OLS-3353 - adding make tls scan job to OLS - #83165
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThe Lightspeed service CI configuration adds a TLS scanning image and a ChangesTLS scan verification
Estimated code review effort: 2 (Simple) | ~10 minutes Mergeability Score: ⚪ Minimal · up to This PR makes a localized CI configuration change to add the TLS scan job, with no actionable merge-blocking risk currently identified. Suggested labels: Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (13 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/pj-rehearse pull-ci-openshift-lightspeed-service-main-tls-scan |
|
@JoaoFula: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-lightspeed-service-main-tls-scan |
|
@JoaoFula: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
The tls-scan CI step was failing because podman cannot create containers inside unprivileged Prow test pods (exit code 125). Build a tls-scan-src image via ci-operator that layers the scanner binary from the QE image onto src, so the script finds it pre-installed and skips the podman extraction path. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml`:
- Around line 9-15: Update extract_scanner() in scripts/tls-scan.sh to first use
the pre-installed /usr/local/bin/tls-scanner and /opt/testssl files when
present, then return without invoking Podman. Preserve the existing podman
create/cp extraction as a fallback when those files are unavailable.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 192959d4-ef2e-4bad-a29f-4e410dbbd2c5
📒 Files selected for processing (1)
ci-operator/config/openshift/lightspeed-service/openshift-lightspeed-service-main.yaml
The previous commit incorrectly removed USER 0 and podman from build_root, which is shared by all test steps (verify, unit, integration). Restore them — only the tls-scan step needs the new tls-scan-src image. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
/pj-rehearse ci/rehearse/openshift/lightspeed-service/main/tls-scan |
|
@JoaoFula: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@JoaoFula: job(s): ci/rehearse/openshift/lightspeed-service/main/tls-scan either don't exist or were not found to be affected, and cannot be rehearsed |
|
/pj-rehearse auto-ack |
|
@JoaoFula: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-lightspeed-service-main-tls-scan |
|
@JoaoFula: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
removing byok changes
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
@JoaoFula: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/pj-rehearse pull-ci-openshift-lightspeed-service-main-tls-scan |
|
@JoaoFula: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-lightspeed-service-main-e2e-ols-cluster |
|
@JoaoFula: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: JoaoFula, onmete The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/pj-rehearse skip |
|
@JoaoFula: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
00d6707
into
openshift:main
2 participants
Summary by CodeRabbit
tls-scanverification job to the OpenShift Lightspeed service CI configuration.tls-scan-srcimage withtls-scannerand/opt/testssl.make tls-scanin the scanner image.