SPIRE-632: Add optional TLS scanner CI job for zero-trust-workload-identity-manager - #83228
SPIRE-632: Add optional TLS scanner CI job for zero-trust-workload-identity-manager#83228sayak-redhat wants to merge 2 commits into
Conversation
…entity-manager Install the PR operator on AWS, deploy SPIRE operand CRs, enable Modern TLS adherence, and scan operator/operand endpoints in the install namespace.
openshift-ci-robot
added
the
jira/valid-reference
|
@sayak-redhat: This pull request references SPIRE-632 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughThe CI configuration adds a ChangesTLS scanner workflow
Estimated code review effort: 3 (Moderate) | ~30 minutes Sequence Diagram(s)sequenceDiagram
participant CIWorkflow
participant OpenShiftCluster
participant TLSScanner
CIWorkflow->>OpenShiftCluster: Install operator and wait for CRDs
CIWorkflow->>OpenShiftCluster: Apply ZeroTrust Workload Identity Manager and SPIRE resources
OpenShiftCluster-->>CIWorkflow: Report managed workloads ready
CIWorkflow->>TLSScanner: Run TLS 1.3 adherence scan
TLSScanner-->>CIWorkflow: Return scan results
Possibly related PRs
Suggested labels: Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 inconclusive)
✅ Passed checks (13 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: sayak-redhat The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/pj-rehearse pull-ci-openshift-zero-trust-workload-identity-manager-main-tls-scanner |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml`:
- Around line 109-111: Run make update after adding the tls-scanner presubmit
job, then commit the generated Prow job definition and any required sanitized
configuration output so Prow exposes /test tls-scanner.
- Around line 161-220: Add a NetworkPolicy resource to the manifest heredoc
alongside the ZeroTrustWorkloadIdentityManager, SpireServer, SpireAgent,
SpiffeCSIDriver, and SpireOIDCDiscoveryProvider resources, targeting the
zero-trust-workload-identity-manager namespace. Configure ingress and egress
rules to allow only the required operator, SPIRE, ingress, and scanner traffic,
and ensure the policy is explicitly defined for that operand namespace.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: dc41e2bc-4a5f-4574-9b76-14bfb41fb73f
⛔ Files ignored due to path filters (1)
ci-operator/jobs/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (1)
ci-operator/config/openshift/zero-trust-workload-identity-manager/openshift-zero-trust-workload-identity-manager-main.yaml
|
@sayak-redhat: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Remove APP_DOMAIN/JWT_ISSUER echoes and wide pod listings so CI logs do not expose internal DNS or pod/node network details. Co-authored-by: Cursor <cursoragent@cursor.com>
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse pull-ci-openshift-zero-trust-workload-identity-manager-main-tls-scanner |
|
@sayak-redhat: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@sayak-redhat: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Summary
tls-scannerpresubmit foropenshift/zero-trust-workload-identity-manageronmain.optional-operators-ci-operator-sdk-aws, installs the PR operator bundle, deploys SPIRE operand CRs (ZeroTrustWorkloadIdentityManager,SpireServer,SpireAgent,SpiffeCSIDriver,SpireOIDCDiscoveryProvider), enables TLS 1.3 strict adherence, and runstls-scanner-runagainst the install namespace.Test plan
/pj-rehearse listconfirmspull-ci-openshift-zero-trust-workload-identity-manager-main-tls-scanneris rehearsable/pj-rehearse pull-ci-openshift-zero-trust-workload-identity-manager-main-tls-scannersucceedsmain,/test tls-scannercan trigger the job after this mergesMade with Cursor
Summary by CodeRabbit
tls-scannerpresubmit job foropenshift/zero-trust-workload-identity-manageronmain.tls-scanner-run.tls-scanner-toolbase image to the CI configuration.