Skip to content

Commit ae7418f

Browse files
hongkailiuhongkailiu
committed
cincinnati-op: add test fips-image-scan
1 parent 313ad90 commit ae7418f

File tree

3 files changed

+193
-0
lines changed

3 files changed

+193
-0
lines changed

‎ci-operator/config/openshift/cincinnati-operator/openshift-cincinnati-operator-master.yaml

+69
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@ base_images:
33
name: cincinnati-build-root
44
namespace: cincinnati-ci
55
tag: deploy
6+
fips-check-payload:
7+
name: check-payload
8+
namespace: ci
9+
tag: latest
610
operator-sdk:
711
name: "4.15"
812
namespace: origin
@@ -131,6 +135,71 @@ tests:
131135
cpu: 100m
132136
memory: 200Mi
133137
workflow: generic-claim
138+
- as: fips-ci-image-scan
139+
optional: true
140+
steps:
141+
test:
142+
- as: check-payload
143+
commands: |
144+
set -euo pipefail
145+
146+
declare -A SCAN_IMAGES
147+
SCAN_IMAGES=( ["cincinnati-operator"]="$RELATED_IMAGE_OPERATOR" )
148+
149+
export REGISTRY_AUTH_FILE=/var/secrets/registry-pull-secret/.dockerconfigjson
150+
for image_k in "${!SCAN_IMAGES[@]}"
151+
do
152+
checking "image: ${SCAN_IMAGES[$image_k]} ..."
153+
mkdir -p /tmp/oci-images
154+
skopeo copy --remove-signatures docker://"${SCAN_IMAGES[$image_k]}" oci:/tmp/oci-images:"$image_k":latest
155+
mkdir -p /tmp/unpacked-images/"$image_k"
156+
umoci raw unpack --rootless --image /tmp/oci-images:"$image_k":latest /tmp/unpacked-images/"$image_k"
157+
mkdir -p "$ARTIFACT_DIR"/"$image_k"
158+
/check-payload scan local -v=6 --path=/tmp/unpacked-images/"$image_k" --output-file=$ARTIFACT_DIR/$image_k/check-payload-report.txt
159+
done
160+
credentials:
161+
- mount_path: /var/secrets/registry-pull-secret
162+
name: registry-pull-credentials
163+
namespace: test-credentials
164+
dependencies:
165+
- env: RELATED_IMAGE_OPERATOR
166+
name: pipeline:cincinnati-operator
167+
from: fips-check-payload
168+
resources:
169+
requests:
170+
cpu: 50m
171+
memory: 64Mi
172+
- as: fips-production-image-scan
173+
cron: '@yearly'
174+
steps:
175+
test:
176+
- as: check-payload
177+
commands: |
178+
set -euo pipefail
179+
180+
declare -A SCAN_IMAGES
181+
SCAN_IMAGES=( ["cincinnati-operator"]="registry.redhat.io/openshift-update-service/openshift-update-service-rhel8-operator:latest" )
182+
183+
export REGISTRY_AUTH_FILE=/var/secrets/ci-pull-credentials/.dockerconfigjson
184+
for image_k in "${!SCAN_IMAGES[@]}"
185+
do
186+
checking "image: ${SCAN_IMAGES[$image_k]} ..."
187+
mkdir -p /tmp/oci-images
188+
skopeo copy --remove-signatures docker://"${SCAN_IMAGES[$image_k]}" oci:/tmp/oci-images:"$image_k":latest
189+
mkdir -p /tmp/unpacked-images/"$image_k"
190+
umoci raw unpack --rootless --image /tmp/oci-images:"$image_k":latest /tmp/unpacked-images/"$image_k"
191+
mkdir -p "$ARTIFACT_DIR"/"$image_k"
192+
/check-payload scan local -v=6 --path=/tmp/unpacked-images/"$image_k" --output-file=$ARTIFACT_DIR/$image_k/check-payload-report.txt
193+
done
194+
credentials:
195+
- mount_path: /var/secrets/ci-pull-credentials
196+
name: ci-pull-credentials
197+
namespace: test-credentials
198+
from: fips-check-payload
199+
resources:
200+
requests:
201+
cpu: 50m
202+
memory: 64Mi
134203
- as: operator-e2e-new-ocp-published-graph-data
135204
cluster_claim:
136205
architecture: amd64

‎ci-operator/jobs/openshift/cincinnati-operator/openshift-cincinnati-operator-master-periodics.yaml

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
periodics:
2+
- agent: kubernetes
3+
cluster: build03
4+
cron: '@yearly'
5+
decorate: true
6+
decoration_config:
7+
skip_cloning: true
8+
extra_refs:
9+
- base_ref: master
10+
org: openshift
11+
repo: cincinnati-operator
12+
labels:
13+
ci.openshift.io/generator: prowgen
14+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
15+
name: periodic-ci-openshift-cincinnati-operator-master-fips-production-image-scan
16+
spec:
17+
containers:
18+
- args:
19+
- --gcs-upload-secret=/secrets/gcs/service-account.json
20+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
21+
- --report-credentials-file=/etc/report/credentials
22+
- --secret-dir=/secrets/ci-pull-credentials
23+
- --target=fips-production-image-scan
24+
command:
25+
- ci-operator
26+
image: ci-operator:latest
27+
imagePullPolicy: Always
28+
name: ""
29+
resources:
30+
requests:
31+
cpu: 10m
32+
volumeMounts:
33+
- mountPath: /secrets/ci-pull-credentials
34+
name: ci-pull-credentials
35+
readOnly: true
36+
- mountPath: /secrets/gcs
37+
name: gcs-credentials
38+
readOnly: true
39+
- mountPath: /secrets/manifest-tool
40+
name: manifest-tool-local-pusher
41+
readOnly: true
42+
- mountPath: /etc/pull-secret
43+
name: pull-secret
44+
readOnly: true
45+
- mountPath: /etc/report
46+
name: result-aggregator
47+
readOnly: true
48+
serviceAccountName: ci-operator
49+
volumes:
50+
- name: ci-pull-credentials
51+
secret:
52+
secretName: ci-pull-credentials
53+
- name: manifest-tool-local-pusher
54+
secret:
55+
secretName: manifest-tool-local-pusher
56+
- name: pull-secret
57+
secret:
58+
secretName: registry-pull-credentials
59+
- name: result-aggregator
60+
secret:
61+
secretName: result-aggregator

‎ci-operator/jobs/openshift/cincinnati-operator/openshift-cincinnati-operator-master-presubmits.yaml

+63
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,69 @@ presubmits:
5555
secret:
5656
secretName: result-aggregator
5757
trigger: (?m)^/test( | .* )ci-bundle-cincinnati-bundle,?($|\s.*)
58+
- agent: kubernetes
59+
always_run: true
60+
branches:
61+
- ^master$
62+
- ^master-
63+
cluster: build09
64+
context: ci/prow/fips-ci-image-scan
65+
decorate: true
66+
decoration_config:
67+
skip_cloning: true
68+
labels:
69+
ci.openshift.io/generator: prowgen
70+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
71+
name: pull-ci-openshift-cincinnati-operator-master-fips-ci-image-scan
72+
optional: true
73+
rerun_command: /test fips-ci-image-scan
74+
spec:
75+
containers:
76+
- args:
77+
- --gcs-upload-secret=/secrets/gcs/service-account.json
78+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
79+
- --report-credentials-file=/etc/report/credentials
80+
- --secret-dir=/secrets/ci-pull-credentials
81+
- --target=fips-ci-image-scan
82+
command:
83+
- ci-operator
84+
image: ci-operator:latest
85+
imagePullPolicy: Always
86+
name: ""
87+
resources:
88+
requests:
89+
cpu: 10m
90+
volumeMounts:
91+
- mountPath: /secrets/ci-pull-credentials
92+
name: ci-pull-credentials
93+
readOnly: true
94+
- mountPath: /secrets/gcs
95+
name: gcs-credentials
96+
readOnly: true
97+
- mountPath: /secrets/manifest-tool
98+
name: manifest-tool-local-pusher
99+
readOnly: true
100+
- mountPath: /etc/pull-secret
101+
name: pull-secret
102+
readOnly: true
103+
- mountPath: /etc/report
104+
name: result-aggregator
105+
readOnly: true
106+
serviceAccountName: ci-operator
107+
volumes:
108+
- name: ci-pull-credentials
109+
secret:
110+
secretName: ci-pull-credentials
111+
- name: manifest-tool-local-pusher
112+
secret:
113+
secretName: manifest-tool-local-pusher
114+
- name: pull-secret
115+
secret:
116+
secretName: registry-pull-credentials
117+
- name: result-aggregator
118+
secret:
119+
secretName: result-aggregator
120+
trigger: (?m)^/test( | .* )fips-ci-image-scan,?($|\s.*)
58121
- agent: kubernetes
59122
always_run: false
60123
branches:

0 commit comments

Comments
 (0)