From 795811575697ff924dc9287432d70ade3a022523 Mon Sep 17 00:00:00 2001 From: Arun Maurya Date: Wed, 19 Aug 2026 15:14:51 +0530 Subject: [PATCH 1/3] Add PQC readiness TLS scanner jobs for cert-manager-operator Add optional tls-pqc-readiness and weekly tls-pqc-readiness-periodic jobs with PQC_CHECK enabled. Reuses the TrustManager deploy path from the existing tls-scanner job already on main. --- ...penshift-cert-manager-operator-master.yaml | 201 ++++++++++++++++++ ...ert-manager-operator-master-periodics.yaml | 94 ++++++++ ...rt-manager-operator-master-presubmits.yaml | 90 ++++++++ 3 files changed, 385 insertions(+) diff --git a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml index 7d08223e07513..8f8c8eeb3d474 100644 --- a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml +++ b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml @@ -576,6 +576,207 @@ tests: memory: 250Mi - ref: tls-scanner-run workflow: optional-operators-ci-operator-sdk-aws +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: cert-manager-operator-bundle + env: + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: cert-manager-operator + OO_SECURITY_CONTEXT: restricted + PQC_CHECK: "true" + SCAN_NAMESPACE: cert-manager-operator,cert-manager + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + test: + - as: deploy-operand + cli: latest + commands: |- + set -o errexit + set -o nounset + set -o pipefail + + echo "Waiting for default cert-manager operand deployments..." + oc wait --for=create namespace/cert-manager --timeout=5m + oc wait --for=create -n cert-manager deployment/cert-manager --timeout=5m + oc wait --for=create -n cert-manager deployment/cert-manager-webhook --timeout=5m + oc wait --for=create -n cert-manager deployment/cert-manager-cainjector --timeout=5m + oc wait --for=condition=Available -n cert-manager deployment/cert-manager --timeout=5m + oc wait --for=condition=Available -n cert-manager deployment/cert-manager-webhook --timeout=5m + oc wait --for=condition=Available -n cert-manager deployment/cert-manager-cainjector --timeout=5m + + echo "Enabling TrustManager feature gate via subscription..." + # operator-sdk run bundle creates a versioned Subscription name + # (e.g. cert-manager-operator-v1-20-0-sub), not a fixed cert-manager-operator. + # Match e2e getCertManagerOperatorSubscription: list and patch the one present. + SUB=$(oc -n cert-manager-operator get subscriptions.operators.coreos.com -o jsonpath='{.items[0].metadata.name}') + if [[ -z "${SUB}" ]]; then + echo "No Subscription found in cert-manager-operator namespace" + oc -n cert-manager-operator get subscriptions.operators.coreos.com -o yaml || true + exit 1 + fi + echo "Patching Subscription ${SUB} (preserve existing env, match e2e patchSubscriptionWithEnvVars)" + PATCH=$(oc -n cert-manager-operator get "subscription/${SUB}" -o json | python3 -c 'import json,sys; sub=json.load(sys.stdin); cfg=(sub.get("spec") or {}).get("config") or {}; env=[e for e in (cfg.get("env") or []) if e.get("name")!="UNSUPPORTED_ADDON_FEATURES"]; env.append({"name":"UNSUPPORTED_ADDON_FEATURES","value":"TrustManager=true"}); print(json.dumps({"spec":{"config":{"env":env}}}))') + oc -n cert-manager-operator patch "subscription/${SUB}" --type=merge -p "${PATCH}" + + echo "Waiting for TrustManager feature gate on operator deployment env and rollout..." + FOUND=false + for _ in $(seq 1 60); do + ENV_VAL=$(oc -n cert-manager-operator get deploy/cert-manager-operator-controller-manager \ + -o jsonpath='{range .spec.template.spec.containers[0].env[?(@.name=="UNSUPPORTED_ADDON_FEATURES")]}{.value}{end}' 2>/dev/null || true) + if [[ "${ENV_VAL}" == "TrustManager=true" ]]; then + echo "Found UNSUPPORTED_ADDON_FEATURES=${ENV_VAL} on operator deployment" + FOUND=true + break + fi + sleep 5 + done + if [[ "${FOUND}" != "true" ]]; then + echo "Timed out waiting for UNSUPPORTED_ADDON_FEATURES=TrustManager=true on operator deployment" + oc -n cert-manager-operator get deploy/cert-manager-operator-controller-manager -o yaml || true + exit 1 + fi + oc -n cert-manager-operator rollout status deployment/cert-manager-operator-controller-manager --timeout=5m + + echo "Creating TrustManager CR (minimal, match e2e newTrustManagerCR)..." + oc apply -f - </dev/null || true) + if [[ "${READY}" == "True" ]]; then + echo "TrustManager CR is Ready" + FOUND=true + break + fi + sleep 5 + done + if [[ "${FOUND}" != "true" ]]; then + echo "Timed out waiting for TrustManager Ready=True" + oc get trustmanagers.operator.openshift.io cluster -o yaml || true + exit 1 + fi + oc wait --for=create -n cert-manager deployment/trust-manager --timeout=5m + oc wait --for=condition=Available -n cert-manager deployment/trust-manager --timeout=5m + from: src + resources: + requests: + cpu: 100m + - ref: tls-13 + - ref: tls-scanner-run + workflow: optional-operators-ci-operator-sdk-aws +- as: tls-pqc-readiness-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: cert-manager-operator-bundle + env: + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: cert-manager-operator + OO_SECURITY_CONTEXT: restricted + PQC_CHECK: "true" + SCAN_NAMESPACE: cert-manager-operator,cert-manager + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + test: + - as: deploy-operand + cli: latest + commands: |- + set -o errexit + set -o nounset + set -o pipefail + + echo "Waiting for default cert-manager operand deployments..." + oc wait --for=create namespace/cert-manager --timeout=5m + oc wait --for=create -n cert-manager deployment/cert-manager --timeout=5m + oc wait --for=create -n cert-manager deployment/cert-manager-webhook --timeout=5m + oc wait --for=create -n cert-manager deployment/cert-manager-cainjector --timeout=5m + oc wait --for=condition=Available -n cert-manager deployment/cert-manager --timeout=5m + oc wait --for=condition=Available -n cert-manager deployment/cert-manager-webhook --timeout=5m + oc wait --for=condition=Available -n cert-manager deployment/cert-manager-cainjector --timeout=5m + + echo "Enabling TrustManager feature gate via subscription..." + # operator-sdk run bundle creates a versioned Subscription name + # (e.g. cert-manager-operator-v1-20-0-sub), not a fixed cert-manager-operator. + # Match e2e getCertManagerOperatorSubscription: list and patch the one present. + SUB=$(oc -n cert-manager-operator get subscriptions.operators.coreos.com -o jsonpath='{.items[0].metadata.name}') + if [[ -z "${SUB}" ]]; then + echo "No Subscription found in cert-manager-operator namespace" + oc -n cert-manager-operator get subscriptions.operators.coreos.com -o yaml || true + exit 1 + fi + echo "Patching Subscription ${SUB} (preserve existing env, match e2e patchSubscriptionWithEnvVars)" + PATCH=$(oc -n cert-manager-operator get "subscription/${SUB}" -o json | python3 -c 'import json,sys; sub=json.load(sys.stdin); cfg=(sub.get("spec") or {}).get("config") or {}; env=[e for e in (cfg.get("env") or []) if e.get("name")!="UNSUPPORTED_ADDON_FEATURES"]; env.append({"name":"UNSUPPORTED_ADDON_FEATURES","value":"TrustManager=true"}); print(json.dumps({"spec":{"config":{"env":env}}}))') + oc -n cert-manager-operator patch "subscription/${SUB}" --type=merge -p "${PATCH}" + + echo "Waiting for TrustManager feature gate on operator deployment env and rollout..." + FOUND=false + for _ in $(seq 1 60); do + ENV_VAL=$(oc -n cert-manager-operator get deploy/cert-manager-operator-controller-manager \ + -o jsonpath='{range .spec.template.spec.containers[0].env[?(@.name=="UNSUPPORTED_ADDON_FEATURES")]}{.value}{end}' 2>/dev/null || true) + if [[ "${ENV_VAL}" == "TrustManager=true" ]]; then + echo "Found UNSUPPORTED_ADDON_FEATURES=${ENV_VAL} on operator deployment" + FOUND=true + break + fi + sleep 5 + done + if [[ "${FOUND}" != "true" ]]; then + echo "Timed out waiting for UNSUPPORTED_ADDON_FEATURES=TrustManager=true on operator deployment" + oc -n cert-manager-operator get deploy/cert-manager-operator-controller-manager -o yaml || true + exit 1 + fi + oc -n cert-manager-operator rollout status deployment/cert-manager-operator-controller-manager --timeout=5m + + echo "Creating TrustManager CR (minimal, match e2e newTrustManagerCR)..." + oc apply -f - </dev/null || true) + if [[ "${READY}" == "True" ]]; then + echo "TrustManager CR is Ready" + FOUND=true + break + fi + sleep 5 + done + if [[ "${FOUND}" != "true" ]]; then + echo "Timed out waiting for TrustManager Ready=True" + oc get trustmanagers.operator.openshift.io cluster -o yaml || true + exit 1 + fi + oc wait --for=create -n cert-manager deployment/trust-manager --timeout=5m + oc wait --for=condition=Available -n cert-manager deployment/trust-manager --timeout=5m + from: src + resources: + requests: + cpu: 100m + - ref: tls-13 + - ref: tls-scanner-run + workflow: optional-operators-ci-operator-sdk-aws - as: periodic-jira-agent cron: 0 9 * * * steps: diff --git a/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-periodics.yaml b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-periodics.yaml index d633df3d7697a..e6feeb08d0fe7 100644 --- a/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-periodics.yaml +++ b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-periodics.yaml @@ -183,3 +183,97 @@ periodics: - name: result-aggregator secret: secretName: result-aggregator +- agent: kubernetes + cluster: build01 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - images/ci/Dockerfile + - images/ci/Dockerfile.coverage + - images/ci/certmanager.Dockerfile + - images/ci/istiocsr.Dockerfile + - images/ci/trustmanager.Dockerfile + extra_refs: + - base_ref: master + org: openshift + repo: cert-manager-operator + sparse_checkout_files: + - .ci-operator.yaml + - images/ci/Dockerfile + - images/ci/Dockerfile.coverage + - images/ci/certmanager.Dockerfile + - images/ci/istiocsr.Dockerfile + - images/ci/trustmanager.Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-cert-manager-operator-master-tls-pqc-readiness-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-periodic + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml index 7f8510e2d95ed..5a1688cfa38dc 100644 --- a/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml +++ b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml @@ -1561,6 +1561,96 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )images,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^master$ + - ^master- + cluster: build01 + context: ci/prow/tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - images/ci/Dockerfile + - images/ci/Dockerfile.coverage + - images/ci/certmanager.Dockerfile + - images/ci/istiocsr.Dockerfile + - images/ci/trustmanager.Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cert-manager-operator-master-tls-pqc-readiness + optional: true + rerun_command: /test tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: false branches: From 63d7bbcb56a5acbac42c089835aa67dc722b2682 Mon Sep 17 00:00:00 2001 From: Arun Maurya Date: Fri, 21 Aug 2026 15:17:02 +0530 Subject: [PATCH 2/3] Replace inline TrustManager deploy commands with make deploy-trust-manager Keep the TLS scanner and PQC jobs in this repo, but run operator-specific setup from the cert-manager-operator make target so it can be verified locally. --- ...penshift-cert-manager-operator-master.yaml | 231 +----------------- 1 file changed, 3 insertions(+), 228 deletions(-) diff --git a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml index 8f8c8eeb3d474..a941374513d91 100644 --- a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml +++ b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml @@ -485,82 +485,7 @@ tests: test: - as: deploy-operand cli: latest - commands: |- - set -o errexit - set -o nounset - set -o pipefail - - echo "Waiting for default cert-manager operand deployments..." - oc wait --for=create namespace/cert-manager --timeout=5m - oc wait --for=create -n cert-manager deployment/cert-manager --timeout=5m - oc wait --for=create -n cert-manager deployment/cert-manager-webhook --timeout=5m - oc wait --for=create -n cert-manager deployment/cert-manager-cainjector --timeout=5m - oc wait --for=condition=Available -n cert-manager deployment/cert-manager --timeout=5m - oc wait --for=condition=Available -n cert-manager deployment/cert-manager-webhook --timeout=5m - oc wait --for=condition=Available -n cert-manager deployment/cert-manager-cainjector --timeout=5m - - echo "Enabling TrustManager feature gate via subscription..." - # operator-sdk run bundle creates a versioned Subscription name - # (e.g. cert-manager-operator-v1-20-0-sub), not a fixed cert-manager-operator. - # Match e2e getCertManagerOperatorSubscription: list and patch the one present. - SUB=$(oc -n cert-manager-operator get subscriptions.operators.coreos.com -o jsonpath='{.items[0].metadata.name}') - if [[ -z "${SUB}" ]]; then - echo "No Subscription found in cert-manager-operator namespace" - oc -n cert-manager-operator get subscriptions.operators.coreos.com -o yaml || true - exit 1 - fi - echo "Patching Subscription ${SUB} (preserve existing env, match e2e patchSubscriptionWithEnvVars)" - PATCH=$(oc -n cert-manager-operator get "subscription/${SUB}" -o json | python3 -c 'import json,sys; sub=json.load(sys.stdin); cfg=(sub.get("spec") or {}).get("config") or {}; env=[e for e in (cfg.get("env") or []) if e.get("name")!="UNSUPPORTED_ADDON_FEATURES"]; env.append({"name":"UNSUPPORTED_ADDON_FEATURES","value":"TrustManager=true"}); print(json.dumps({"spec":{"config":{"env":env}}}))') - oc -n cert-manager-operator patch "subscription/${SUB}" --type=merge -p "${PATCH}" - - echo "Waiting for TrustManager feature gate on operator deployment env and rollout..." - FOUND=false - for _ in $(seq 1 60); do - ENV_VAL=$(oc -n cert-manager-operator get deploy/cert-manager-operator-controller-manager \ - -o jsonpath='{range .spec.template.spec.containers[0].env[?(@.name=="UNSUPPORTED_ADDON_FEATURES")]}{.value}{end}' 2>/dev/null || true) - if [[ "${ENV_VAL}" == "TrustManager=true" ]]; then - echo "Found UNSUPPORTED_ADDON_FEATURES=${ENV_VAL} on operator deployment" - FOUND=true - break - fi - sleep 5 - done - if [[ "${FOUND}" != "true" ]]; then - echo "Timed out waiting for UNSUPPORTED_ADDON_FEATURES=TrustManager=true on operator deployment" - oc -n cert-manager-operator get deploy/cert-manager-operator-controller-manager -o yaml || true - exit 1 - fi - oc -n cert-manager-operator rollout status deployment/cert-manager-operator-controller-manager --timeout=5m - - echo "Creating TrustManager CR (minimal, match e2e newTrustManagerCR)..." - oc apply -f - </dev/null || true) - if [[ "${READY}" == "True" ]]; then - echo "TrustManager CR is Ready" - FOUND=true - break - fi - sleep 5 - done - if [[ "${FOUND}" != "true" ]]; then - echo "Timed out waiting for TrustManager Ready=True" - oc get trustmanagers.operator.openshift.io cluster -o yaml || true - exit 1 - fi - oc wait --for=create -n cert-manager deployment/trust-manager --timeout=5m - oc wait --for=condition=Available -n cert-manager deployment/trust-manager --timeout=5m + commands: make deploy-trust-manager --warn-undefined-variables from: src resources: requests: @@ -594,82 +519,7 @@ tests: test: - as: deploy-operand cli: latest - commands: |- - set -o errexit - set -o nounset - set -o pipefail - - echo "Waiting for default cert-manager operand deployments..." - oc wait --for=create namespace/cert-manager --timeout=5m - oc wait --for=create -n cert-manager deployment/cert-manager --timeout=5m - oc wait --for=create -n cert-manager deployment/cert-manager-webhook --timeout=5m - oc wait --for=create -n cert-manager deployment/cert-manager-cainjector --timeout=5m - oc wait --for=condition=Available -n cert-manager deployment/cert-manager --timeout=5m - oc wait --for=condition=Available -n cert-manager deployment/cert-manager-webhook --timeout=5m - oc wait --for=condition=Available -n cert-manager deployment/cert-manager-cainjector --timeout=5m - - echo "Enabling TrustManager feature gate via subscription..." - # operator-sdk run bundle creates a versioned Subscription name - # (e.g. cert-manager-operator-v1-20-0-sub), not a fixed cert-manager-operator. - # Match e2e getCertManagerOperatorSubscription: list and patch the one present. - SUB=$(oc -n cert-manager-operator get subscriptions.operators.coreos.com -o jsonpath='{.items[0].metadata.name}') - if [[ -z "${SUB}" ]]; then - echo "No Subscription found in cert-manager-operator namespace" - oc -n cert-manager-operator get subscriptions.operators.coreos.com -o yaml || true - exit 1 - fi - echo "Patching Subscription ${SUB} (preserve existing env, match e2e patchSubscriptionWithEnvVars)" - PATCH=$(oc -n cert-manager-operator get "subscription/${SUB}" -o json | python3 -c 'import json,sys; sub=json.load(sys.stdin); cfg=(sub.get("spec") or {}).get("config") or {}; env=[e for e in (cfg.get("env") or []) if e.get("name")!="UNSUPPORTED_ADDON_FEATURES"]; env.append({"name":"UNSUPPORTED_ADDON_FEATURES","value":"TrustManager=true"}); print(json.dumps({"spec":{"config":{"env":env}}}))') - oc -n cert-manager-operator patch "subscription/${SUB}" --type=merge -p "${PATCH}" - - echo "Waiting for TrustManager feature gate on operator deployment env and rollout..." - FOUND=false - for _ in $(seq 1 60); do - ENV_VAL=$(oc -n cert-manager-operator get deploy/cert-manager-operator-controller-manager \ - -o jsonpath='{range .spec.template.spec.containers[0].env[?(@.name=="UNSUPPORTED_ADDON_FEATURES")]}{.value}{end}' 2>/dev/null || true) - if [[ "${ENV_VAL}" == "TrustManager=true" ]]; then - echo "Found UNSUPPORTED_ADDON_FEATURES=${ENV_VAL} on operator deployment" - FOUND=true - break - fi - sleep 5 - done - if [[ "${FOUND}" != "true" ]]; then - echo "Timed out waiting for UNSUPPORTED_ADDON_FEATURES=TrustManager=true on operator deployment" - oc -n cert-manager-operator get deploy/cert-manager-operator-controller-manager -o yaml || true - exit 1 - fi - oc -n cert-manager-operator rollout status deployment/cert-manager-operator-controller-manager --timeout=5m - - echo "Creating TrustManager CR (minimal, match e2e newTrustManagerCR)..." - oc apply -f - </dev/null || true) - if [[ "${READY}" == "True" ]]; then - echo "TrustManager CR is Ready" - FOUND=true - break - fi - sleep 5 - done - if [[ "${FOUND}" != "true" ]]; then - echo "Timed out waiting for TrustManager Ready=True" - oc get trustmanagers.operator.openshift.io cluster -o yaml || true - exit 1 - fi - oc wait --for=create -n cert-manager deployment/trust-manager --timeout=5m - oc wait --for=condition=Available -n cert-manager deployment/trust-manager --timeout=5m + commands: make deploy-trust-manager --warn-undefined-variables from: src resources: requests: @@ -694,82 +544,7 @@ tests: test: - as: deploy-operand cli: latest - commands: |- - set -o errexit - set -o nounset - set -o pipefail - - echo "Waiting for default cert-manager operand deployments..." - oc wait --for=create namespace/cert-manager --timeout=5m - oc wait --for=create -n cert-manager deployment/cert-manager --timeout=5m - oc wait --for=create -n cert-manager deployment/cert-manager-webhook --timeout=5m - oc wait --for=create -n cert-manager deployment/cert-manager-cainjector --timeout=5m - oc wait --for=condition=Available -n cert-manager deployment/cert-manager --timeout=5m - oc wait --for=condition=Available -n cert-manager deployment/cert-manager-webhook --timeout=5m - oc wait --for=condition=Available -n cert-manager deployment/cert-manager-cainjector --timeout=5m - - echo "Enabling TrustManager feature gate via subscription..." - # operator-sdk run bundle creates a versioned Subscription name - # (e.g. cert-manager-operator-v1-20-0-sub), not a fixed cert-manager-operator. - # Match e2e getCertManagerOperatorSubscription: list and patch the one present. - SUB=$(oc -n cert-manager-operator get subscriptions.operators.coreos.com -o jsonpath='{.items[0].metadata.name}') - if [[ -z "${SUB}" ]]; then - echo "No Subscription found in cert-manager-operator namespace" - oc -n cert-manager-operator get subscriptions.operators.coreos.com -o yaml || true - exit 1 - fi - echo "Patching Subscription ${SUB} (preserve existing env, match e2e patchSubscriptionWithEnvVars)" - PATCH=$(oc -n cert-manager-operator get "subscription/${SUB}" -o json | python3 -c 'import json,sys; sub=json.load(sys.stdin); cfg=(sub.get("spec") or {}).get("config") or {}; env=[e for e in (cfg.get("env") or []) if e.get("name")!="UNSUPPORTED_ADDON_FEATURES"]; env.append({"name":"UNSUPPORTED_ADDON_FEATURES","value":"TrustManager=true"}); print(json.dumps({"spec":{"config":{"env":env}}}))') - oc -n cert-manager-operator patch "subscription/${SUB}" --type=merge -p "${PATCH}" - - echo "Waiting for TrustManager feature gate on operator deployment env and rollout..." - FOUND=false - for _ in $(seq 1 60); do - ENV_VAL=$(oc -n cert-manager-operator get deploy/cert-manager-operator-controller-manager \ - -o jsonpath='{range .spec.template.spec.containers[0].env[?(@.name=="UNSUPPORTED_ADDON_FEATURES")]}{.value}{end}' 2>/dev/null || true) - if [[ "${ENV_VAL}" == "TrustManager=true" ]]; then - echo "Found UNSUPPORTED_ADDON_FEATURES=${ENV_VAL} on operator deployment" - FOUND=true - break - fi - sleep 5 - done - if [[ "${FOUND}" != "true" ]]; then - echo "Timed out waiting for UNSUPPORTED_ADDON_FEATURES=TrustManager=true on operator deployment" - oc -n cert-manager-operator get deploy/cert-manager-operator-controller-manager -o yaml || true - exit 1 - fi - oc -n cert-manager-operator rollout status deployment/cert-manager-operator-controller-manager --timeout=5m - - echo "Creating TrustManager CR (minimal, match e2e newTrustManagerCR)..." - oc apply -f - </dev/null || true) - if [[ "${READY}" == "True" ]]; then - echo "TrustManager CR is Ready" - FOUND=true - break - fi - sleep 5 - done - if [[ "${FOUND}" != "true" ]]; then - echo "Timed out waiting for TrustManager Ready=True" - oc get trustmanagers.operator.openshift.io cluster -o yaml || true - exit 1 - fi - oc wait --for=create -n cert-manager deployment/trust-manager --timeout=5m - oc wait --for=condition=Available -n cert-manager deployment/trust-manager --timeout=5m + commands: make deploy-trust-manager --warn-undefined-variables from: src resources: requests: From a931e1a8e2d13a0ca83607ae63573ace3809e98b Mon Sep 17 00:00:00 2001 From: Arun Maurya Date: Fri, 4 Sep 2026 14:29:07 +0530 Subject: [PATCH 3/3] Run tls-scanner TLS profile e2e before deploying TrustManager. The Feature:TLSProfile tests create and delete the singleton TrustManager CR; deploying it first caused AlreadyExists, then AfterEach removed it before the scanner ran. --- .../openshift-cert-manager-operator-master.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml index a941374513d91..1c7593d4f9c63 100644 --- a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml +++ b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml @@ -483,22 +483,22 @@ tests: TLS_13_ENABLE_TLS_ADHERENCE: "true" TLS_13_TLS_ADHERENCE_POLICY: StrictAllComponents test: - - as: deploy-operand + - as: test-tls-profile cli: latest - commands: make deploy-trust-manager --warn-undefined-variables + commands: E2E_GINKGO_LABEL_FILTER='Feature:TLSProfile' make test-e2e from: src resources: requests: cpu: 100m - - ref: tls-13 - - as: test-tls-profile + memory: 250Mi + - as: deploy-operand cli: latest - commands: E2E_GINKGO_LABEL_FILTER='Feature:TLSProfile' make test-e2e + commands: make deploy-trust-manager --warn-undefined-variables from: src resources: requests: cpu: 100m - memory: 250Mi + - ref: tls-13 - ref: tls-scanner-run workflow: optional-operators-ci-operator-sdk-aws - always_run: false