Skip to content

Add TLS and PQC checks for RHWA operators #83399

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 9 commits into from
Aug 20, 2026
Merged

Add TLS and PQC checks for RHWA operators #83399

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
3441a0b
medik8s: add TLS 1.3 / PQC scanner CI for all operators
JonahSussman Aug 13, 2026
35bef5f
medik8s: regenerate CI jobs for TLS scanner
JonahSussman Aug 13, 2026
0c5b613
medik8s: declare tls-scanner-tool base image for 4.23 scanner jobs
JonahSussman Aug 18, 2026
e45fc54
medik8s: run TLS scanner presubmits on all non-trivial changes
JonahSussman Aug 18, 2026
924fed4
medik8s: stagger 5.0 TLS periodics to avoid cluster collision
JonahSussman Aug 18, 2026
5c38202
medik8s: regenerate CI jobs for trigger broadening and cron stagger
JonahSussman Aug 18, 2026
ff757bf
medik8s: restrict TLS 1.3 adherence scans to main branch configs
JonahSussman Aug 20, 2026
8908640
medik8s: add PQC readiness scan to main branch 4.22 configs
JonahSussman Aug 20, 2026
b794d30
medik8s: add PQC readiness scan to release branch 4.22 configs
JonahSussman Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions .../config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.22.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ base_images:
name: centos
namespace: openshift
tag: stream9
tls-scanner-tool:
name: tls-scanner
namespace: tls-scanner
tag: tls-scanner-tool
binary_build_commands: make build
build_root:
from_repository: true
Expand Down Expand Up @@ -89,6 +93,38 @@ tests:
cpu: 100m
memory: 200Mi
workflow: ipi-aws
- as: tls-pqc-readiness
optional: true
skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$
steps:
cluster_profile: medik8s-aws
env:
BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com
OPERATOR_NAMESPACE: far-install
PQC_CHECK: "true"
SCAN_NAMESPACE: far-install
SCANNER_CPU: "2"
test:
- as: install-operator
cli: latest
commands: |
make create-ns
oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false
oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged
BUNDLE_IMG="$OO_BUNDLE" make bundle-run
dependencies:
- env: OO_BUNDLE
name: my-bundle
env:
- name: OPERATOR_NAMESPACE
from: src
resources:
requests:
cpu: 100m
memory: 200Mi
- ref: tls-13
- ref: tls-scanner-run
workflow: ipi-aws
zz_generated_metadata:
branch: main
org: medik8s
Expand Down
70 changes: 70 additions & 0 deletions .../config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__4.23.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ base_images:
name: centos
namespace: openshift
tag: stream9
tls-scanner-tool:
name: tls-scanner
namespace: tls-scanner
tag: tls-scanner-tool
binary_build_commands: make build
build_root:
from_repository: true
Expand Down Expand Up @@ -89,6 +93,72 @@ tests:
cpu: 100m
memory: 200Mi
workflow: ipi-aws
Comment thread
JonahSussman marked this conversation as resolved.
- as: tls-pqc-readiness
Comment thread
JonahSussman marked this conversation as resolved.
optional: true
skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$
steps:
cluster_profile: medik8s-aws
env:
BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com
OPERATOR_NAMESPACE: far-install
PQC_CHECK: "true"
SCAN_NAMESPACE: far-install
SCANNER_CPU: "2"
test:
- as: install-operator
cli: latest
commands: |
make create-ns
oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false
oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged
BUNDLE_IMG="$OO_BUNDLE" make bundle-run
dependencies:
- env: OO_BUNDLE
name: my-bundle
env:
- name: OPERATOR_NAMESPACE
from: src
resources:
requests:
cpu: 100m
memory: 200Mi
- ref: tls-13
- ref: tls-scanner-run
workflow: ipi-aws
- as: tls13-adherence
optional: true
skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$
steps:
cluster_profile: medik8s-aws
env:
BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com
OPERATOR_NAMESPACE: far-install
PQC_CHECK: "false"
SCAN_NAMESPACE: far-install
SCANNER_CPU: "2"
TLS_13_ENABLE_TLS_ADHERENCE: "true"
TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents
test:
- as: install-operator
cli: latest
commands: |
make create-ns
oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false
oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged
BUNDLE_IMG="$OO_BUNDLE" make bundle-run
dependencies:
- env: OO_BUNDLE
name: my-bundle
env:
- name: OPERATOR_NAMESPACE
from: src
resources:
requests:
cpu: 100m
memory: 200Mi
- ref: tls-13
- ref: tls-scanner-run
workflow: ipi-aws
zz_generated_metadata:
branch: main
org: medik8s
Expand Down
70 changes: 70 additions & 0 deletions ...r/config/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-main__5.0.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ base_images:
name: centos
namespace: openshift
tag: stream9
tls-scanner-tool:
name: tls-scanner
namespace: tls-scanner
tag: tls-scanner-tool
binary_build_commands: make build
build_root:
from_repository: true
Expand Down Expand Up @@ -89,6 +93,72 @@ tests:
cpu: 100m
memory: 200Mi
workflow: ipi-aws
- as: tls-pqc-readiness
optional: true
skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$
steps:
cluster_profile: medik8s-aws
env:
BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com
OPERATOR_NAMESPACE: far-install
PQC_CHECK: "true"
SCAN_NAMESPACE: far-install
SCANNER_CPU: "2"
test:
- as: install-operator
cli: latest
commands: |
make create-ns
oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false
oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged
BUNDLE_IMG="$OO_BUNDLE" make bundle-run
dependencies:
- env: OO_BUNDLE
name: my-bundle
env:
- name: OPERATOR_NAMESPACE
from: src
resources:
requests:
cpu: 100m
memory: 200Mi
- ref: tls-13
- ref: tls-scanner-run
workflow: ipi-aws
- as: tls13-adherence
optional: true
skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$
steps:
cluster_profile: medik8s-aws
env:
BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com
OPERATOR_NAMESPACE: far-install
PQC_CHECK: "false"
SCAN_NAMESPACE: far-install
SCANNER_CPU: "2"
TLS_13_ENABLE_TLS_ADHERENCE: "true"
TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents
test:
- as: install-operator
cli: latest
commands: |
make create-ns
oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false
oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged
BUNDLE_IMG="$OO_BUNDLE" make bundle-run
dependencies:
- env: OO_BUNDLE
name: my-bundle
env:
- name: OPERATOR_NAMESPACE
from: src
resources:
requests:
cpu: 100m
memory: 200Mi
- ref: tls-13
- ref: tls-scanner-run
workflow: ipi-aws
zz_generated_metadata:
branch: main
org: medik8s
Expand Down
36 changes: 36 additions & 0 deletions .../medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.22.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ base_images:
name: centos
namespace: openshift
tag: stream9
tls-scanner-tool:
name: tls-scanner
namespace: tls-scanner
tag: tls-scanner-tool
binary_build_commands: make build
build_root:
from_repository: true
Expand Down Expand Up @@ -89,6 +93,38 @@ tests:
cpu: 100m
memory: 200Mi
workflow: ipi-aws
- as: tls-pqc-readiness
optional: true
skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$
steps:
cluster_profile: medik8s-aws
env:
BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com
OPERATOR_NAMESPACE: far-install
PQC_CHECK: "true"
SCAN_NAMESPACE: far-install
SCANNER_CPU: "2"
test:
- as: install-operator
cli: latest
commands: |
make create-ns
oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false
oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged
BUNDLE_IMG="$OO_BUNDLE" make bundle-run
dependencies:
- env: OO_BUNDLE
name: my-bundle
env:
- name: OPERATOR_NAMESPACE
from: src
resources:
requests:
cpu: 100m
memory: 200Mi
- ref: tls-13
- ref: tls-scanner-run
workflow: ipi-aws
zz_generated_metadata:
branch: release-0.8
org: medik8s
Expand Down
36 changes: 36 additions & 0 deletions .../medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__4.23.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ base_images:
name: centos
namespace: openshift
tag: stream9
tls-scanner-tool:
name: tls-scanner
namespace: tls-scanner
tag: tls-scanner-tool
binary_build_commands: make build
build_root:
from_repository: true
Expand Down Expand Up @@ -89,6 +93,38 @@ tests:
cpu: 100m
memory: 200Mi
workflow: ipi-aws
- as: tls-pqc-readiness
optional: true
skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$
steps:
cluster_profile: medik8s-aws
env:
BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com
OPERATOR_NAMESPACE: far-install
PQC_CHECK: "true"
SCAN_NAMESPACE: far-install
SCANNER_CPU: "2"
test:
- as: install-operator
cli: latest
commands: |
make create-ns
oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false
oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged
BUNDLE_IMG="$OO_BUNDLE" make bundle-run
dependencies:
- env: OO_BUNDLE
name: my-bundle
env:
- name: OPERATOR_NAMESPACE
from: src
resources:
requests:
cpu: 100m
memory: 200Mi
- ref: tls-13
- ref: tls-scanner-run
workflow: ipi-aws
zz_generated_metadata:
branch: release-0.8
org: medik8s
Expand Down
36 changes: 36 additions & 0 deletions ...g/medik8s/fence-agents-remediation/medik8s-fence-agents-remediation-release-0.8__5.0.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ base_images:
name: centos
namespace: openshift
tag: stream9
tls-scanner-tool:
name: tls-scanner
namespace: tls-scanner
tag: tls-scanner-tool
binary_build_commands: make build
build_root:
from_repository: true
Expand Down Expand Up @@ -89,6 +93,38 @@ tests:
cpu: 100m
memory: 200Mi
workflow: ipi-aws
- as: tls-pqc-readiness
optional: true
skip_if_only_changed: ^docs/|\.md$|^(?:.*/)?(?:\.gitignore|OWNERS|PROJECT|LICENSE)$
steps:
cluster_profile: medik8s-aws
env:
BASE_DOMAIN: ocp-ci.medik8s-ci.devcluster.openshift.com
OPERATOR_NAMESPACE: far-install
PQC_CHECK: "true"
SCAN_NAMESPACE: far-install
SCANNER_CPU: "2"
test:
- as: install-operator
cli: latest
commands: |
make create-ns
oc label --overwrite ns "$OPERATOR_NAMESPACE" security.openshift.io/scc.podSecurityLabelSync=false
oc label --overwrite ns "$OPERATOR_NAMESPACE" pod-security.kubernetes.io/enforce=privileged
BUNDLE_IMG="$OO_BUNDLE" make bundle-run
dependencies:
- env: OO_BUNDLE
name: my-bundle
env:
- name: OPERATOR_NAMESPACE
from: src
resources:
requests:
cpu: 100m
memory: 200Mi
- ref: tls-13
- ref: tls-scanner-run
workflow: ipi-aws
zz_generated_metadata:
branch: release-0.8
org: medik8s
Expand Down
Loading