opendatahub-operator: drop cleanup-olm-catalog workaround step

[ugiordan]

The cleanup-olm-catalog step deletes CatalogSource pods before tls-scanner-run to avoid apparent false positives from the OLM catalog pod serving plain gRPC on port 50051.

Investigation shows this step was never needed:

• In the pre-PR#90 scanner, NO_TLS ports produced a passing (empty) JUnit testcase with no failure element. The scanner's HasComplianceFailures function only returns non-zero for ports where TLS was detected but didn't meet the cluster profile — a non-TLS port never triggers that path.
• In the current scanner (post PR Always send users to gubernator for origin #90, merged 2026-08-12), NO_TLS ports emit an explicit <skipped> JUnit element. Still not a failure.

The actual failures that caused the scanner to be reverted in July (#82675) were rhods-operator:8080 plain HTTP endpoints. Those are now fixed — the operator metrics endpoint moved to :8443 with TLS. The catalog pod was noise in the scan log, not the root cause.

Dropping the destructive workaround and relying on the scanner's existing NO_TLS handling.

/cc @richardsonnick @rhmdnd

Summary by CodeRabbit

The opendatahub-operator RHOAI end-to-end job now runs the TLS scanner without deleting CatalogSource pods first. This removes the cleanup-olm-catalog workaround because NO_TLS results do not produce scanner failures, and the affected rhods-operator endpoint now uses TLS on port 8443.

The CI configuration also adds the TLS scanner image, scan environment variables, Quay pull-secret setup, automatic E2E resource resolution, and updated file-change and image-mirror skip patterns.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: a848f00c-611e-45bb-a207-31680fde4df7

📥 Commits

Reviewing files that changed from the base of the PR and between 365217a and 9557cfc.

📒 Files selected for processing (1)

• ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml

💤 Files with no reviewable changes (1)

• ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml

---

Walkthrough

The operator CI configuration adds a TLS scanner image and post-step. It updates standard and RHOAI E2E jobs with automatic resource resolution and broader skip patterns. RHOAI jobs also receive scan variables and Quay pull-secret preparation.

Changes

Operator CI configuration

Layer / File(s)	Summary
TLS scanner and standard E2E configuration ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml	Adds the tls-scanner-tool base image. Expands standard E2E exclusions and enables E2E_AUTO_RESOLVE=true.
RHOAI E2E scanning workflow ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml	Adds PQC_CHECK, SCAN_NAMESPACE, Quay pull-secret preparation, automatic E2E resolution, and the tls-scanner-run post-step. Removes the cleanup-olm-catalog step.
Image-mirror exclusions ci-operator/config/opendatahub-io/opendatahub-operator/opendatahub-io-opendatahub-operator-main.yaml	Expands standard and RHOAI image-mirror skip patterns for dot-prefixed YAML and specified configuration files.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 9557c

This change removes an unnecessary catalog cleanup step and relies on the scanner’s existing handling for non-TLS endpoints. No actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: richardsonnick, rhmdnd

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: removing the cleanup-OLM-catalog workaround step from the opendatahub-operator RHOAI E2E job.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The commit only removes an 11-line CI YAML cleanup step; it adds no Ginkgo declarations or test titles, dynamic or otherwise.
Test Structure And Quality	✅ Passed	The diff changes only one YAML CI config and removes a cleanup step; no Ginkgo It/BeforeEach/AfterEach or Eventually code changed, and remaining CI commands have bounded timeouts.
Microshift Test Compatibility	✅ Passed	The diff only removes a CI cleanup step from one YAML file. It adds no Ginkgo e2e tests or new MicroShift-incompatible API usage.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only one CI YAML file and removes 11 workflow lines; it adds no Ginkgo e2e tests or other test declarations subject to SNO compatibility review.
Topology-Aware Scheduling Compatibility	✅ Passed	The only change deletes a CI cleanup step from a YAML job; it adds no deployment, operator, controller, replica, affinity, topology, node, taint, or PDB scheduling constraint.
Ote Binary Stdout Contract	✅ Passed	The PR changes only one YAML file and removes a shell cleanup step; it adds no OTE binary code or process-level stdout writes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The diff changes only one YAML job and removes cleanup-olm-catalog; it adds no Ginkgo tests, IPv4 assumptions, or external connectivity.
No-Weak-Crypto	✅ Passed	The PR diff only removes the cleanup-olm-catalog YAML step. It adds no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The PR only removes the cleanup-olm-catalog step. The added-line diff contains no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The diff only removes the cleanup-olm-catalog step; it adds no logging or sensitive values. Existing scanner and pull-secret logging is unchanged.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

@ugiordan, pj-rehearse: unable to determine affected jobs. This could be due to a branch that needs to be rebased. ERROR:

couldn't prepare candidate: couldn't rebase candidate onto 365217a5829dc437a4bfc42f73516533ee8ee5a5 due to conflicts

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@ugiordan: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-opendatahub-io-opendatahub-operator-main-opendatahub-operator-rhoai-e2e	opendatahub-io/opendatahub-operator	presubmit	Ci-operator config changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[carlkyrillos]

/pj-rehearse

[openshift-merge-bot]

@carlkyrillos: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[richardsonnick]

Makes sense. Thanks for the cleanup! NO_TLS status should always result in a SKIP rather than failing the test.

[richardsonnick]

/lgtm

[richardsonnick]

Feel free to rehearsal-ack if the compliance failures are accurate (no false failures).

[ugiordan]

/pj-rehearse pull-ci-opendatahub-io-opendatahub-operator-main-opendatahub-operator-rhoai-e2e

[openshift-merge-bot]

@ugiordan: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

@ugiordan: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[richardsonnick]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: carlkyrillos, richardsonnick, ugiordan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/opendatahub-io/opendatahub-operator/OWNERS [carlkyrillos,ugiordan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment