secret - name: pull-secret - readOnly: true - - mountPath: /etc/report - name: result-aggregator - readOnly: true - serviceAccountName: ci-operator - volumes: - - name: boskos - secret: - items: - - key: credentials - path: credentials - secretName: boskos-credentials - - name: ci-pull-credentials - secret: - secretName: ci-pull-credentials - - name: manifest-tool-local-pusher - secret: - secretName: manifest-tool-local-pusher - - name: pull-secret - secret: - secretName: registry-pull-credentials - - name: result-aggregator - secret: - secretName: result-aggregator - trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -1098,92 +1009,3 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) - - agent: kubernetes - always_run: false - branches: - - ^release-0\.8$ - - ^release-0\.8- - cluster: build07 - context: ci/prow/5.0-tls13-adherence - decorate: true - decoration_config: - sparse_checkout_files: - - .ci-operator.yaml - - Dockerfile - labels: - ci-operator.openshift.io/cloud: aws - ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws - ci-operator.openshift.io/variant: "5.0" - ci.openshift.io/generator: prowgen - job-release: "5.0" - pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-medik8s-fence-agents-remediation-release-0.8-5.0-tls13-adherence - optional: true - rerun_command: /test 5.0-tls13-adherence - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - spec: - containers: - - args: - - --gcs-upload-secret=/secrets/gcs/service-account.json - - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --lease-server-credentials-file=/etc/boskos/credentials - - --report-credentials-file=/etc/report/credentials - - --secret-dir=/secrets/ci-pull-credentials - - --target=tls13-adherence - - --variant=5.0 - command: - - ci-operator - env: - - name: HTTP_SERVER_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest - imagePullPolicy: Always - name: "" - ports: - - containerPort: 8080 - name: http - resources: - requests: - cpu: 10m - volumeMounts: - - mountPath: /etc/boskos - name: boskos - readOnly: true - - mountPath: /secrets/ci-pull-credentials - name: ci-pull-credentials - readOnly: true - - mountPath: /secrets/gcs - name: gcs-credentials - readOnly: true - - mountPath: /secrets/manifest-tool - name: manifest-tool-local-pusher - readOnly: true - - mountPath: /etc/pull-secret - name: pull-secret - readOnly: true - - mountPath: /etc/report - name: result-aggregator - readOnly: true - serviceAccountName: ci-operator - volumes: - - name: boskos - secret: - items: - - key: credentials - path: credentials - secretName: boskos-credentials - - name: ci-pull-credentials - secret: - secretName: ci-pull-credentials - - name: manifest-tool-local-pusher - secret: - secretName: manifest-tool-local-pusher - - name: pull-secret - secret: - secretName: registry-pull-credentials - - name: result-aggregator - secret: - secretName: result-aggregator - trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml index c5bc0cb852718..e96cfb3edca4f 100644 --- a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml +++ b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml @@ -643,95 +643,6 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) - - agent: kubernetes - always_run: false - branches: - - ^release-0\.7$ - - ^release-0\.7- - cluster: build01 - context: ci/prow/4.23-tls13-adherence - decorate: true - decoration_config: - sparse_checkout_files: - - .ci-operator.yaml - - Dockerfile - labels: - ci-operator.openshift.io/cloud: aws - ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws - ci-operator.openshift.io/variant: "4.23" - ci.openshift.io/generator: prowgen - job-release: "4.23" - pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-4.23-tls13-adherence - optional: true - rerun_command: /test 4.23-tls13-adherence - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - spec: - containers: - - args: - - --gcs-upload-secret=/secrets/gcs/service-account.json - - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --lease-server-credentials-file=/etc/boskos/credentials - - --report-credentials-file=/etc/report/credentials - - --secret-dir=/secrets/ci-pull-credentials - - --target=tls13-adherence - - --variant=4.23 - command: - - ci-operator - env: - - name: HTTP_SERVER_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest - imagePullPolicy: Always - name: "" - ports: - - containerPort: 8080 - name: http - resources: - requests: - cpu: 10m - volumeMounts: - - mountPath: /etc/boskos - name: boskos - readOnly: true - - mountPath: /secrets/ci-pull-credentials - name: ci-pull-credentials - readOnly: true - - mountPath: /secrets/gcs - name: gcs-credentials - readOnly: true - - mountPath: /secrets/manifest-tool - name: manifest-tool-local-pusher - readOnly: true - - mountPath: /etc/pull-secret - name: pull-secret - readOnly: true - - mountPath: /etc/report - name: result-aggregator - readOnly: true - serviceAccountName: ci-operator - volumes: - - name: boskos - secret: - items: - - key: credentials - path: credentials - secretName: boskos-credentials - - name: ci-pull-credentials - secret: - secretName: ci-pull-credentials - - name: manifest-tool-local-pusher - secret: - secretName: manifest-tool-local-pusher - - name: pull-secret - secret: - secretName: registry-pull-credentials - - name: result-aggregator - secret: - secretName: result-aggregator - trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -1098,92 +1009,3 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) - - agent: kubernetes - always_run: false - branches: - - ^release-0\.7$ - - ^release-0\.7- - cluster: build01 - context: ci/prow/5.0-tls13-adherence - decorate: true - decoration_config: - sparse_checkout_files: - - .ci-operator.yaml - - Dockerfile - labels: - ci-operator.openshift.io/cloud: aws - ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws - ci-operator.openshift.io/variant: "5.0" - ci.openshift.io/generator: prowgen - job-release: "5.0" - pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-5.0-tls13-adherence - optional: true - rerun_command: /test 5.0-tls13-adherence - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - spec: - containers: - - args: - - --gcs-upload-secret=/secrets/gcs/service-account.json - - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --lease-server-credentials-file=/etc/boskos/credentials - - --report-credentials-file=/etc/report/credentials - - --secret-dir=/secrets/ci-pull-credentials - - --target=tls13-adherence - - --variant=5.0 - command: - - ci-operator - env: - - name: HTTP_SERVER_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest - imagePullPolicy: Always - name: "" - ports: - - containerPort: 8080 - name: http - resources: - requests: - cpu: 10m - volumeMounts: - - mountPath: /etc/boskos - name: boskos - readOnly: true - - mountPath: /secrets/ci-pull-credentials - name: ci-pull-credentials - readOnly: true - - mountPath: /secrets/gcs - name: gcs-credentials - readOnly: true - - mountPath: /secrets/manifest-tool - name: manifest-tool-local-pusher - readOnly: true - - mountPath: /etc/pull-secret - name: pull-secret - readOnly: true - - mountPath: /etc/report - name: result-aggregator - readOnly: true - serviceAccountName: ci-operator - volumes: - - name: boskos - secret: - items: - - key: credentials - path: credentials - secretName: boskos-credentials - - name: ci-pull-credentials - secret: - secretName: ci-pull-credentials - - name: manifest-tool-local-pusher - secret: - secretName: manifest-tool-local-pusher - - name: pull-secret - secret: - secretName: registry-pull-credentials - - name: result-aggregator - secret: - secretName: result-aggregator - trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml index 5a3b3ffe1f0d6..bf04a329296ea 100644 --- a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml @@ -643,95 +643,6 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) - - agent: kubernetes - always_run: false - branches: - - ^release-0\.12$ - - ^release-0\.12- - cluster: build10 - context: ci/prow/4.23-tls13-adherence - decorate: true - decoration_config: - sparse_checkout_files: - - .ci-operator.yaml - - Dockerfile - labels: - ci-operator.openshift.io/cloud: aws - ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws - ci-operator.openshift.io/variant: "4.23" - ci.openshift.io/generator: prowgen - job-release: "4.23" - pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-4.23-tls13-adherence - optional: true - rerun_command: /test 4.23-tls13-adherence - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - spec: - containers: - - args: - - --gcs-upload-secret=/secrets/gcs/service-account.json - - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --lease-server-credentials-file=/etc/boskos/credentials - - --report-credentials-file=/etc/report/credentials - - --secret-dir=/secrets/ci-pull-credentials - - --target=tls13-adherence - - --variant=4.23 - command: - - ci-operator - env: - - name: HTTP_SERVER_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest - imagePullPolicy: Always - name: "" - ports: - - containerPort: 8080 - name: http - resources: - requests: - cpu: 10m - volumeMounts: - - mountPath: /etc/boskos - name: boskos - readOnly: true - - mountPath: /secrets/ci-pull-credentials - name: ci-pull-credentials - readOnly: true - - mountPath: /secrets/gcs - name: gcs-credentials - readOnly: true - - mountPath: /secrets/manifest-tool - name: manifest-tool-local-pusher - readOnly: true - - mountPath: /etc/pull-secret - name: pull-secret - readOnly: true - - mountPath: /etc/report - name: result-aggregator - readOnly: true - serviceAccountName: ci-operator - volumes: - - name: boskos - secret: - items: - - key: credentials - path: credentials - secretName: boskos-credentials - - name: ci-pull-credentials - secret: - secretName: ci-pull-credentials - - name: manifest-tool-local-pusher - secret: - secretName: manifest-tool-local-pusher - - name: pull-secret - secret: - secretName: registry-pull-credentials - - name: result-aggregator - secret: - secretName: result-aggregator - trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -1098,92 +1009,3 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) - - agent: kubernetes - always_run: false - branches: - - ^release-0\.12$ - - ^release-0\.12- - cluster: build10 - context: ci/prow/5.0-tls13-adherence - decorate: true - decoration_config: - sparse_checkout_files: - - .ci-operator.yaml - - Dockerfile - labels: - ci-operator.openshift.io/cloud: aws - ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws - ci-operator.openshift.io/variant: "5.0" - ci.openshift.io/generator: prowgen - job-release: "5.0" - pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-5.0-tls13-adherence - optional: true - rerun_command: /test 5.0-tls13-adherence - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - spec: - containers: - - args: - - --gcs-upload-secret=/secrets/gcs/service-account.json - - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --lease-server-credentials-file=/etc/boskos/credentials - - --report-credentials-file=/etc/report/credentials - - --secret-dir=/secrets/ci-pull-credentials - - --target=tls13-adherence - - --variant=5.0 - command: - - ci-operator - env: - - name: HTTP_SERVER_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest - imagePullPolicy: Always - name: "" - ports: - - containerPort: 8080 - name: http - resources: - requests: - cpu: 10m - volumeMounts: - - mountPath: /etc/boskos - name: boskos - readOnly: true - - mountPath: /secrets/ci-pull-credentials - name: ci-pull-credentials - readOnly: true - - mountPath: /secrets/gcs - name: gcs-credentials - readOnly: true - - mountPath: /secrets/manifest-tool - name: manifest-tool-local-pusher - readOnly: true - - mountPath: /etc/pull-secret - name: pull-secret - readOnly: true - - mountPath: /etc/report - name: result-aggregator - readOnly: true - serviceAccountName: ci-operator - volumes: - - name: boskos - secret: - items: - - key: credentials - path: credentials - secretName: boskos-credentials - - name: ci-pull-credentials - secret: - secretName: ci-pull-credentials - - name: manifest-tool-local-pusher - secret: - secretName: manifest-tool-local-pusher - - name: pull-secret - secret: - secretName: registry-pull-credentials - - name: result-aggregator - secret: - secretName: result-aggregator - trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml index 3fb6ffbec900f..94e3c56e923f7 100644 --- a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml @@ -643,95 +643,6 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) - - agent: kubernetes - always_run: false - branches: - - ^release-0\.21$ - - ^release-0\.21- - cluster: build10 - context: ci/prow/4.23-tls13-adherence - decorate: true - decoration_config: - sparse_checkout_files: - - .ci-operator.yaml - - Dockerfile - labels: - ci-operator.openshift.io/cloud: aws - ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws - ci-operator.openshift.io/variant: "4.23" - ci.openshift.io/generator: prowgen - job-release: "4.23" - pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-medik8s-node-maintenance-operator-release-0.21-4.23-tls13-adherence - optional: true - rerun_command: /test 4.23-tls13-adherence - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - spec: - containers: - - args: - - --gcs-upload-secret=/secrets/gcs/service-account.json - - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --lease-server-credentials-file=/etc/boskos/credentials - - --report-credentials-file=/etc/report/credentials - - --secret-dir=/secrets/ci-pull-credentials - - --target=tls13-adherence - - --variant=4.23 - command: - - ci-operator - env: - - name: HTTP_SERVER_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest - imagePullPolicy: Always - name: "" - ports: - - containerPort: 8080 - name: http - resources: - requests: - cpu: 10m - volumeMounts: - - mountPath: /etc/boskos - name: boskos - readOnly: true - - mountPath: /secrets/ci-pull-credentials - name: ci-pull-credentials - readOnly: true - - mountPath: /secrets/gcs - name: gcs-credentials - readOnly: true - - mountPath: /secrets/manifest-tool - name: manifest-tool-local-pusher - readOnly: true - - mountPath: /etc/pull-secret - name: pull-secret - readOnly: true - - mountPath: /etc/report - name: result-aggregator - readOnly: true - serviceAccountName: ci-operator - volumes: - - name: boskos - secret: - items: - - key: credentials - path: credentials - secretName: boskos-credentials - - name: ci-pull-credentials - secret: - secretName: ci-pull-credentials - - name: manifest-tool-local-pusher - secret: - secretName: manifest-tool-local-pusher - - name: pull-secret - secret: - secretName: registry-pull-credentials - - name: result-aggregator - secret: - secretName: result-aggregator - trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -1098,92 +1009,3 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) - - agent: kubernetes - always_run: false - branches: - - ^release-0\.21$ - - ^release-0\.21- - cluster: build10 - context: ci/prow/5.0-tls13-adherence - decorate: true - decoration_config: - sparse_checkout_files: - - .ci-operator.yaml - - Dockerfile - labels: - ci-operator.openshift.io/cloud: aws - ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws - ci-operator.openshift.io/variant: "5.0" - ci.openshift.io/generator: prowgen - job-release: "5.0" - pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-medik8s-node-maintenance-operator-release-0.21-5.0-tls13-adherence - optional: true - rerun_command: /test 5.0-tls13-adherence - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - spec: - containers: - - args: - - --gcs-upload-secret=/secrets/gcs/service-account.json - - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --lease-server-credentials-file=/etc/boskos/credentials - - --report-credentials-file=/etc/report/credentials - - --secret-dir=/secrets/ci-pull-credentials - - --target=tls13-adherence - - --variant=5.0 - command: - - ci-operator - env: - - name: HTTP_SERVER_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest - imagePullPolicy: Always - name: "" - ports: - - containerPort: 8080 - name: http - resources: - requests: - cpu: 10m - volumeMounts: - - mountPath: /etc/boskos - name: boskos - readOnly: true - - mountPath: /secrets/ci-pull-credentials - name: ci-pull-credentials - readOnly: true - - mountPath: /secrets/gcs - name: gcs-credentials - readOnly: true - - mountPath: /secrets/manifest-tool - name: manifest-tool-local-pusher - readOnly: true - - mountPath: /etc/pull-secret - name: pull-secret - readOnly: true - - mountPath: /etc/report - name: result-aggregator - readOnly: true - serviceAccountName: ci-operator - volumes: - - name: boskos - secret: - items: - - key: credentials - path: credentials - secretName: boskos-credentials - - name: ci-pull-credentials - secret: - secretName: ci-pull-credentials - - name: manifest-tool-local-pusher - secret: - secretName: manifest-tool-local-pusher - - name: pull-secret - secret: - secretName: registry-pull-credentials - - name: result-aggregator - secret: - secretName: result-aggregator - trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) diff --git a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml index 61906da072242..77d1c650867fe 100644 --- a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml +++ b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml @@ -643,95 +643,6 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.23-tls-pqc-readiness,?($|\s.*) - - agent: kubernetes - always_run: false - branches: - - ^release-0\.13$ - - ^release-0\.13- - cluster: build05 - context: ci/prow/4.23-tls13-adherence - decorate: true - decoration_config: - sparse_checkout_files: - - .ci-operator.yaml - - Dockerfile - labels: - ci-operator.openshift.io/cloud: aws - ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws - ci-operator.openshift.io/variant: "4.23" - ci.openshift.io/generator: prowgen - job-release: "4.23" - pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-medik8s-self-node-remediation-release-0.13-4.23-tls13-adherence - optional: true - rerun_command: /test 4.23-tls13-adherence - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - spec: - containers: - - args: - - --gcs-upload-secret=/secrets/gcs/service-account.json - - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --lease-server-credentials-file=/etc/boskos/credentials - - --report-credentials-file=/etc/report/credentials - - --secret-dir=/secrets/ci-pull-credentials - - --target=tls13-adherence - - --variant=4.23 - command: - - ci-operator - env: - - name: HTTP_SERVER_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest - imagePullPolicy: Always - name: "" - ports: - - containerPort: 8080 - name: http - resources: - requests: - cpu: 10m - volumeMounts: - - mountPath: /etc/boskos - name: boskos - readOnly: true - - mountPath: /secrets/ci-pull-credentials - name: ci-pull-credentials - readOnly: true - - mountPath: /secrets/gcs - name: gcs-credentials - readOnly: true - - mountPath: /secrets/manifest-tool - name: manifest-tool-local-pusher - readOnly: true - - mountPath: /etc/pull-secret - name: pull-secret - readOnly: true - - mountPath: /etc/report - name: result-aggregator - readOnly: true - serviceAccountName: ci-operator - volumes: - - name: boskos - secret: - items: - - key: credentials - path: credentials - secretName: boskos-credentials - - name: ci-pull-credentials - secret: - secretName: ci-pull-credentials - - name: manifest-tool-local-pusher - secret: - secretName: manifest-tool-local-pusher - - name: pull-secret - secret: - secretName: registry-pull-credentials - - name: result-aggregator - secret: - secretName: result-aggregator - trigger: (?m)^/test( | .* )4.23-tls13-adherence,?($|\s.*) - agent: kubernetes always_run: true branches: @@ -1098,92 +1009,3 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )5.0-tls-pqc-readiness,?($|\s.*) - - agent: kubernetes - always_run: false - branches: - - ^release-0\.13$ - - ^release-0\.13- - cluster: build05 - context: ci/prow/5.0-tls13-adherence - decorate: true - decoration_config: - sparse_checkout_files: - - .ci-operator.yaml - - Dockerfile - labels: - ci-operator.openshift.io/cloud: aws - ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws - ci-operator.openshift.io/variant: "5.0" - ci.openshift.io/generator: prowgen - job-release: "5.0" - pj-rehearse.openshift.io/can-be-rehearsed: "true" - name: pull-ci-medik8s-self-node-remediation-release-0.13-5.0-tls13-adherence - optional: true - rerun_command: /test 5.0-tls13-adherence - skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ - spec: - containers: - - args: - - --gcs-upload-secret=/secrets/gcs/service-account.json - - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson - - --lease-server-credentials-file=/etc/boskos/credentials - - --report-credentials-file=/etc/report/credentials - - --secret-dir=/secrets/ci-pull-credentials - - --target=tls13-adherence - - --variant=5.0 - command: - - ci-operator - env: - - name: HTTP_SERVER_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest - imagePullPolicy: Always - name: "" - ports: - - containerPort: 8080 - name: http - resources: - requests: - cpu: 10m - volumeMounts: - - mountPath: /etc/boskos - name: boskos - readOnly: true - - mountPath: /secrets/ci-pull-credentials - name: ci-pull-credentials - readOnly: true - - mountPath: /secrets/gcs - name: gcs-credentials - readOnly: true - - mountPath: /secrets/manifest-tool - name: manifest-tool-local-pusher - readOnly: true - - mountPath: /etc/pull-secret - name: pull-secret - readOnly: true - - mountPath: /etc/report - name: result-aggregator - readOnly: true - serviceAccountName: ci-operator - volumes: - - name: boskos - secret: - items: - - key: credentials - path: credentials - secretName: boskos-credentials - - name: ci-pull-credentials - secret: - secretName: ci-pull-credentials - - name: manifest-tool-local-pusher - secret: - secretName: manifest-tool-local-pusher - - name: pull-secret - secret: - secretName: registry-pull-credentials - - name: result-aggregator - secret: - secretName: result-aggregator - trigger: (?m)^/test( | .* )5.0-tls13-adherence,?($|\s.*) From 89086408faa2f773ca338aec0b0ee5ffc59131c4 Mon Sep 17 00:00:00 2001 From: JonahSussman Date: Thu, 20 Aug 2026 02:43:39 -0400 Subject: [PATCH 8/9] medik8s: add PQC readiness scan to main branch 4.22 configs PQC readiness (ML-KEM) has been mandatory since OCP 4.22, so it should run wherever code is tested against 4.22+, including the main branch's 4.22 variant. It was only present on the 4.23/5.0 variants. Add it to all six operators' main__4.22.yaml configs for consistency (tls13-adherence stays out, per the main-only-until-5.0 rule already applied elsewhere). Signed-off-by: JonahSussman --- ...s-fence-agents-remediation-main__4.22.yaml | 36 ++++++++ ...chine-deletion-remediation-main__4.22.yaml | 37 ++++++++ ...-node-healthcheck-operator-main__4.22.yaml | 38 ++++++++ ...-node-maintenance-operator-main__4.22.yaml | 36 ++++++++ ...ik8s-self-node-remediation-main__4.22.yaml | 36 ++++++++ ...-storage-based-remediation-main__4.22.yaml | 38 ++++++++ ...ce-agents-remediation-main-presubmits.yaml | 89 ++++++++++++++++++ ...-deletion-remediation-main-presubmits.yaml | 89 ++++++++++++++++++ ...-healthcheck-operator-main-presubmits.yaml | 89 ++++++++++++++++++ ...-maintenance-operator-main-presubmits.yaml | 89 ++++++++++++++++++ ...self-node-remediation-main-presubmits.yaml | 89 ++++++++++++++++++ ...age-based-remediation-main-presubmits.yaml | 90 +++++++++++++++++++ 12 files changed, 756 insertions(+) diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.22.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.22.yaml index 2a5580bc570b7..557c0223a8df8 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.22.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.22.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.22.yaml index 45fd763884b3d..269b1661cd01d 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.22.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: ubi namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -91,6 +95,39 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.22.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.22.yaml index f1c4b1baa9efe..1c8672cce19be 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.22.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main__4.22.yaml @@ -7,6 +7,10 @@ base_images: name: claude-ai-helpers namespace: ci tag: latest + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -101,6 +105,40 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG=quay.io/medik8s/self-node-remediation-operator-bundle:latest make bundle-run + OPERATOR_NAMESPACE="$INSTALL_NAMESPACE" BUNDLE_IMG="$OO_BUNDLE" make bundle-run + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.22.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.22.yaml index 6fe529cd12b9d..efef3b7564597 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.22.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: "4.22" namespace: ocp tag: base + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -88,6 +92,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.22.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.22.yaml index 81214f2645946..80df66cf51f98 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.22.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-main__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: ubi-minimal namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -90,6 +94,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.22.yaml b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.22.yaml index 748c97e0d828d..a71e6b8246245 100644 --- a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.22.yaml +++ b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -117,6 +121,40 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: sbr-operator-system + PQC_CHECK: "true" + SCAN_NAMESPACE: sbr-operator-system + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + - env: SBR_AGENT_IMAGE + name: sbr-agent + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: main org: medik8s diff --git a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml index 9b106ced23223..1b503658fc2e3 100644 --- a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build09 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-main-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml index cb40a8e325568..00cca4c79f570 100644 --- a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-main-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build03 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-main-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml index 0f781b93d382b..9892c71a7b184 100644 --- a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-main-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-main-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml index 6bc202a298dfa..b32652ec83afa 100644 --- a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-main-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-main-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml index 23942c30659e4..e0da4eb44fa82 100644 --- a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-main-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build05 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-main-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml b/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml index cd2749d5094ff..b77f8957ba224 100644 --- a/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml +++ b/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-main-presubmits.yaml @@ -211,6 +211,96 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-openshift-e2e,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build10 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - cmd/sbr-agent/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-storage-based-remediation-main-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: From b794d3060184b1e7b6d039b42e28d54621a1da57 Mon Sep 17 00:00:00 2001 From: JonahSussman Date: Thu, 20 Aug 2026 03:04:53 -0400 Subject: [PATCH 9/9] medik8s: add PQC readiness scan to release branch 4.22 configs PQC readiness has been mandatory since OCP 4.22, and each operator's current release branch is the one aligned to 4.22 support (main will carry 4.23/5.0 forward). Add tls-pqc-readiness to the latest release branch's 4.22 config for all six operators, alongside the existing main__4.22.yaml coverage. MDR and NHC's release branches still install via operator-sdk (only main was migrated to make bundle-run upstream), so their install steps match that existing, already-proven convention. Signed-off-by: JonahSussman --- ...-agents-remediation-release-0.8__4.22.yaml | 36 ++++++++ ...eletion-remediation-release-0.7__4.22.yaml | 37 ++++++++ ...althcheck-operator-release-0.12__4.22.yaml | 38 ++++++++ ...intenance-operator-release-0.21__4.22.yaml | 36 ++++++++ ...f-node-remediation-release-0.13__4.22.yaml | 36 ++++++++ ...e-based-remediation-release-0.3__4.22.yaml | 38 ++++++++ ...ts-remediation-release-0.8-presubmits.yaml | 89 ++++++++++++++++++ ...on-remediation-release-0.7-presubmits.yaml | 89 ++++++++++++++++++ ...heck-operator-release-0.12-presubmits.yaml | 89 ++++++++++++++++++ ...ance-operator-release-0.21-presubmits.yaml | 89 ++++++++++++++++++ ...e-remediation-release-0.13-presubmits.yaml | 89 ++++++++++++++++++ ...ed-remediation-release-0.3-presubmits.yaml | 90 +++++++++++++++++++ 12 files changed, 756 insertions(+) diff --git a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.22.yaml b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.22.yaml index 33f9fd20211ac..57f2fe48b3383 100644 --- a/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.22.yaml +++ b/ci-operator/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -89,6 +93,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: far-install + PQC_CHECK: "true" + SCAN_NAMESPACE: far-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.8 org: medik8s diff --git a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.22.yaml b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.22.yaml index 3a04059935bb8..35a5ade26a25f 100644 --- a/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.22.yaml +++ b/ci-operator/config/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7__4.22.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -81,6 +85,39 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: mdr-install + PQC_CHECK: "true" + SCAN_NAMESPACE: mdr-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment machine-deletion-remediation-controller-manager + dependencies: + - env: OO_BUNDLE + name: machine-deletion-remediation-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.7 org: medik8s diff --git a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.22.yaml b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.22.yaml index 9c35fc84f9e49..cf915381d7ec9 100644 --- a/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.22.yaml +++ b/ci-operator/config/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12__4.22.yaml @@ -7,6 +7,10 @@ base_images: name: "4.17" namespace: origin tag: operator-sdk + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make manager build_root: from_repository: true @@ -84,6 +88,40 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + INSTALL_NAMESPACE: nhc-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nhc-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$INSTALL_NAMESPACE" + oc label --overwrite ns "$INSTALL_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$INSTALL_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + operator-sdk run bundle -n "$INSTALL_NAMESPACE" quay.io/medik8s/self-node-remediation-operator-bundle:latest + operator-sdk run bundle -n "$INSTALL_NAMESPACE" "$OO_BUNDLE" + oc wait --for condition=Available -n "$INSTALL_NAMESPACE" deployment node-healthcheck-controller-manager + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: INSTALL_NAMESPACE + from: operator-sdk + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.12 org: medik8s diff --git a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.22.yaml b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.22.yaml index 720b18222519c..a7916f9b7fdb1 100644 --- a/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.22.yaml +++ b/ci-operator/config/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: "4.22" namespace: ocp tag: base + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -88,6 +92,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: nmo-install + PQC_CHECK: "true" + SCAN_NAMESPACE: nmo-install + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + oc create namespace "$OPERATOR_NAMESPACE" + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.21 org: medik8s diff --git a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.22.yaml b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.22.yaml index d06bdc1ff0c92..8a32f0f8d86d1 100644 --- a/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.22.yaml +++ b/ci-operator/config/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: ubi-minimal namespace: ocp tag: "9" + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -90,6 +94,38 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: self-node-remediation + PQC_CHECK: "true" + SCAN_NAMESPACE: self-node-remediation + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: self-node-remediation-bundle + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.13 org: medik8s diff --git a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-release-0.3__4.22.yaml b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-release-0.3__4.22.yaml index f62305131efe5..c8d875a1858f6 100644 --- a/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-release-0.3__4.22.yaml +++ b/ci-operator/config/medik8s/storage-based-remediation/medik8s-storage-based-remediation-release-0.3__4.22.yaml @@ -3,6 +3,10 @@ base_images: name: centos namespace: openshift tag: stream9 + tls-scanner-tool: + name: tls-scanner + namespace: tls-scanner + tag: tls-scanner-tool binary_build_commands: make build build_root: from_repository: true @@ -117,6 +121,40 @@ tests: cpu: 100m memory: 200Mi workflow: ipi-aws +- as: tls-pqc-readiness + optional: true + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + steps: + cluster_profile: medik8s-aws + env: + BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com + OPERATOR_NAMESPACE: sbr-operator-system + PQC_CHECK: "true" + SCAN_NAMESPACE: sbr-operator-system + SCANNER_CPU: "2" + test: + - as: install-operator + cli: latest + commands: | + make create-ns + oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false + oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged + BUNDLE_IMG="$OO_BUNDLE" make bundle-run + dependencies: + - env: OO_BUNDLE + name: my-bundle + - env: SBR_AGENT_IMAGE + name: sbr-agent + env: + - name: OPERATOR_NAMESPACE + from: src + resources: + requests: + cpu: 100m + memory: 200Mi + - ref: tls-13 + - ref: tls-scanner-run + workflow: ipi-aws zz_generated_metadata: branch: release-0.3 org: medik8s diff --git a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml index 03178cacff7be..82ea5c3f130aa 100644 --- a/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml +++ b/ci-operator/jobs/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.8$ + - ^release-0\.8- + cluster: build07 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-fence-agents-remediation-release-0.8-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml index e96cfb3edca4f..b824c1467f0a9 100644 --- a/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml +++ b/ci-operator/jobs/medik8s/machine-deletion-remediation/medik8s-machine-deletion-remediation-release-0.7-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.7$ + - ^release-0\.7- + cluster: build01 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-machine-deletion-remediation-release-0.7-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml index bf04a329296ea..0df53cb1d4e85 100644 --- a/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-healthcheck-operator/medik8s-node-healthcheck-operator-release-0.12-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.12$ + - ^release-0\.12- + cluster: build10 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-healthcheck-operator-release-0.12-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml index 94e3c56e923f7..c25532d6443c1 100644 --- a/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml +++ b/ci-operator/jobs/medik8s/node-maintenance-operator/medik8s-node-maintenance-operator-release-0.21-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.21$ + - ^release-0\.21- + cluster: build10 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-node-maintenance-operator-release-0.21-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml index 77d1c650867fe..1f97c1fcd8d87 100644 --- a/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml +++ b/ci-operator/jobs/medik8s/self-node-remediation/medik8s-self-node-remediation-release-0.13-presubmits.yaml @@ -277,6 +277,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-test,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.13$ + - ^release-0\.13- + cluster: build05 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-self-node-remediation-release-0.13-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: true branches: diff --git a/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-release-0.3-presubmits.yaml b/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-release-0.3-presubmits.yaml index 76fe13d88c3d4..1c8d7107db32a 100644 --- a/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-release-0.3-presubmits.yaml +++ b/ci-operator/jobs/medik8s/storage-based-remediation/medik8s-storage-based-remediation-release-0.3-presubmits.yaml @@ -422,3 +422,93 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )4.22-openshift-e2e,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^release-0\.3$ + - ^release-0\.3- + cluster: build09 + context: ci/prow/4.22-tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - Dockerfile + - cmd/sbr-agent/Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws + ci-operator.openshift.io/variant: "4.22" + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-medik8s-storage-based-remediation-release-0.3-4.22-tls-pqc-readiness + optional: true + rerun_command: /test 4.22-tls-pqc-readiness + skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$ + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + - --variant=4.22 + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )4.22-tls-pqc-readiness,?($|\s.*)