STOR-3001: Add TLS scanner job to csi-operator for SMB

[RomanBednar]

Adds an optional, manually-triggered TLS scanner presubmit job (tls-scanner-smb) to csi-operator for the SMB CSI driver operator across main, release-4.23, release-5.0, and release-5.1 branches.

The job provisions an Azure cluster using the existing SMB workflow, installs the SMB operator through OLM, and scans the openshift-cluster-csi-drivers namespace.

Summary by CodeRabbit

• Adds an optional, manually triggered tls-scanner-smb presubmit job for the SMB CSI driver operator on main, release-4.23, release-5.0, and release-5.1.
• The job provisions an Azure cluster via the existing SMB workflow, installs the operator through OLM, and scans the openshift-cluster-csi-drivers namespace with TLS 1.3 strict adherence checks.
• References valid JIRA issue STOR-3001.

[openshift-ci-robot]

@RomanBednar: This pull request references STOR-3001 which is a valid jira issue.

Details

In response to this:

Adds an optional, manually-triggered TLS scanner presubmit job (tls-scanner-smb) to csi-operator for the SMB CSI driver operator across main, release-4.23, release-5.0, and release-5.1 branches.

The job provisions an Azure cluster using the existing SMB workflow, installs the SMB operator through OLM, and scans the openshift-cluster-csi-drivers namespace.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: d4e26ab9-310c-416c-b351-e40335f1c4fd

📥 Commits

Reviewing files that changed from the base of the PR and between 43b6aab and f7a32b5.

⛔ Files ignored due to path filters (4)

• ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-main-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-release-4.23-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-release-5.0-presubmits.yaml is excluded by !ci-operator/jobs/**
• ci-operator/jobs/openshift/csi-operator/openshift-csi-operator-release-5.1-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (4)

• ci-operator/config/openshift/csi-operator/openshift-csi-operator-main.yaml
• ci-operator/config/openshift/csi-operator/openshift-csi-operator-release-4.23.yaml
• ci-operator/config/openshift/csi-operator/openshift-csi-operator-release-5.0.yaml
• ci-operator/config/openshift/csi-operator/openshift-csi-operator-release-5.1.yaml

---

Walkthrough

Adds an optional tls-scanner-smb CI job to the main, 4.23, 5.0, and 5.1 CSI operator configurations. The job runs SMB TLS 1.3 tests through the Azure workflow with required controller conditions.

Changes

SMB TLS scanner coverage

Layer / File(s)	Summary
Configure SMB TLS scanner jobs ci-operator/config/openshift/csi-operator/openshift-csi-operator-{main,release-4.23,release-5.0,release-5.1}.yaml	Adds an optional Azure SMB TLS scanner job with bundle dependency, TLS adherence settings, controller availability conditions, tls-13 and tls-scanner-run references, and the openshift-e2e-azure-csi-smb workflow.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• openshift/release#82553: Updates the shared tls-scanner-run step used by this job.
• openshift/release#82555: Wires the shared TLS scanner test into another operator’s CI workflow.

Suggested reviewers: stuggi

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Container-Privileges	❌ Error	tls-scanner-run defaults to privileged host mode (privileged:true, hostNetwork:true, hostPID:true, runAsUser:0) and this job doesn’t set TLS_SCANNER_CLUSTER_LABEL.	Switch this job to the restricted pod-mode scanner path or remove the job if privileged host-mode scanning is unintended; otherwise document a justification.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding a TLS scanner job for the SMB csi-operator.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only YAML CI job configs changed; no Ginkgo titles were added, and the new tls-scanner-smb job/test refs are static strings.
Test Structure And Quality	✅ Passed	PR only changes ci-operator YAML/job configs; no Go/Ginkgo test code was added or modified, so the test-structure review is not applicable.
Microshift Test Compatibility	✅ Passed	Config-only CI job additions; no new/changed Ginkgo tests or runtime test code to evaluate for MicroShift compatibility.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only adds ci-operator/job YAML for an existing TLS scanner job; no new Ginkgo test code or SNO-sensitive test logic was introduced.
Topology-Aware Scheduling Compatibility	✅ Passed	Only ci-operator CI config/job YAML changed; no deployment manifests, controllers, or scheduling-affecting code were modified.
Ote Binary Stdout Contract	✅ Passed	PASS: Commit only changes CI YAML; no Go process-level code or stdout setup changed, so the OTE stdout contract is unaffected.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: This PR only adds CI job wiring; the new tls-scanner-smb stanza uses existing internal Azure SMB workflow/refs and adds no new IPv4/public-host assumptions.
No-Weak-Crypto	✅ Passed	Changed files are CI YAML only; scan found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons.
No-Sensitive-Data-In-Logs	✅ Passed	New tls-scanner-smb YAML blocks only set namespace/workflow/env vars; no passwords, tokens, PII, or internal hostnames appear.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[RomanBednar]

/assign @dfajmon

For review.

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@RomanBednar: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-csi-operator-main-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed
pull-ci-openshift-csi-operator-release-4.23-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed
pull-ci-openshift-csi-operator-release-5.0-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed
pull-ci-openshift-csi-operator-release-5.1-tls-scanner-smb	openshift/csi-operator	presubmit	Presubmit changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@RomanBednar: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[dfajmon]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dfajmon, RomanBednar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/csi-operator/OWNERS [RomanBednar,dfajmon]
• ci-operator/jobs/openshift/csi-operator/OWNERS [RomanBednar,dfajmon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[RomanBednar]

/pj-rehearse ack

[openshift-merge-bot]

@RomanBednar: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.