ESO-538:Add TLS scanner and PQC readiness jobs for External Secrets Operator - #82876
ESO-538:Add TLS scanner and PQC readiness jobs for External Secrets Operator#82876siddhibhor-56 wants to merge 1 commit into
Conversation
|
/pj-rehearse |
|
@siddhibhor-56: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThe configuration adds base images and an optional AWS workflow. The workflow deploys the External Secrets operator, validates resource reconciliation, creates TLS materials, enables the Bitwarden plugin, and runs TLS 1.3 checks. ChangesExternal Secrets TLS validation
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant AWSWorkflow
participant OperatorSDK
participant ExternalSecretsOperator
participant SecretStore
participant ExternalSecret
participant BitwardenPlugin
participant TLSScannerTool
AWSWorkflow->>OperatorSDK: Install operator and deploy operands
OperatorSDK->>ExternalSecretsOperator: Start operator components
AWSWorkflow->>SecretStore: Create test SecretStore
AWSWorkflow->>ExternalSecret: Create test ExternalSecret
ExternalSecret->>ExternalSecretsOperator: Reconcile test resource
ExternalSecretsOperator-->>AWSWorkflow: Report successful reconciliation
AWSWorkflow->>ExternalSecretsOperator: Create TLS secret and enable Bitwarden plugin
ExternalSecretsOperator->>BitwardenPlugin: Roll out Bitwarden SDK server
AWSWorkflow->>TLSScannerTool: Scan TLS-relevant services with TLS 1.3
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/openshift/external-secrets-operator/openshift-external-secrets-operator-main.yaml`:
- Around line 314-325: Update the webhook verification block around WEBHOOK_SVC
and WEBHOOK_NS to fail with a nonzero status when the
ValidatingWebhookConfiguration, service, or endpoints cannot be discovered or
verified, instead of suppressing errors with true. Also update the
reconciliation readiness check around the Ready condition to fail when Ready
never becomes True, ensuring tls-scanner-run cannot succeed without exercising
both webhook and controller TLS paths.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: e068a18f-62ee-4e95-ab29-70cb421ae1e9
⛔ Files ignored due to path filters (1)
ci-operator/jobs/openshift/external-secrets-operator/openshift-external-secrets-operator-main-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (1)
ci-operator/config/openshift/external-secrets-operator/openshift-external-secrets-operator-main.yaml
2f6ca1f to
8874ee8
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/openshift/external-secrets-operator/openshift-external-secrets-operator-main.yaml`:
- Around line 258-260: The tls-scanner job has been added to the configuration
in the openshift-external-secrets-operator-main.yaml file (with as:
tls-scanner), but the corresponding generated Prow job artifacts and metadata
have not been created. Run make update in the repository root to generate the
Prow job configurations for the tls-scanner job, then commit all generated files
and configuration changes together. Without these generated artifacts, Prow
cannot properly register the optional job after merge.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: fbb3f5c2-2dfc-4e7e-b204-a2f43f400365
⛔ Files ignored due to path filters (1)
ci-operator/jobs/openshift/external-secrets-operator/openshift-external-secrets-operator-main-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (1)
ci-operator/config/openshift/external-secrets-operator/openshift-external-secrets-operator-main.yaml
|
/pj-rehearse |
|
@siddhibhor-56: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
8874ee8 to
bfc1292
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
|
/pj-rehearse |
|
@siddhibhor-56: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/openshift/external-secrets-operator/openshift-external-secrets-operator-main.yaml`:
- Around line 415-425: Update the oc patch payload in the Bitwarden plugin
configuration so TLS_SECRET_NAME is expanded by the shell before the request is
sent, while preserving valid JSON quoting and the existing secretRef structure.
Ensure ExternalSecretsConfig receives the actual secret name, such as
bitwarden-tls-cert, rather than the literal placeholder.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 6276b220-9133-4e5e-ae65-59c64c117da9
📒 Files selected for processing (1)
ci-operator/config/openshift/external-secrets-operator/openshift-external-secrets-operator-main.yaml
|
/pj-rehearse |
|
@siddhibhor-56: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/retest |
|
/pj-rehearse pull-ci-openshift-external-secrets-operator-main-e2e-operator-coverage |
|
@siddhibhor-56: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@siddhibhor-56: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command. |
1 similar comment
|
@siddhibhor-56: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command. |
ce7436c to
561d99f
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
|
/pj-rehearse |
|
@siddhibhor-56: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-external-secrets-operator-main-tls-scanner |
|
@siddhibhor-56: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
561d99f to
bde7063
Compare
|
/pj-rehearse |
|
@siddhibhor-56: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
6473588 to
ce269ca
Compare
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: siddhibhor-56 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/pj-rehearse |
|
@siddhibhor-56: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
ce269ca to
059c27c
Compare
|
/pj-rehearse |
|
@siddhibhor-56: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
059c27c to
50eb937
Compare
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
siddhibhor-56
changed the title
|
/pj-rehearse |
|
@siddhibhor-56: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/retest |
siddhibhor-56
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@siddhibhor-56: This pull request references ESO-538 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/pj-rehearse max |
|
@siddhibhor-56: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@siddhibhor-56: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
openshift/external-secrets-operator, mirroring thetls13-adherence/tls-pqc-readiness(+ periodic) pattern used byocp-release-operator-sdk,ansible-operator-plugins, and other operators.StrictAllComponents, and runtls-scanner-runagainst theexternal-secrets-operatornamespace.Pattern follows #83172.
Test plan
make updateregeneratedci-operator/jobs/**presubmits/periodics with no unexpected diffs.make jobs(ci-operator-checkconfig+ci-operator-prowgen+sanitize-prow-jobs) completed with no errors./test tls-scannerand/test tls-pqc-readinesson a PR against the repo to confirm the operator deploys and the scan runs end-to-end.