Remove redundant TLS/PQC scanner jobs from 4.22, 4.23, and release branches - #83855
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
@razo7: GitHub didn't allow me to request PR reviews from the following users: JonahSussman. Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (13)
📒 Files selected for processing (29)
💤 Files with no reviewable changes (29)
Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review. WalkthroughThe change removes the ChangesMedik8s TLS CI cleanup
Estimated code review effort: 2 (Simple) | ~15 minutes Merge Risk: ⚪ Minimal · up to This PR removes obsolete TLS scanner jobs while retaining the required 5.0 coverage; no actionable merge-blocking risk remains beyond normal checks and review. Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-ci
Bot
added
the
approved
|
@razo7, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse atuo-ack |
|
@razo7: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@razo7, If the problem persists, please contact Test Platform. |
|
/pj-rehearse ack |
|
@razo7: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
openshift-merge-bot
Bot
removed
the
rehearsals-ack
|
/pj-rehearse ack |
|
@razo7: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
openshift-ci
Bot
added
the
needs-rebase
…anches The tls-pqc-readiness and tls13-adherence CI jobs were added in openshift#83399 for RHWA operators. This removes the jobs that are no longer needed: - tls-pqc-readiness from all 4.22 configs (main + release branches) - tls-pqc-readiness and tls13-adherence from all 4.23 configs - tls-pqc-readiness from all release branch 5.0 configs - Corresponding tls-scanner-tool base_image entries - System-tests 4.23 periodic TLS jobs The PQC ML-KEM verification on 4.22 was a one-time test activity (OCPSTRAT-2361); the RHWA tickets (RHWA-1024/1025/1045) are closed. These jobs tested Go default ML-KEM behavior, which the remaining main__5.0 tls-pqc-readiness job covers identically. TLS 1.3 adherence is a 5.0 GA release blocker (OCPSTRAT-2611), so tls13-adherence remains on main__5.0 only. The regular e2e and unit test jobs on 4.22/4.23/5.0 are unaffected. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
After removing TLS scanner jobs, this config had no tests or images left, causing ci-operator validation to fail with "you must define at least one test or image build". Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fix generated-config and ordered-prow-config CI failures caused by pre-existing missing trailing newlines in 6 release-branch presubmit job files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
c04bf78 to
da54fe0
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
openshift-ci
Bot
removed
the
needs-rebase
openshift-merge-bot
Bot
removed
the
rehearsals-ack
|
[REHEARSALNOTIFIER]
A total of 109 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs. A full list of affected jobs can be found here Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse ack |
|
@razo7: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
@razo7: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
@razo7 we can remove the 5.0 tls/pcq jobs because we have our own tests now? I understand why 4.22 and 4.23 need to be removed, but unclear why we're removing 5.0 jobs sir. Can you please update the summary w/ the reasons. Thank you |
Good question. To clarify, the PR does not remove any 5.0 What's removed is That said, if you'd prefer keeping them on release branches for completeness, the CI cost is small. Let me know and I'll update the PR either way. I'll also update the summary to make the main-vs-release-branch distinction clearer. @weshayutin |
|
@razo7 thanks for the explanation. OK.. I'm now referring to the versions table and this makes sense. thank you!! |
|
/lgtm |
3 participants
Summary
Follow-up to #83399. Removes TLS scanner CI jobs that are no longer needed:
tls-pqc-readinessfrom all 4.22 configs (main + release branches)tls-pqc-readinessandtls13-adherencefrom all 4.23 configs (main + release branches)tls-pqc-readinessfrom release branch 5.0 configs only (main__5.0 is unchanged)tls-scanner-toolbase_image entries from configs where no TLS jobs remainWhy
4.22 and 4.23: The PQC ML-KEM verification was a one-time test activity (OCPSTRAT-2361). The RHWA tickets (RHWA-1024, RHWA-1025, RHWA-1045) are all closed (rhwa-4.22-0). Work complete, no ongoing coverage needed.
5.0 release branches:
tls-pqc-readinessremoved from release branch configs (release-0.8__5.0,release-0.7__5.0, etc.) but kept on allmain__5.0configs. PQC readiness checks Go's default ML-KEM key exchange, which is a Go runtime property baked into the binary at build time. Go's compatibility guarantee ensures ML-KEM behavior is preserved across patch and minor releases (controlled by thegodirective ingo.mod, with a 2-year GODEBUG stability window), so the release branch won't regress on this.TLS 1.3 adherence is a 5.0 GA release blocker (OCPSTRAT-2611), so
tls13-adherenceremains onmain__5.0only.What stays
tls-pqc-readiness+tls13-adherenceon all 6 operatormain__5.0configstls-pqc-readiness-all+tls13-adherence-allon system-testsmain__5.0periodictestandopenshift-e2ejobs on 4.22/4.23/5.0 (backward compatibility unaffected)Test plan
pull-ci-openshift-release-main-configpasses (config validation)