CMP-4504: Add PQC/ML-KEM readiness check (tls-scanner) for file-integrity-operator by guzalv · Pull Request #85402 · openshift/release

guzalv · 2026-09-17T14:06:39Z

What

Adds post-quantum readiness (ML-KEM) testing for the File Integrity Operator's TLS endpoints, per CMP-4504 (layered-product tracker for OCPSTRAT-3303 / OCP 4.22 ML-KEM readiness).

Adds a new, dedicated, optional test e2e-aws-tls-scanner that:

Deploys the operator with make e2e-set-image deploy (plain kustomize apply, no test framework — leaves the openshift-file-integrity namespace and Deployment running).
Runs the tls-scanner-run step registry ref against it, with PQC_CHECK=true and SCANNER_NAMESPACE/SCAN_NAMESPACE both set to openshift-file-integrity (restricted pod-mode scan — see below).

Why a separate test, not appended to the existing `e2e-aws` job

My first attempt appended tls-scanner-run directly onto the existing e2e-aws test (mirroring openshift/release#82555, RHOAI's merged pattern). That failed on the first real rehearsal run with namespaces "openshift-file-integrity" not found: FIO's make e2e runs its own Go e2e test suite, and every test in tests/e2e/e2e_test.go runs defer testctx.Cleanup(), which tears down the namespace on exit regardless of pass/fail. By the time tls-scanner-run ran afterward, there was nothing left to scan. (rehearsal log)

This is the same reason Compliance Operator's own tls-scanner work (openshift/release#84972 / #84296) explicitly used make deploy instead of their e2e-deployment test target (see commit message in #84296: "Following yuumasato's approach in PR #84972... Use make deploy directly (skip e2e-deployment test)"). This PR follows the same approach for FIO: a plain make deploy leaves a persistent installation (confirmed: config/default → config/ns/ns.yaml creates the namespace, no teardown), which tls-scanner-run can then scan.

Restricted (non-privileged) scan mode

SCANNER_NAMESPACE is set (not left to the step's default) so tls-scanner-run deploys its scanner pod into the existing openshift-file-integrity namespace instead of creating its own dedicated, hostNetwork/hostPID/privileged-as-root namespace. This was flagged by CodeRabbit's Container-Privileges pre-merge check on an earlier revision of this PR, and matches the identical mitigation both merged Compliance Operator PRs use (SCANNER_NAMESPACE: openshift-compliance in #84296).

`tls-scanner-tool` base image version

Uses ocp/4.22:tls-scanner-tool. I confirmed via the openshift/tls-scanner repo's own CI config (ci-operator/config/openshift/tls-scanner/openshift-tls-scanner-release-*.yaml) that 4.22, 4.23, and 5.0 all have active promotion (so the image is actually published), while 5.1 (which would otherwise match FIO's own releases.latest target) has promotion.to[0].disabled: true — i.e. that tag is not reliably published. 4.22 also matches two independent working precedents (RHOAI #82555, Compliance Operator #84296).

Testing

Verified manually end-to-end on a live OCP 4.22.13 cluster (not just CI-config review):

Built file-integrity-operator from current master (commit 8b647112, already on Go 1.25.11) and deployed it to the cluster in the openshift-file-integrity namespace, then created the sample FileIntegrity CR to bring up the full operator + aide DaemonSet.
Built the real upstream tls-scanner tool from source (the CI-only tls-scanner-tool base image isn't pullable outside the CI registry) and ran it in-cluster exactly as the tls-scanner-run step does: tls-scanner --all-pods --namespace-filter openshift-file-integrity --pqc-check.
Result — the operator's Prometheus metrics endpoint (port 8585, pkg/controller/metrics/metrics.go) is fully PQC-ready:

Port 8585:
    TLS 1.3:  SUPPORTED
    ML-KEM:   SUPPORTED
    ML-KEM KEMs: X25519MLKEM768
    TLS Versions: TLSv1.2, TLSv1.3

PQC COMPLIANCE CHECK: PASSED
All endpoints support TLS 1.3 + ML-KEM

No code changes were needed in file-integrity-operator to satisfy the "offers ML-KEM by default" requirement — the metrics TLS listener sets no CurvePreferences/MaxVersion, so Go 1.25's default TLS 1.3 group preference (which includes X25519MLKEM768) already applies. (Ports 8081/8383 are plain HTTP health/controller-runtime-metrics endpoints by design, not TLS.) Separately, FIO does still hardcode a static cipher/version fallback that doesn't yet observe the cluster's TLSSecurityProfile/TLSAdherencePolicy (the other half of the epic's AC) — that is being tracked as follow-up work in the file-integrity-operator repo itself, out of scope for this CI-only PR.

Rehearsal: ci/rehearse/openshift/file-integrity-operator/master/e2e-aws-tls-scanner in progress.

cc @yuumasato — your CMP-4503 compliance-operator work was the reference pattern pointed to for this change.

Summary by CodeRabbit

The File Integrity Operator CI configuration adds an optional e2e-aws-tls-scanner test.

Adds the ocp/4.22:tls-scanner-tool base image.
Deploys the operator with make e2e-set-image deploy.
Provides a kubectl shim when the CI image includes oc only.
Waits for the operator deployment to become Available.
Runs tls-scanner-run with PQC_CHECK=true against the openshift-file-integrity namespace.

Appends the tls-scanner-run step registry ref to the existing e2e-aws test for file-integrity-operator, scoped to the openshift-file-integrity namespace where the operator and its aide daemonset run, with PQC_CHECK=true to assert TLS 1.3 + ML-KEM (X25519MLKEM768) readiness. Follows the pattern already merged for RHOAI (openshift#82555): append '- ref: tls-scanner-run' to the existing e2e test's step list and add the required tls-scanner-tool base image, rather than provisioning a separate cluster/job as compliance-operator's manual approach did. Verified manually on a live OCP 4.22.13 cluster: deployed FIO built from the current Go 1.25 source and ran the actual upstream tls-scanner tool against the openshift-file-integrity namespace with --pqc-check. The operator's metrics endpoint (port 8585) reported: TLS 1.3: SUPPORTED, ML-KEM: SUPPORTED, ML-KEM KEMs: X25519MLKEM768 PQC COMPLIANCE CHECK: PASSED No code changes were required in file-integrity-operator itself: the metrics TLS listener (pkg/controller/metrics/metrics.go) sets no CurvePreferences/MaxVersion, so Go 1.25's default TLS 1.3 group preference (which includes X25519MLKEM768) already applies. Ref: https://redhat.atlassian.net/browse/CMP-4504

openshift-ci-robot · 2026-09-17T14:06:44Z

@guzalv: This pull request references CMP-4504 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "5.1.0" version, but no target version was set.

Details

In response to this:

What

Adds post-quantum readiness (ML-KEM) testing for the File Integrity Operator's TLS endpoints, per CMP-4504 (layered-product tracker for OCPSTRAT-3303 / OCP 4.22 ML-KEM readiness).

Appends the tls-scanner-run step registry ref to FIO's existing e2e-aws test, pointed at the openshift-file-integrity namespace (where make e2e installs the operator and its aide DaemonSet), with PQC_CHECK=true.

This follows the pattern already merged for RHOAI in openshift/release#82555: append - ref: tls-scanner-run to an existing e2e test's step list with SCAN_NAMESPACE/PQC_CHECK env, rather than provisioning a dedicated cluster/job the way compliance-operator's manual approach did in openshift/release#84972/#84296. No new base image dependency issues here since the tls-scanner-tool base image name matches exactly what the tls-scanner-run ref expects (PULL_SPEC_TLS_SCANNER_TOOL → base image named tls-scanner-tool), so no manual/inline scripting is required.

Only ci-operator/config/openshift/file-integrity-operator/openshift-file-integrity-operator-master.yaml changes; no ci-operator/jobs/** regeneration is needed because the added step only affects the steps.test/steps.env body that ci-operator resolves at runtime, not anything baked into the generated Prow job spec (confirmed by inspecting the existing generated pull-ci-openshift-file-integrity-operator-master-e2e-aws job, which merely invokes ci-operator --target=e2e-aws). Verified with make ci-operator-config (determinize) — no additional formatting changes produced.

Testing

Verified manually end-to-end on a live OCP 4.22.13 cluster (not just CI-config review):

Built file-integrity-operator from current master (commit 8b647112, already on Go 1.25.11) and deployed it to the cluster in the openshift-file-integrity namespace via make deploy, then created the sample FileIntegrity CR to bring up the full operator + aide DaemonSet.

Built the real upstream tls-scanner tool from source (the CI-only tls-scanner-tool base image isn't pullable outside the CI registry) and ran it in-cluster exactly as the tls-scanner-run step does: tls-scanner --all-pods --namespace-filter openshift-file-integrity --pqc-check.

Result — the operator's Prometheus metrics endpoint (port 8585, pkg/controller/metrics/metrics.go) is fully PQC-ready:
Port 8585:
   TLS 1.3:  SUPPORTED
   ML-KEM:   SUPPORTED
   ML-KEM KEMs: X25519MLKEM768
   TLS Versions: TLSv1.2, TLSv1.3

PQC COMPLIANCE CHECK: PASSED
All endpoints support TLS 1.3 + ML-KEM
No code changes were needed in file-integrity-operator itself — the metrics TLS listener sets no CurvePreferences/MaxVersion, so Go 1.25's default TLS 1.3 group preference (which includes X25519MLKEM768) already applies. (Ports 8081/8383 are plain HTTP health/controller-runtime-metrics endpoints by design, not TLS.)

cc @yuumasato — your CMP-4503 compliance-operator work was the reference pattern pointed to for this change.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-09-17T14:07:21Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: f89cf26a-3177-431c-b666-587f81b9adc3

📥 Commits

Reviewing files that changed from the base of the PR and between 0d29d69 and ea6402e.

📒 Files selected for processing (1)

ci-operator/config/openshift/file-integrity-operator/openshift-file-integrity-operator-master.yaml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

Walkthrough

The file-integrity-operator configuration adds the tls-scanner-tool base image and an optional AWS end-to-end test. The test enables PQC checks, deploys the operator, waits for availability, and runs tls-scanner-run.

Changes

TLS scanner integration

Layer / File(s)	Summary
Configure TLS scanner workflow `ci-operator/config/openshift/file-integrity-operator/openshift-file-integrity-operator-master.yaml`	Adds the `tls-scanner-tool` base image. Defines the optional `e2e-aws-tls-scanner` test with PQC and namespace settings, `kubectl` setup, operator deployment, an availability check, and the `tls-scanner-run` test reference.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to ea640

The optional TLS scanner test configuration introduces no confirmed merge-blocking risk.

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	The new `e2e-aws-tls-scanner` job activates raw scanner output in the CI log. It sets `PQC_CHECK=true` and runs `tls-scanner-run` against `openshift-file-integrity`. The step forwards the scanner pod …	Do not stream raw scanner output to the CI log. Emit only aggregate PQC results, or redact private IPs and pod identifiers before forwarding output. Also review the copied JSON, CSV, JUnit, and log artifacts and redact or restrict them if C…

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: adding a PQC/ML-KEM readiness check that uses tls-scanner for the File Integrity Operator.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request changes only CI configuration and a generated Prow job. It adds the static test identifier `e2e-aws-tls-scanner` and static namespace values. The diff adds no Ginkgo `It`, `Desc…
Test Structure And Quality	✅ Passed	PASS — The pull request changes only two CI YAML files. It adds no Go or Ginkgo test code, no `It`, `BeforeEach`, `AfterEach`, `Eventually`, or `Consistently` blocks. Therefore, the stated Ginkgo test…
Microshift Test Compatibility	✅ Passed	The pull request changes only CI configuration and a generated Prow job. It adds no Ginkgo tests or test source. The new job invokes the existing `tls-scanner-run` step and uses Kubernetes resource na…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS — The authoritative diff changes only two YAML CI configuration files. It adds a deployment step, a `tls-scanner-run` reference, and a generated Prow job; it adds no Go files or Ginkgo constructs…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request changes only CI configuration and a generated presubmit job. It adds a `tls-scanner-tool` image and an optional test that runs `make e2e-set-image deploy`, waits for the existin…
Ote Binary Stdout Contract	✅ Passed	PASS — The pull request changes only two YAML CI configuration files. The diff adds a Prow job, base-image metadata, environment variables, and shell commands. It adds no Go or other OTE binary source…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only CI YAML and a generated Prow job. It adds no Ginkgo test code or Ginkgo constructs such as It(), Describe(), Context(), or When(). The new job deploys the operator …
No-Weak-Crypto	✅ Passed	PASS. The pull request changes only CI YAML and generated Prow job YAML. The additions configure `tls-scanner-run`, deployment commands, namespace variables, and CI secrets mounts. Added lines contain…
Container-Privileges	✅ Passed	No stated privilege violation is introduced. The PR changes only CI configuration and generated Prow job data; the changed manifests contain no `privileged`, `hostPID`, `hostNetwork`, `hostIPC`, `SYS_…

Full details: No-Sensitive-Data-In-Logs

Explanation

The new e2e-aws-tls-scanner job activates raw scanner output in the CI log. It sets PQC_CHECK=true and runs tls-scanner-run against openshift-file-integrity. The step forwards the scanner pod output with oc logs -f. In PQC mode, the scanner prints each target IP and namespace/pod identifier. This exposes internal cluster identifiers in public job logs. The PR causes this exposure by adding the scanner invocation.

Resolution

Do not stream raw scanner output to the CI log. Emit only aggregate PQC results, or redact private IPs and pod identifiers before forwarding output. Also review the copied JSON, CSV, JUnit, and log artifacts and redact or restrict them if CI artifacts are publicly accessible.

Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

guzalv · 2026-09-17T16:44:57Z

/pj-rehearse

openshift-merge-bot · 2026-09-17T16:44:59Z

@guzalv: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

Setting SCANNER_NAMESPACE to the existing openshift-file-integrity namespace (already created by the e2e-aws test's 'make e2e' step) makes tls-scanner-run take the OWNS_NAMESPACE=false code path: it deploys the scanner pod into that namespace instead of creating its own, with hostNetwork: false, hostPID: false, a restricted (non-privileged, non-root, runAsUser: 65532) securityContext, and no 'privileged' SCC grant -- instead of the default owned-namespace path which runs hostNetwork/hostPID/privileged as root. This mode uses the kube API for pod discovery and exec rather than host networking, which matches how we already validated ML-KEM support manually on a live cluster (via pods/exec into the target pod), so it does not change scan coverage for FIO's single-namespace target. Verified with 'make ci-operator-config' (idempotent after this change).

guzalv · 2026-09-17T18:23:03Z

/pj-rehearse pull-ci-openshift-file-integrity-operator-master-e2e-aws pull-ci-openshift-file-integrity-operator-master-e2e-bundle-aws pull-ci-openshift-file-integrity-operator-master-e2e-bundle-aws-upgrade

openshift-merge-bot · 2026-09-17T18:23:06Z

@guzalv: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

guzalv · 2026-09-18T09:53:32Z

/pj-rehearse pull-ci-openshift-file-integrity-operator-master-e2e-aws

openshift-merge-bot · 2026-09-18T09:53:35Z

@guzalv: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

…ng e2e test The e2e-aws job's 'make e2e' step tears down its own namespace on exit (every test in tests/e2e/e2e_test.go runs 'defer testctx.Cleanup()'), regardless of pass/fail. Appending tls-scanner-run after it fails with 'namespaces "openshift-file-integrity" not found', confirmed by the first real rehearsal run: https://prow.ci.openshift.org/view/gs/test-platform-results-public/pr-logs/pull/openshift_release/85402/rehearse-85402-pull-ci-openshift-file-integrity-operator-master-e2e-aws/2100886946011156480 Revert the e2e-aws change entirely, and instead add a new, separate optional test (e2e-aws-tls-scanner) that uses 'make deploy' (just kustomize apply, no test framework, no cleanup) to stand up a persistent operator installation, then scans it. This matches what compliance-operator's own tls-scanner PRs settled on for the same reason -- see commit message 99893f0 in openshift#84296: 'Following yuumasato's approach in PR openshift#84972... Use make deploy directly (skip e2e-deployment test)'.

openshift-ci · 2026-09-18T12:56:55Z

New changes are detected. LGTM label has been removed.

guzalv · 2026-09-18T12:57:29Z

/pj-rehearse pull-ci-openshift-file-integrity-operator-master-e2e-aws-tls-scanner

openshift-merge-bot · 2026-09-18T13:00:06Z

@guzalv: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-merge-bot · 2026-09-18T13:04:26Z

@guzalv: job(s): pull-ci-openshift-file-integrity-operator-master-e2e-aws-tls-scanner either don't exist or were not found to be affected, and cannot be rehearsed

Unlike the previous revision (which only added a step to the existing e2e-aws test, leaving the generated job spec untouched since it merely invokes 'ci-operator --target=e2e-aws'), this revision introduces a brand new test name, which requires its own generated Prow job entry in ci-operator/jobs/. pj-rehearse confirmed this is required: 'job(s): pull-ci-openshift-file-integrity-operator-master-e2e-aws-tls-scanner either don't exist or were not found to be affected, and cannot be rehearsed' Hand-crafted following the exact boilerplate of the sibling e2e-bundle-aws job (same cluster_profile: openshift-org-aws, same optional:true/always_run:false shape), since 'make jobs' (ci-operator-prowgen) could not be run standalone here -- it requires the full step-registry tree to resolve every ref/chain/workflow used anywhere in the config, which isn't practical in this sparse checkout. Validated instead with 'make sanitize-prow-jobs', which is repo-local (only needs ci-operator/jobs + core-services/sanitize-prow-jobs) and produced zero additional changes on top of this hand-written entry, confirming it already matches the tool's expected normalized form. The real CI 'generated-config' presubmit will independently verify this is byte-for-byte what the full generator would produce.

openshift-ci · 2026-09-18T13:19:00Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: guzalv, taimurhafeez

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~ci-operator/config/openshift/file-integrity-operator/OWNERS~~ [taimurhafeez]
~~ci-operator/jobs/openshift/file-integrity-operator/OWNERS~~ [taimurhafeez]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

guzalv · 2026-09-18T13:23:25Z

/pj-rehearse pull-ci-openshift-file-integrity-operator-master-e2e-aws-tls-scanner

openshift-merge-bot · 2026-09-18T13:23:27Z

@guzalv: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

The rehearsal run failed inside 'make deploy' with 'kubectl: command not found': https://storage.googleapis.com/test-platform-results-public/pr-logs/pull/openshift_release/85402/rehearse-85402-pull-ci-openshift-file-integrity-operator-master-e2e-aws-tls-scanner/2100939653510074368/artifacts/e2e-aws-tls-scanner/deploy/build-log.txt FIO's Makefile 'install'/'deploy' targets are kubebuilder-scaffolded boilerplate that shell out to a literal 'kubectl' binary, unlike 'make e2e' (which applies manifests via the Go client library inside the test binary itself, never invoking a CLI tool). The CI cli image only provides 'oc'. Symlink oc as kubectl on PATH before invoking make, entirely within this CI step -- no change to file-integrity-operator's Makefile needed, keeping this PR CI-only as intended.

guzalv · 2026-09-18T14:42:41Z

/pj-rehearse pull-ci-openshift-file-integrity-operator-master-e2e-aws-tls-scanner

openshift-merge-bot · 2026-09-18T14:47:17Z

@guzalv: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-merge-bot · 2026-09-18T14:48:14Z

[REHEARSALNOTIFIER]
@guzalv: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-file-integrity-operator-master-e2e-aws-tls-scanner	openshift/file-integrity-operator	presubmit	Presubmit changed
pull-ci-openshift-file-integrity-operator-master-ci-index-file-integrity-operator-bundle	openshift/file-integrity-operator	presubmit	Ci-operator config changed
pull-ci-openshift-file-integrity-operator-master-e2e-aws	openshift/file-integrity-operator	presubmit	Ci-operator config changed
pull-ci-openshift-file-integrity-operator-master-e2e-bundle-aws	openshift/file-integrity-operator	presubmit	Ci-operator config changed
pull-ci-openshift-file-integrity-operator-master-e2e-bundle-aws-upgrade	openshift/file-integrity-operator	presubmit	Ci-operator config changed
pull-ci-openshift-file-integrity-operator-master-e2e-rosa	openshift/file-integrity-operator	presubmit	Ci-operator config changed
pull-ci-openshift-file-integrity-operator-master-go-build	openshift/file-integrity-operator	presubmit	Ci-operator config changed
pull-ci-openshift-file-integrity-operator-master-images	openshift/file-integrity-operator	presubmit	Ci-operator config changed
pull-ci-openshift-file-integrity-operator-master-unit	openshift/file-integrity-operator	presubmit	Ci-operator config changed
pull-ci-openshift-file-integrity-operator-master-verify	openshift/file-integrity-operator	presubmit	Ci-operator config changed
periodic-ci-openshift-file-integrity-operator-master-nightly-4.20-baremetalds-ipi-ovn-lvms-f7	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-file-integrity-operator-master-nightly-4.21-baremetalds-ipi-ovn-lvms-f7	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-file-integrity-operator-master-nightly-4.22-baremetalds-ipi-ovn-lvms-f7	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-file-integrity-operator-master-nightly-4.12-aws-ipi-proxy-fips-f60	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-file-integrity-operator-master-nightly-4.14-aws-ipi-proxy-fips-f28	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-file-integrity-operator-master-nightly-4.16-ibmcloud-ipi-private-fips-f14	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-file-integrity-operator-master-nightly-4.18-aws-ipi-proxy-fips-f14	N/A	periodic	Ci-operator config changed
periodic-ci-openshift-file-integrity-operator-master-nightly-4.19-baremetalds-ipi-ovn-lvms-f7	N/A	periodic	Ci-operator config changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

openshift-ci · 2026-09-18T18:13:45Z

@guzalv: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/openshift/file-integrity-operator/master/e2e-rosa	`e33d12b`	link	unknown	`/pj-rehearse pull-ci-openshift-file-integrity-operator-master-e2e-rosa`
ci/rehearse/openshift/file-integrity-operator/master/e2e-aws	`a41303e`	link	unknown	`/pj-rehearse pull-ci-openshift-file-integrity-operator-master-e2e-aws`
ci/rehearse/openshift/file-integrity-operator/master/e2e-aws-tls-scanner	`ea6402e`	link	unknown	`/pj-rehearse pull-ci-openshift-file-integrity-operator-master-e2e-aws-tls-scanner`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Sep 17, 2026

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 17, 2026

guzalv marked this pull request as ready for review September 17, 2026 16:44

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 17, 2026

openshift-ci Bot requested review from Anna-Koudelkova and vickeybrown September 17, 2026 16:45

taimurhafeez approved these changes Sep 18, 2026

View reviewed changes

openshift-ci Bot assigned taimurhafeez Sep 18, 2026

openshift-ci Bot added lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Sep 18, 2026

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Sep 18, 2026

guzalv changed the title ~~CMP-4504: Add PQC/ML-KEM readiness check (tls-scanner) to file-integrity-operator e2e-aws~~ CMP-4504: Add PQC/ML-KEM readiness check (tls-scanner) for file-integrity-operator Sep 18, 2026

Conversation

guzalv commented Sep 17, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why a separate test, not appended to the existing e2e-aws job

Restricted (non-privileged) scan mode

tls-scanner-tool base image version

Testing

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Sep 17, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Testing

Uh oh!

coderabbitai Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Pre-merge checks failed

❌ Failed checks (1 error)

Uh oh!

guzalv commented Sep 17, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 17, 2026

Uh oh!

guzalv commented Sep 17, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 17, 2026

Uh oh!

guzalv commented Sep 18, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 18, 2026

Uh oh!

openshift-ci Bot commented Sep 18, 2026

Uh oh!

guzalv commented Sep 18, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 18, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 18, 2026

Uh oh!

openshift-ci Bot commented Sep 18, 2026

Uh oh!

guzalv commented Sep 18, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 18, 2026

Uh oh!

guzalv commented Sep 18, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 18, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 18, 2026

Uh oh!

openshift-ci Bot commented Sep 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

guzalv commented Sep 17, 2026 •

edited by coderabbitai Bot

Loading

Why a separate test, not appended to the existing `e2e-aws` job

`tls-scanner-tool` base image version

openshift-ci-robot commented Sep 17, 2026 •

edited by atlassian Bot

Loading

coderabbitai Bot commented Sep 17, 2026 •

edited

Loading