From 3ca59a3191a787f6a91bb7da5f98f3a77c5265d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ra=C3=BAl=20Hern=C3=A1ndez?= Date: Mon, 31 Aug 2026 17:23:20 +0200 Subject: [PATCH 1/3] oran-o2ims: fix timing issue in TLS scan after tls-13 rollout The tls-13 step applies the Modern TLS profile with StrictAllComponents, triggering a full cluster rollout (~20 min). In some cases, service-ca restarts and re-issues serving certificates before tls-scanner-run begins, causing operator pods to still be restarting. The scanner then finds ports open but no TLS active, reporting NO_TLS for affected endpoints (e.g. 125/133 instead of 133/133). Add a new wait-for-tls-pods-post-rollout step between tls-13 and tls-scanner-run to ensure pods are fully ready and serving TLS after the cluster rollout. The step reuses the existing wait-for-tls-pods commands script via symlink to avoid duplication. Applied to install-bundle-tls-scan and install-bundle-tls-scan-periodic in both main and release-4.22 configs. Co-authored-by: Cursor --- .../openshift-kni-oran-o2ims-main.yaml | 2 ++ ...openshift-kni-oran-o2ims-release-4.22.yaml | 2 ++ .../wait-for-tls-pods-post-rollout/OWNERS | 1 + ...wait-for-tls-pods-post-rollout-commands.sh | 1 + ...or-tls-pods-post-rollout-ref.metadata.json | 15 ++++++++++++++ ...ms-wait-for-tls-pods-post-rollout-ref.yaml | 20 +++++++++++++++++++ 6 files changed, 41 insertions(+) create mode 120000 ci-operator/step-registry/oran-o2ims/wait-for-tls-pods-post-rollout/OWNERS create mode 120000 ci-operator/step-registry/oran-o2ims/wait-for-tls-pods-post-rollout/oran-o2ims-wait-for-tls-pods-post-rollout-commands.sh create mode 100644 ci-operator/step-registry/oran-o2ims/wait-for-tls-pods-post-rollout/oran-o2ims-wait-for-tls-pods-post-rollout-ref.metadata.json create mode 100644 ci-operator/step-registry/oran-o2ims/wait-for-tls-pods-post-rollout/oran-o2ims-wait-for-tls-pods-post-rollout-ref.yaml diff --git a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml index cf6ce7938375a..0bc0c97f6b3a8 100644 --- a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml +++ b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml @@ -129,6 +129,7 @@ tests: - ref: optional-operators-operator-sdk - ref: oran-o2ims-wait-for-tls-pods - ref: tls-13 + - ref: oran-o2ims-wait-for-tls-pods-post-rollout - ref: tls-scanner-run workflow: ipi-aws - as: install-bundle-tls-scan-periodic @@ -149,6 +150,7 @@ tests: - ref: optional-operators-operator-sdk - ref: oran-o2ims-wait-for-tls-pods - ref: tls-13 + - ref: oran-o2ims-wait-for-tls-pods-post-rollout - ref: tls-scanner-run workflow: ipi-aws - always_run: false diff --git a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml index 8669f3afae7e7..8df1b506a46a4 100644 --- a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml +++ b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml @@ -129,6 +129,7 @@ tests: - ref: optional-operators-operator-sdk - ref: oran-o2ims-wait-for-tls-pods - ref: tls-13 + - ref: oran-o2ims-wait-for-tls-pods-post-rollout - ref: tls-scanner-run workflow: ipi-aws - as: install-bundle-tls-scan-periodic @@ -149,6 +150,7 @@ tests: - ref: optional-operators-operator-sdk - ref: oran-o2ims-wait-for-tls-pods - ref: tls-13 + - ref: oran-o2ims-wait-for-tls-pods-post-rollout - ref: tls-scanner-run workflow: ipi-aws - always_run: false diff --git a/ci-operator/step-registry/oran-o2ims/wait-for-tls-pods-post-rollout/OWNERS b/ci-operator/step-registry/oran-o2ims/wait-for-tls-pods-post-rollout/OWNERS new file mode 120000 index 0000000000000..ec405d65a79df --- /dev/null +++ b/ci-operator/step-registry/oran-o2ims/wait-for-tls-pods-post-rollout/OWNERS @@ -0,0 +1 @@ +../OWNERS \ No newline at end of file diff --git a/ci-operator/step-registry/oran-o2ims/wait-for-tls-pods-post-rollout/oran-o2ims-wait-for-tls-pods-post-rollout-commands.sh b/ci-operator/step-registry/oran-o2ims/wait-for-tls-pods-post-rollout/oran-o2ims-wait-for-tls-pods-post-rollout-commands.sh new file mode 120000 index 0000000000000..e3b9dbe09f38f --- /dev/null +++ b/ci-operator/step-registry/oran-o2ims/wait-for-tls-pods-post-rollout/oran-o2ims-wait-for-tls-pods-post-rollout-commands.sh @@ -0,0 +1 @@ +../wait-for-tls-pods/oran-o2ims-wait-for-tls-pods-commands.sh \ No newline at end of file diff --git a/ci-operator/step-registry/oran-o2ims/wait-for-tls-pods-post-rollout/oran-o2ims-wait-for-tls-pods-post-rollout-ref.metadata.json b/ci-operator/step-registry/oran-o2ims/wait-for-tls-pods-post-rollout/oran-o2ims-wait-for-tls-pods-post-rollout-ref.metadata.json new file mode 100644 index 0000000000000..a4e2e2f995cd5 --- /dev/null +++ b/ci-operator/step-registry/oran-o2ims/wait-for-tls-pods-post-rollout/oran-o2ims-wait-for-tls-pods-post-rollout-ref.metadata.json @@ -0,0 +1,15 @@ +{ + "path": "oran-o2ims/wait-for-tls-pods-post-rollout/oran-o2ims-wait-for-tls-pods-post-rollout-ref.yaml", + "owners": { + "approvers": [ + "alegacy", + "donpenney", + "rauhersu" + ], + "reviewers": [ + "alegacy", + "donpenney", + "rauhersu" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/oran-o2ims/wait-for-tls-pods-post-rollout/oran-o2ims-wait-for-tls-pods-post-rollout-ref.yaml b/ci-operator/step-registry/oran-o2ims/wait-for-tls-pods-post-rollout/oran-o2ims-wait-for-tls-pods-post-rollout-ref.yaml new file mode 100644 index 0000000000000..a98cf30b10839 --- /dev/null +++ b/ci-operator/step-registry/oran-o2ims/wait-for-tls-pods-post-rollout/oran-o2ims-wait-for-tls-pods-post-rollout-ref.yaml @@ -0,0 +1,20 @@ +ref: + as: oran-o2ims-wait-for-tls-pods-post-rollout + from: cli + cli: latest + commands: oran-o2ims-wait-for-tls-pods-post-rollout-commands.sh + env: + - name: WAIT_NAMESPACE + default: oran-o2ims + documentation: "Namespace where the oran-o2ims operator is deployed." + resources: + requests: + cpu: 100m + memory: 200Mi + documentation: |- + Runs the same checks as oran-o2ims-wait-for-tls-pods but is + intended to be placed after the tls-13 step. The Modern TLS + profile rollout restarts service-ca, which re-issues serving + certificates and causes operator pods to be recreated. This + step waits for the pods to come back up and serve TLS before + the tls-scanner-run step executes. From e8c36d0125e826ee3627fd6ec8dd1dc6ed4b3895 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ra=C3=BAl=20Hern=C3=A1ndez?= Date: Mon, 31 Aug 2026 21:49:20 +0200 Subject: [PATCH 2/3] oran-o2ims: install ACM before TLS scan to fix operator pod crashes The oran-o2ims alarms-server and controller-manager pods crash-loop on vanilla OCP clusters without ACM: alarms-server fatally exits when it cannot resolve alertmanager.open-cluster-management-observability.svc, and controller-manager exits after a 2-minute cache sync timeout for missing ACM CRDs (ManagedCluster, ClusterInstance, Policy, ImageBasedGroupUpgrade). Adding the acm-install chain before the operator install ensures these dependencies are present so all endpoints can be scanned. Co-authored-by: Cursor --- .../openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml | 2 ++ .../oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml index 0bc0c97f6b3a8..6c78c037c34e3 100644 --- a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml +++ b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml @@ -126,6 +126,7 @@ tests: TLS_13_ENABLE_TLS_ADHERENCE: "true" TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: + - chain: acm-install - ref: optional-operators-operator-sdk - ref: oran-o2ims-wait-for-tls-pods - ref: tls-13 @@ -147,6 +148,7 @@ tests: TLS_13_ENABLE_TLS_ADHERENCE: "true" TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: + - chain: acm-install - ref: optional-operators-operator-sdk - ref: oran-o2ims-wait-for-tls-pods - ref: tls-13 diff --git a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml index 8df1b506a46a4..432e1eeda5afa 100644 --- a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml +++ b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml @@ -126,6 +126,7 @@ tests: TLS_13_ENABLE_TLS_ADHERENCE: "true" TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: + - chain: acm-install - ref: optional-operators-operator-sdk - ref: oran-o2ims-wait-for-tls-pods - ref: tls-13 @@ -147,6 +148,7 @@ tests: TLS_13_ENABLE_TLS_ADHERENCE: "true" TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: + - chain: acm-install - ref: optional-operators-operator-sdk - ref: oran-o2ims-wait-for-tls-pods - ref: tls-13 From cb83c5fa08b419f9a94e4cc9e6addcf97ff9eafc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ra=C3=BAl=20Hern=C3=A1ndez?= Date: Mon, 31 Aug 2026 22:15:02 +0200 Subject: [PATCH 3/3] oran-o2ims: add ACM Observability for alarms-server Alertmanager dependency The alarms-server pod fatally exits when it cannot reach alertmanager.open-cluster-management-observability.svc:9095, which is only available after ACM Observability (MultiClusterObservability CR) is deployed. Add rhobs-acm-setup-observability after acm-install to deploy MinIO + MCO + Alertmanager so the alarms-server can start successfully and expose its TLS endpoints for scanning. Co-authored-by: Cursor --- .../openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml | 2 ++ .../oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml index 6c78c037c34e3..7108db6230183 100644 --- a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml +++ b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-main.yaml @@ -127,6 +127,7 @@ tests: TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: - chain: acm-install + - ref: rhobs-acm-setup-observability - ref: optional-operators-operator-sdk - ref: oran-o2ims-wait-for-tls-pods - ref: tls-13 @@ -149,6 +150,7 @@ tests: TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: - chain: acm-install + - ref: rhobs-acm-setup-observability - ref: optional-operators-operator-sdk - ref: oran-o2ims-wait-for-tls-pods - ref: tls-13 diff --git a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml index 432e1eeda5afa..86ab74a92045a 100644 --- a/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml +++ b/ci-operator/config/openshift-kni/oran-o2ims/openshift-kni-oran-o2ims-release-4.22.yaml @@ -127,6 +127,7 @@ tests: TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: - chain: acm-install + - ref: rhobs-acm-setup-observability - ref: optional-operators-operator-sdk - ref: oran-o2ims-wait-for-tls-pods - ref: tls-13 @@ -149,6 +150,7 @@ tests: TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: - chain: acm-install + - ref: rhobs-acm-setup-observability - ref: optional-operators-operator-sdk - ref: oran-o2ims-wait-for-tls-pods - ref: tls-13