monitoring: CMO: add TLS scanner step to e2e-agnostic-operator presubmit by machine424 · Pull Request #82553 · openshift/release

machine424 · 2026-07-28T14:17:22Z

CMO: add TLS scanner step to e2e-agnostic-operator presubmit

Add the tls-scanner-run step (strict Intermediate profile) to the
e2e-agnostic-operator test so it executes on every PR. While the
scanner already runs as a periodic, having it in a presubmit catches
TLS regressions before merge instead of after.

The step scans both the Platform (openshift-monitoring) and UWM
(openshift-user-workload-monitoring) stacks and adds ~10 minutes to
the job.

The scanner only needs to run in CMO CI, not in operand-specific ones
(Prometheus, Alertmanager), since all TLS configuration is applied on
the CMO side.

ipi-install-monitoring-uwm

Add ipi-install-monitoring-uwm to the ipi-conf-aws chain. The step
generates install-time manifests to enable the full UWM stack (UWM +
UWM Alertmanager). It defaults to off and is a no-op unless
ENABLE_USER_WORKLOAD_MONITORING is set to "true".

TLS Scanner benchmarks

Commit	Duration	Throughput	-j	cpu req / limit	memory	Ports Scanned / Skipped	IPs	Status
`2b34dbed`	10m46s	7.34/min	4	500m / 4	1Gi	79 / 42	28	SUCCESS
`b2797976`	14m35s	5.42/min	4	500m / 2	1Gi	79 / 42	28	SUCCESS
`0610bf0f`	16m52s	4.69/min	32	500m / 2	1Gi	79 / 42	28	scan finished, job aborted
`27830335`	23m2s	3.43/min	16	500m / 2	1Gi	79 / 42	28	scan finished, job aborted
`b3d9f753`	49m51s	1.59/min	50	500m / 500m	1Gi	79 / 42	28	SUCCESS
`3793c64b`	56m57s	1.39/min	4	500m / 500m	1Gi	79 / 42	28	SUCCESS

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

Walkthrough

Adds optional user-workload monitoring configuration, wires the TLS scanner into the cluster monitoring e2e job, and updates scanner concurrency and CPU limits.

Changes

Monitoring and TLS scanner integration

Layer / File(s)	Summary
User-workload monitoring configuration `ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-ref.yaml`, `ci-operator/step-registry/ipi/install/monitoringpvc/ipi-install-monitoringpvc-commands.sh`	Defines `ENABLE_USER_WORKLOAD_MONITORING` and conditionally adds `enableUserWorkload: true` to the monitoring configuration patch.
Cluster monitoring scanner wiring `ci-operator/config/openshift/cluster-monitoring-operator/openshift-cluster-monitoring-operator-main.yaml`	Adds the scanner base image, runtime environment variables, and `tls-scanner-run` test reference.
Scanner runtime settings `ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh`	Changes scanner concurrency from 4 to 32 and sets the CPU limit to `2` while retaining the configured CPU request.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

openshift/release#82555: Adds the shared TLS scanner image and wires the scanner into a related e2e configuration.

Suggested reviewers: danielmellado, simonpasquier

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No Ginkgo titles were added or changed in the touched files; they only define static CI step names and shell logic.
Test Structure And Quality	✅ Passed	No Ginkgo test code was changed; the PR only updates CI config and shell steps, so the test-structure check is not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the PR only changes ci-operator YAML and shell step-registry scripts.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo tests were added; the TLS scanner and monitoring config changes don’t assume multiple nodes or topology-specific behavior.
Topology-Aware Scheduling Compatibility	✅ Passed	No topology-sensitive scheduling constraints were added; the PR only changes env, scanner args, and resource limits.
Ote Binary Stdout Contract	✅ Passed	PR only changes CI step YAML/shell wrappers; no Go main/init/TestMain or stdout-contract code was touched, and no new stdout-violation patterns were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo tests were added; the new tls-scanner step uses only cluster-internal oc/API access and no IPv4-only or public-host assumptions were found.
No-Weak-Crypto	✅ Passed	No exact weak-crypto algorithms/modes or secret/token comparisons were added; the edits only add env flags and tls-scanner invocation.
Container-Privileges	✅ Passed	PASS: The only diff in the pod manifest is `-j 16`→`-j 32`; `privileged`, `hostNetwork`, `hostPID`, and root settings were already present and unchanged.
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The only code change is tls-scanner -j 16→32; added config/env fields don’t print secrets, and existing logs only echo non-sensitive paths/namespaces.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: adding the TLS scanner step to the monitoring e2e-agnostic-operator presubmit.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

machine424 · 2026-07-28T14:38:08Z

/pj-rehearse pull-ci-openshift-cluster-monitoring-operator-main-e2e-agnostic-operator

openshift-merge-bot · 2026-07-28T14:41:17Z

@machine424: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

machine424 · 2026-07-28T16:21:35Z

/pj-rehearse pull-ci-openshift-cluster-monitoring-operator-main-e2e-agnostic-operator

openshift-merge-bot · 2026-07-28T16:26:37Z

@machine424: your /pj-rehearse request was not processed because the request waited in queue for longer than 5 minutes. Please retry in a few minutes.

machine424 · 2026-07-28T17:06:24Z

/pj-rehearse pull-ci-openshift-cluster-monitoring-operator-main-e2e-agnostic-operator

openshift-merge-bot · 2026-07-28T17:06:27Z

@machine424: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

machine424 · 2026-07-28T23:32:19Z

/pj-rehearse pull-ci-openshift-cluster-monitoring-operator-main-e2e-agnostic-operator

openshift-merge-bot · 2026-07-28T23:32:22Z

@machine424: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

machine424 · 2026-07-29T07:52:42Z

/pj-rehearse pull-ci-openshift-cluster-monitoring-operator-main-e2e-agnostic-operator

openshift-merge-bot · 2026-07-29T07:52:45Z

@machine424: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh`:
- Line 196: Update the scanner resource configuration near the cpu request so
the CPU limit uses the configured scanner_cpu value instead of the hardcoded 2.
Ensure the resulting pod always satisfies the request<=limit invariant, while
preserving the existing SCANNER_CPU default behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: ed62125b-8ccd-49a8-b61d-45a9e2fca220

📥 Commits

Reviewing files that changed from the base of the PR and between b3d9f75 and 2783033.

📒 Files selected for processing (1)

ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh

coderabbitai · 2026-07-29T07:55:43Z

        memory: ${scanner_memory}
      limits:
-        cpu: "${scanner_cpu}"
+        cpu: "2"


🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash set -euo pipefail echo "== file outline ==" wc -l ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh sed -n '150,220p' ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh echo echo "== SCANNER_CPU references ==" rg -n "SCANNER_CPU|scanner_cpu|limits:|requests:" ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh ci-operator/step-registry/tls/scanner -g '*.sh' -g '*.yaml' -g '*.yml' echo echo "== surrounding step-registry files ==" fd -t f . ci-operator/step-registry/tls/scanner

Repository: openshift/release

Length of output: 5211

🏁 Script executed:

#!/bin/bash set -euo pipefail echo "== run ref yaml ==" sed -n '1,120p' ci-operator/step-registry/tls/scanner/run/tls-scanner-run-ref.yaml echo echo "== hypershift run ref yaml ==" sed -n '1,120p' ci-operator/step-registry/tls/scanner/hypershift-run/tls-scanner-hypershift-run-ref.yaml echo echo "== resource assignment logic ==" sed -n '60,85p' ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh echo echo "== limit context ==" sed -n '186,200p' ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh

Repository: openshift/release

Length of output: 6746

Align the scanner CPU limit with the configured request
SCANNER_CPU defaults to 4, so management runs create a pod with a 4 CPU request and a hardcoded 2 CPU limit. That violates the request<=limit invariant and can block the pod from starting. Keep the limit at ${scanner_cpu} or split request/limit into separate vars with an enforced ordering.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/step-registry/tls/scanner/run/tls-scanner-run-commands.sh` at line 196, Update the scanner resource configuration near the cpu request so the CPU limit uses the configured scanner_cpu value instead of the hardcoded 2. Ensure the resulting pod always satisfies the request<=limit invariant, while preserving the existing SCANNER_CPU default behavior.

machine424 · 2026-07-29T09:59:50Z

/pj-rehearse pull-ci-openshift-cluster-monitoring-operator-main-e2e-agnostic-operator

openshift-merge-bot · 2026-07-29T09:59:53Z

@machine424: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

machine424 · 2026-07-29T12:46:30Z

/pj-rehearse pull-ci-openshift-cluster-monitoring-operator-main-e2e-agnostic-operator

openshift-merge-bot · 2026-07-29T12:51:14Z

@machine424: pj-rehearse could not automatically process this event because the request waited in queue for longer than 5 minutes. Use /pj-rehearse to trigger rehearsals manually.

openshift-merge-bot · 2026-07-29T12:51:32Z

@machine424: your /pj-rehearse request was not processed because the request waited in queue for longer than 5 minutes. Please retry in a few minutes.

machine424 · 2026-07-29T13:57:36Z

/pj-rehearse pull-ci-openshift-cluster-monitoring-operator-main-e2e-agnostic-operator

openshift-merge-bot · 2026-07-29T13:57:39Z

@machine424: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-merge-bot · 2026-07-29T13:57:49Z

@machine424, pj-rehearse: unable prepare a candidate for rehearsal; rehearsals will not be run. This could be due to a branch that needs to be rebased. ERROR:

couldn't checkout base SHA 62b1cb48066ab45fe4d02d55c93e44622dd9164c: error checking out "62b1cb48066ab45fe4d02d55c93e44622dd9164c": exit status 128 fatal: unable to read tree (62b1cb48066ab45fe4d02d55c93e44622dd9164c)

machine424 · 2026-07-29T13:59:34Z

/pj-rehearse pull-ci-openshift-cluster-monitoring-operator-main-e2e-agnostic-operator

openshift-merge-bot · 2026-07-29T14:02:25Z

@machine424: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

Align the step-registry env vars with the upstream tls-scanner change (openshift/tls-scanner#87) that splits SCANNER_CPU / SCANNER_MEMORY into separate request and limit variables. New variables (both run and hypershift-run refs): SCANNER_CPU_REQUEST / SCANNER_CPU_LIMIT (default 4 / 4) SCANNER_MEM_REQUEST / SCANNER_MEM_LIMIT (default 4Gi / 4Gi) New guest-cluster variables (hypershift-run ref only): SCANNER_CPU_GUEST_REQUEST / SCANNER_CPU_GUEST_LIMIT (default 1 / 1) SCANNER_MEM_GUEST_REQUEST / SCANNER_MEM_GUEST_LIMIT (default 2Gi / 2Gi) The original SCANNER_CPU, SCANNER_MEMORY, SCANNER_CPU_GUEST, and SCANNER_MEMORY_GUEST are preserved as deprecated fallbacks so that existing CI configs continue to work without changes. This unblocks openshift#82553 (add tls-scanner to cluster-monitoring-operator e2e) which uses the new split vars to set a lower CPU request for scheduling while keeping a higher burst limit.

…82865) Align the step-registry env vars with the upstream tls-scanner change (openshift/tls-scanner#87) that splits SCANNER_CPU / SCANNER_MEMORY into separate request and limit variables. New variables (both run and hypershift-run refs): SCANNER_CPU_REQUEST / SCANNER_CPU_LIMIT (default 4 / 4) SCANNER_MEM_REQUEST / SCANNER_MEM_LIMIT (default 4Gi / 4Gi) New guest-cluster variables (hypershift-run ref only): SCANNER_CPU_GUEST_REQUEST / SCANNER_CPU_GUEST_LIMIT (default 1 / 1) SCANNER_MEM_GUEST_REQUEST / SCANNER_MEM_GUEST_LIMIT (default 2Gi / 2Gi) The original SCANNER_CPU, SCANNER_MEMORY, SCANNER_CPU_GUEST, and SCANNER_MEMORY_GUEST are preserved as deprecated fallbacks so that existing CI configs continue to work without changes. This unblocks #82553 (add tls-scanner to cluster-monitoring-operator e2e) which uses the new split vars to set a lower CPU request for scheduling while keeping a higher burst limit. Co-authored-by: Chai Bot <ship-help-github@redhat.com>

…penshift#82865) Align the step-registry env vars with the upstream tls-scanner change (openshift/tls-scanner#87) that splits SCANNER_CPU / SCANNER_MEMORY into separate request and limit variables. New variables (both run and hypershift-run refs): SCANNER_CPU_REQUEST / SCANNER_CPU_LIMIT (default 4 / 4) SCANNER_MEM_REQUEST / SCANNER_MEM_LIMIT (default 4Gi / 4Gi) New guest-cluster variables (hypershift-run ref only): SCANNER_CPU_GUEST_REQUEST / SCANNER_CPU_GUEST_LIMIT (default 1 / 1) SCANNER_MEM_GUEST_REQUEST / SCANNER_MEM_GUEST_LIMIT (default 2Gi / 2Gi) The original SCANNER_CPU, SCANNER_MEMORY, SCANNER_CPU_GUEST, and SCANNER_MEMORY_GUEST are preserved as deprecated fallbacks so that existing CI configs continue to work without changes. This unblocks openshift#82553 (add tls-scanner to cluster-monitoring-operator e2e) which uses the new split vars to set a lower CPU request for scheduling while keeping a higher burst limit. Co-authored-by: Chai Bot <ship-help-github@redhat.com>

machine424 · 2026-08-13T13:45:03Z

/retest

machine424 · 2026-08-13T13:45:06Z

/pj-rehearse pull-ci-openshift-cluster-monitoring-operator-main-e2e-agnostic-operator

openshift-merge-bot · 2026-08-13T13:46:40Z

@machine424: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

machine424 · 2026-08-13T14:05:43Z

/pj-rehearse pull-ci-openshift-cluster-monitoring-operator-main-e2e-agnostic-operator

openshift-merge-bot · 2026-08-13T14:09:20Z

@machine424: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

simonpasquier · 2026-08-13T14:08:36Z

for completeness we need also to enable UWM Alertmanager.

I try to do that in the UWM step

simonpasquier · 2026-08-13T14:10:12Z

it's a bit disturbing that a step to configure monitoring PVC can also enable user-workload monitoring. Should we have our own separate step?

Good catch, yes we can make things cleaner

Add the tls-scanner-run step (strict Intermediate profile) to the e2e-agnostic-operator test so it executes on every PR. While the scanner already runs as a periodic, having it in a presubmit catches TLS regressions before merge instead of after. The step scans both the Platform (openshift-monitoring) and UWM (openshift-user-workload-monitoring) stacks and adds ~10 minutes to the job. The scanner only needs to run in CMO CI, not in operand-specific ones (Prometheus, Alertmanager), since all TLS configuration is applied on the CMO side. Add ipi-install-monitoring-uwm to the ipi-conf-aws chain. The step generates install-time manifests to enable the full UWM stack (UWM + UWM Alertmanager). It defaults to off and is a no-op unless ENABLE_USER_WORKLOAD_MONITORING is set to true.

Update OWNERS for ipi-install-monitoringpvc and ipi-install-monitoring-uwm.

machine424 · 2026-08-13T15:37:49Z

/pj-rehearse pull-ci-openshift-cluster-monitoring-operator-main-e2e-agnostic-operator

openshift-merge-bot · 2026-08-13T15:37:52Z

@machine424: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-ci · 2026-08-13T15:38:53Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: machine424
Once this PR has been reviewed and has the lgtm label, please assign sosiouxme for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

~~ci-operator/config/openshift/cluster-monitoring-operator/OWNERS~~ [machine424]
ci-operator/step-registry/ipi/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

machine424 · 2026-08-13T15:38:57Z

@simonpasquier this would add the step to thousands of jobs
maybe we can just override our own chain for cmo agnostic, the steps don;t seem to change a lot

openshift-merge-bot · 2026-08-13T15:42:13Z

[REHEARSALNOTIFIER]
@machine424: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-cloud-provider-nutanix-main-okd-scos-e2e-aws-ovn	openshift/cloud-provider-nutanix	presubmit	Registry content changed
pull-ci-openshift-cloud-provider-nutanix-release-4.21-okd-scos-e2e-aws-ovn	openshift/cloud-provider-nutanix	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-main-regression-clusterinfra-aws-ipi-mapi	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-5.1-regression-clusterinfra-aws-ipi-mapi	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-5.0-regression-clusterinfra-aws-ipi-mapi	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-4.23-regression-clusterinfra-aws-ipi-mapi	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-4.22-regression-clusterinfra-aws-ipi-mapi	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-4.21-regression-clusterinfra-aws-ipi-mapi	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-4.20-regression-clusterinfra-aws-ipi-mapi	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-4.19-regression-clusterinfra-aws-ipi-mapi	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-4.18-regression-clusterinfra-aws-ipi-mapi	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-main-e2e-aws-operator	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-main-e2e-aws-operator-techpreview	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-5.1-e2e-aws-operator	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-5.1-e2e-aws-operator-techpreview	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-5.0-e2e-aws-operator	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-5.0-e2e-aws-operator-techpreview	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-4.23-e2e-aws-operator	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-4.23-e2e-aws-operator-techpreview	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-4.22-e2e-aws-operator	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-4.22-e2e-aws-operator-techpreview	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-4.21-e2e-aws-operator	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-4.21-e2e-aws-operator-techpreview	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-4.20-e2e-aws-operator	openshift/machine-api-operator	presubmit	Registry content changed
pull-ci-openshift-machine-api-operator-release-4.20-e2e-aws-operator-techpreview	openshift/machine-api-operator	presubmit	Registry content changed

A total of 15928 jobs have been affected by this change. The above listing is non-exhaustive and limited to 25 jobs.

A full list of affected jobs can be found here

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

openshift-ci · 2026-08-13T19:08:10Z

@machine424: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 28, 2026

openshift-ci Bot requested review from danielmellado and simonpasquier July 28, 2026 14:19

coderabbitai Bot mentioned this pull request Jul 28, 2026

oran-o2ims: add tls scanner #82154

Merged

machine424 force-pushed the mon-tls branch from 81ba040 to 3793c64 Compare July 28, 2026 16:20

machine424 force-pushed the mon-tls branch from 3793c64 to b3d9f75 Compare July 28, 2026 23:30

coderabbitai Bot reviewed Jul 29, 2026

View reviewed changes

machine424 force-pushed the mon-tls branch from 09e25dd to b279797 Compare July 29, 2026 13:59

coderabbitai Bot mentioned this pull request Jul 29, 2026

STOR-3001: add TLS scanner for vsphere problem detector #82619

Merged

machine424 mentioned this pull request Aug 4, 2026

step-registry/tls-scanner: split CPU/memory into request and limit #82865

Merged

machine424 force-pushed the mon-tls branch from 294544c to 486fb7e Compare August 13, 2026 14:03

machine424 changed the title ~~WIP: trying tls-scanner with strict Intermediate profile on monitoring stack~~ monitoring: CMO: add TLS scanner step to e2e-agnostic-operator presubmit Aug 13, 2026

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 13, 2026

simonpasquier reviewed Aug 13, 2026

View reviewed changes

machine424 changed the title ~~monitoring: CMO: add TLS scanner step to e2e-agnostic-operator presubmit~~ WIP: monitoring: CMO: add TLS scanner step to e2e-agnostic-operator presubmit Aug 13, 2026

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 13, 2026

machine424 added 2 commits August 13, 2026 17:29

monitoring: sync step-registry OWNERS

f35e4a4

Update OWNERS for ipi-install-monitoringpvc and ipi-install-monitoring-uwm.

machine424 force-pushed the mon-tls branch from 486fb7e to f35e4a4 Compare August 13, 2026 15:36

machine424 changed the title ~~WIP: monitoring: CMO: add TLS scanner step to e2e-agnostic-operator presubmit~~ monitoring: CMO: add TLS scanner step to e2e-agnostic-operator presubmit Aug 13, 2026

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 13, 2026

machine424 commented Aug 13, 2026

View reviewed changes

Uh oh!

Conversation

machine424 commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CMO: add TLS scanner step to e2e-agnostic-operator presubmit

ipi-install-monitoring-uwm

TLS Scanner benchmarks

Uh oh!

coderabbitai Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Uh oh!

machine424 commented Jul 28, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 28, 2026

Uh oh!

machine424 commented Jul 28, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 28, 2026

Uh oh!

machine424 commented Jul 28, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 28, 2026

Uh oh!

machine424 commented Jul 28, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 28, 2026

Uh oh!

machine424 commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

machine424 commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

machine424 commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

machine424 commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

machine424 commented Jul 29, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 29, 2026

Uh oh!

machine424 commented Aug 13, 2026

Uh oh!

machine424 commented Aug 13, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 13, 2026

Uh oh!

machine424 commented Aug 13, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 13, 2026

Uh oh!

simonpasquier Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

machine424 Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

simonpasquier Aug 13, 2026

Choose a reason for hiding this comment

Uh oh!

machine424 Aug 13, 2026

machine424 commented Jul 28, 2026 •

edited

Loading

coderabbitai Bot commented Jul 28, 2026 •

edited

Loading