Repository: openshift/release
Pull request #64430: SSCSI-97: Add FIPS scanning and E2E in FIPS for SSCSI Driver and Operator
Author: login: chiragkyal
Labels: name: lgtm
description: Indicates that a PR is ready to be merged.
name: approved
description: Indicates a PR has been approved by an approver from all required OWNERS files.
name: rehearsals-ack
description: Signifies that rehearsal jobs have been acknowledged
name: jira/valid-reference
description: Indicates that this PR references a valid Jira ticket of any type.
Created: 2025-05-01T06:44:45Z | Merged: 2025-05-21T05:07:42Z

Add FIPS scanning and E2E in FIPS for SSCSI Driver and Operator

Use `fips-check-image-scan` step for the following images
- secrets-store-csi-driver
- secrets-store-csi-driver-operator
- secrets-store-csi-mustgather

Modify existing E2E jobs to run on FIPS enabled clusters. Include `fips-check-fips-or-die` and `fips-check-node-scan` steps to ensure that the tests are indeed running on a FIPS enabled clusters. 

- operator-e2e-fips
- operator-e2e-vault-fips
- e2e-vault-fips


Diff:
diff --git a/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml b/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml
index 89dc6a822a95a..ea1347101a065 100644
--- a/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml
+++ b/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml
@@ -98,19 +98,31 @@ tests:
   commands: make verify
   container:
     from: src
-- as: operator-e2e
+- as: operator-e2e-fips
   steps:
     cluster_profile: azure4
     dependencies:
       OO_INDEX: ci-index-secrets-store-csi-driver-operator-bundle
       SECRETS_STORE_E2E_PROVIDER_IMAGE: secrets-store-csi-driver-e2eprovider
     env:
+      FIPS_ENABLED: "true"
       OO_CHANNEL: stable
       OO_INSTALL_NAMESPACE: openshift-cluster-csi-drivers
       OO_PACKAGE: secrets-store-csi-driver-operator
       OO_TARGET_NAMESPACES: '!all'
+    test:
+    - ref: fips-check-fips-or-die
+    - ref: fips-check-node-scan
+    - as: test-e2e
+      cli: latest
+      commands: make test-e2e
+      from: src
+      resources:
+        requests:
+          cpu: 50m
+          memory: 100Mi
     workflow: openshift-e2e-azure-csi-secrets-store
-- as: operator-e2e-vault
+- as: operator-e2e-vault-fips
   optional: true
   steps:
     cluster_profile: azure4
@@ -118,10 +130,25 @@ tests:
       OO_INDEX: ci-index-secrets-store-csi-driver-operator-bundle
       SECRETS_STORE_E2E_PROVIDER_IMAGE: secrets-store-csi-driver-e2eprovider
     env:
+      FIPS_ENABLED: "true"
       OO_CHANNEL: stable
       OO_INSTALL_NAMESPACE: openshift-cluster-csi-drivers
       OO_PACKAGE: secrets-store-csi-driver-operator
       OO_TARGET_NAMESPACES: '!all'
+    test:
+    - ref: fips-check-fips-or-die
+    - ref: fips-check-node-scan
+    - as: test-e2e-vault
+      cli: latest
+      commands: |
+        # the test assumes the default namespace is used
+        oc project default
+        make e2e-vault
+      from: secrets-store-csi-driver-test
+      resources:
+        requests:
+          cpu: 50m
+          memory: 100Mi
     workflow: openshift-e2e-azure-csi-secrets-store-vault
 - as: verify-deps
   steps:
@@ -133,6 +160,18 @@ tests:
     env:
       PROJECT_NAME: secrets-store-csi-driver-operator
     workflow: openshift-ci-security
+- as: fips-image-scan-operator
+  steps:
+    dependencies:
+      SCAN_IMAGE: secrets-store-csi-driver-operator
+    test:
+    - ref: fips-check-image-scan
+- as: fips-image-scan-mustgather
+  steps:
+    dependencies:
+      SCAN_IMAGE: secrets-store-csi-mustgather
+    test:
+    - ref: fips-check-image-scan
 zz_generated_metadata:
   branch: main
   org: openshift
diff --git a/ci-operator/config/openshift/secrets-store-csi-driver/openshift-secrets-store-csi-driver-main.yaml b/ci-operator/config/openshift/secrets-store-csi-driver/openshift-secrets-store-csi-driver-main.yaml
index 6aa53f12515ca..62d531a01a49e 100644
--- a/ci-operator/config/openshift/secrets-store-csi-driver/openshift-secrets-store-csi-driver-main.yaml
+++ b/ci-operator/config/openshift/secrets-store-csi-driver/openshift-secrets-store-csi-driver-main.yaml
@@ -67,11 +67,27 @@ tests:
   commands: GOFLAGS="-mod=readonly" make go-test
   container:
     from: src
-- as: e2e-vault
+- as: e2e-vault-fips
   steps:
     cluster_profile: azure4
     dependencies:
       SECRETS_STORE_CSI_DRIVER_IMAGE: secrets-store-csi-driver
+    env:
+      FIPS_ENABLED: "true"
+    test:
+    - ref: fips-check-fips-or-die
+    - ref: fips-check-node-scan
+    - as: test-e2e-vault
+      cli: latest
+      commands: |
+        # the test assumes the default namespace is used
+        oc project default
+        make e2e-vault
+      from: secrets-store-csi-driver-test
+      resources:
+        requests:
+          cpu: 50m
+          memory: 100Mi
     workflow: openshift-e2e-azure-csi-secrets-store-vault-operand
 - as: verify-deps
   steps:
@@ -88,6 +104,12 @@ tests:
     commitchecker --start ${PULL_BASE_SHA:-main}
   container:
     from: commitchecker
+- as: fips-image-scan-driver
+  steps:
+    dependencies:
+      SCAN_IMAGE: secrets-store-csi-driver
+    test:
+    - ref: fips-check-image-scan
 zz_generated_metadata:
   branch: main
   org: openshift
diff --git a/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-presubmits.yaml b/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-presubmits.yaml
index be50e79ace4b9..e7a94ebf5ed0d 100644
--- a/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-presubmits.yaml
+++ b/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-presubmits.yaml
@@ -53,6 +53,126 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )ci-index-secrets-store-csi-driver-operator-bundle,?($|\s.*)
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build02
+    context: ci/prow/fips-image-scan-mustgather
+    decorate: true
+    labels:
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-secrets-store-csi-driver-operator-main-fips-image-scan-mustgather
+    rerun_command: /test fips-image-scan-mustgather
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=fips-image-scan-mustgather
+        command:
+        - ci-operator
+        image: ci-operator:latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )fips-image-scan-mustgather,?($|\s.*)
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build02
+    context: ci/prow/fips-image-scan-operator
+    decorate: true
+    labels:
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-secrets-store-csi-driver-operator-main-fips-image-scan-operator
+    rerun_command: /test fips-image-scan-operator
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=fips-image-scan-operator
+        command:
+        - ci-operator
+        image: ci-operator:latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )fips-image-scan-operator,?($|\s.*)
   - agent: kubernetes
     always_run: true
     branches:
@@ -113,15 +233,15 @@ presubmits:
     - ^main$
     - ^main-
     cluster: build02
-    context: ci/prow/operator-e2e
+    context: ci/prow/operator-e2e-fips
     decorate: true
     labels:
       ci-operator.openshift.io/cloud: azure4
       ci-operator.openshift.io/cloud-cluster-profile: azure4
       ci.openshift.io/generator: prowgen
       pj-rehearse.openshift.io/can-be-rehearsed: "true"
-    name: pull-ci-openshift-secrets-store-csi-driver-operator-main-operator-e2e
-    rerun_command: /test operator-e2e
+    name: pull-ci-openshift-secrets-store-csi-driver-operator-main-operator-e2e-fips
+    rerun_command: /test operator-e2e-fips
     spec:
       containers:
       - args:
@@ -130,7 +250,7 @@ presubmits:
         - --lease-server-credentials-file=/etc/boskos/credentials
         - --report-credentials-file=/etc/report/credentials
         - --secret-dir=/secrets/ci-pull-credentials
-        - --target=operator-e2e
+        - --target=operator-e2e-fips
         command:
         - ci-operator
         image: ci-operator:latest
@@ -178,23 +298,23 @@ presubmits:
       - name: result-aggregator
         secret:
           secretName: result-aggregator
-    trigger: (?m)^/test( | .* )operator-e2e,?($|\s.*)
+    trigger: (?m)^/test( | .* )operator-e2e-fips,?($|\s.*)
   - agent: kubernetes
     always_run: true
     branches:
     - ^main$
     - ^main-
     cluster: build02
-    context: ci/prow/operator-e2e-vault
+    context: ci/prow/operator-e2e-vault-fips
     decorate: true
     labels:
       ci-operator.openshift.io/cloud: azure4
       ci-operator.openshift.io/cloud-cluster-profile: azure4
       ci.openshift.io/generator: prowgen
       pj-rehearse.openshift.io/can-be-rehearsed: "true"
-    name: pull-ci-openshift-secrets-store-csi-driver-operator-main-operator-e2e-vault
+    name: pull-ci-openshift-secrets-store-csi-driver-operator-main-operator-e2e-vault-fips
     optional: true
-    rerun_command: /test operator-e2e-vault
+    rerun_command: /test operator-e2e-vault-fips
     spec:
       containers:
       - args:
@@ -203,7 +323,7 @@ presubmits:
         - --lease-server-credentials-file=/etc/boskos/credentials
         - --report-credentials-file=/etc/report/credentials
         - --secret-dir=/secrets/ci-pull-credentials
-        - --target=operator-e2e-vault
+        - --target=operator-e2e-vault-fips
         command:
         - ci-operator
         image: ci-operator:latest
@@ -251,7 +371,7 @@ presubmits:
       - name: result-aggregator
         secret:
           secretName: result-aggregator
-    trigger: (?m)^/test( | .* )operator-e2e-vault,?($|\s.*)
+    trigger: (?m)^/test( | .* )operator-e2e-vault-fips,?($|\s.*)
   - agent: kubernetes
     always_run: true
     branches:
diff --git a/ci-operator/jobs/openshift/secrets-store-csi-driver/openshift-secrets-store-csi-driver-main-presubmits.yaml b/ci-operator/jobs/openshift/secrets-store-csi-driver/openshift-secrets-store-csi-driver-main-presubmits.yaml
index 88c67d88a6d25..1fad03e2bdab2 100644
--- a/ci-operator/jobs/openshift/secrets-store-csi-driver/openshift-secrets-store-csi-driver-main-presubmits.yaml
+++ b/ci-operator/jobs/openshift/secrets-store-csi-driver/openshift-secrets-store-csi-driver-main-presubmits.yaml
@@ -6,16 +6,16 @@ presubmits:
     - ^main$
     - ^main-
     cluster: build07
-    context: ci/prow/e2e-vault
+    context: ci/prow/e2e-vault-fips
     decorate: true
     labels:
       ci-operator.openshift.io/cloud: azure4
       ci-operator.openshift.io/cloud-cluster-profile: azure4
       ci.openshift.io/generator: prowgen
       pj-rehearse.openshift.io/can-be-rehearsed: "true"
-    name: pull-ci-openshift-secrets-store-csi-driver-main-e2e-vault
+    name: pull-ci-openshift-secrets-store-csi-driver-main-e2e-vault-fips
     path_alias: sigs.k8s.io/secrets-store-csi-driver
-    rerun_command: /test e2e-vault
+    rerun_command: /test e2e-vault-fips
     spec:
       containers:
       - args:
@@ -24,7 +24,7 @@ presubmits:
         - --lease-server-credentials-file=/etc/boskos/credentials
         - --report-credentials-file=/etc/report/credentials
         - --secret-dir=/secrets/ci-pull-credentials
-        - --target=e2e-vault
+        - --target=e2e-vault-fips
         command:
         - ci-operator
         image: ci-operator:latest
@@ -72,7 +72,68 @@ presubmits:
       - name: result-aggregator
         secret:
           secretName: result-aggregator
-    trigger: (?m)^/test( | .* )e2e-vault,?($|\s.*)
+    trigger: (?m)^/test( | .* )e2e-vault-fips,?($|\s.*)
+  - agent: kubernetes
+    always_run: true
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build07
+    context: ci/prow/fips-image-scan-driver
+    decorate: true
+    labels:
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-secrets-store-csi-driver-main-fips-image-scan-driver
+    path_alias: sigs.k8s.io/secrets-store-csi-driver
+    rerun_command: /test fips-image-scan-driver
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=fips-image-scan-driver
+        command:
+        - ci-operator
+        image: ci-operator:latest
+        imagePullPolicy: Always
+        name: ""
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )fips-image-scan-driver,?($|\s.*)
   - agent: kubernetes
     always_run: true
     branches:


Reviews:
user: login: arkadeepsen
body: I have one comment regarding the image scan tests.
Also, do we need to add `-fips` to the name of the e2e tests though I understand the intent of it.
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-05-15T16:30:39Z
user: login: chiragkyal
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-05-15T17:17:11Z
user: login: chiragkyal
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-05-19T06:17:20Z
user: login: chiragkyal
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-05-19T06:17:37Z
user: login: chiragkyal
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-05-19T06:17:54Z

Review comments:
diff_hunk: @@ -133,6 +141,18 @@ tests:
     env:
       PROJECT_NAME: secrets-store-csi-driver-operator
     workflow: openshift-ci-security
+- as: fips-image-scan-operator
+  steps:
+    dependencies:
+      SCAN_IMAGE: secrets-store-csi-driver-operator
+    test:
+    - ref: fips-check-image-scan
+- as: fips-image-scan-mustgather
+  steps:
+    dependencies:
+      SCAN_IMAGE: secrets-store-csi-mustgather
+    test:
+    - ref: fips-check-image-scan
path: ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml
user: login: arkadeepsen
body: Can these 2 tests be clubbed into a single one?
created_at: 2025-05-15T16:28:52Z
author_association: MEMBER
diff_hunk: @@ -133,6 +141,18 @@ tests:
     env:
       PROJECT_NAME: secrets-store-csi-driver-operator
     workflow: openshift-ci-security
+- as: fips-image-scan-operator
+  steps:
+    dependencies:
+      SCAN_IMAGE: secrets-store-csi-driver-operator
+    test:
+    - ref: fips-check-image-scan
+- as: fips-image-scan-mustgather
+  steps:
+    dependencies:
+      SCAN_IMAGE: secrets-store-csi-mustgather
+    test:
+    - ref: fips-check-image-scan
path: ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml
user: login: chiragkyal
body: `fips-check-image-scan` can take only one image at a time, so I think we need to keep them separate
created_at: 2025-05-15T17:17:11Z
author_association: MEMBER
diff_hunk: @@ -98,30 +98,57 @@ tests:
   commands: make verify
   container:
     from: src
-- as: operator-e2e
+- as: operator-e2e-fips
   steps:
     cluster_profile: azure4
     dependencies:
       OO_INDEX: ci-index-secrets-store-csi-driver-operator-bundle
       SECRETS_STORE_E2E_PROVIDER_IMAGE: secrets-store-csi-driver-e2eprovider
     env:
+      FIPS_ENABLED: "true"
       OO_CHANNEL: stable
       OO_INSTALL_NAMESPACE: openshift-cluster-csi-drivers
       OO_PACKAGE: secrets-store-csi-driver-operator
       OO_TARGET_NAMESPACES: '!all'
+    test:
+    - ref: fips-check-fips-or-die
+    - ref: fips-check-node-scan
+    - as: test-e2e
+      cli: latest
+      commands: make test-e2e
+      from: src
+      resources:
+        requests:
+          cpu: 50m
+          memory: 100Mi
path: ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml
user: login: chiragkyal
body: We need to copy `test-e2e` target from the workflow to the ci-operator configuration to avoid override.

In cases where both the workflow and a ci-operator configuration
specify the same field (e.g test), the ci-operator configuration's field has priority.

- https://docs.ci.openshift.org/docs/architecture/step-registry/#ci-operator-test-configuration
- https://docs.ci.openshift.org/docs/architecture/step-registry/#hierarchical-propagation

created_at: 2025-05-19T06:17:20Z
author_association: MEMBER
diff_hunk: @@ -98,30 +98,57 @@ tests:
   commands: make verify
   container:
     from: src
-- as: operator-e2e
+- as: operator-e2e-fips
   steps:
     cluster_profile: azure4
     dependencies:
       OO_INDEX: ci-index-secrets-store-csi-driver-operator-bundle
       SECRETS_STORE_E2E_PROVIDER_IMAGE: secrets-store-csi-driver-e2eprovider
     env:
+      FIPS_ENABLED: "true"
       OO_CHANNEL: stable
       OO_INSTALL_NAMESPACE: openshift-cluster-csi-drivers
       OO_PACKAGE: secrets-store-csi-driver-operator
       OO_TARGET_NAMESPACES: '!all'
+    test:
+    - ref: fips-check-fips-or-die
+    - ref: fips-check-node-scan
+    - as: test-e2e
+      cli: latest
+      commands: make test-e2e
+      from: src
+      resources:
+        requests:
+          cpu: 50m
+          memory: 100Mi
     workflow: openshift-e2e-azure-csi-secrets-store
-- as: operator-e2e-vault
+- as: operator-e2e-vault-fips
   optional: true
   steps:
     cluster_profile: azure4
     dependencies:
       OO_INDEX: ci-index-secrets-store-csi-driver-operator-bundle
       SECRETS_STORE_E2E_PROVIDER_IMAGE: secrets-store-csi-driver-e2eprovider
     env:
+      FIPS_ENABLED: "true"
       OO_CHANNEL: stable
       OO_INSTALL_NAMESPACE: openshift-cluster-csi-drivers
       OO_PACKAGE: secrets-store-csi-driver-operator
       OO_TARGET_NAMESPACES: '!all'
+    test:
+    - ref: fips-check-fips-or-die
+    - ref: fips-check-node-scan
+    - as: test-e2e-vault
+      cli: latest
+      commands: |
+        # the test assumes the default namespace is used
+        oc project default
+        make e2e-vault
+      from: secrets-store-csi-driver-test
+      resources:
+        requests:
+          cpu: 50m
+          memory: 100Mi
path: ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml
user: login: chiragkyal
body: Same as https://github.com/openshift/release/pull/64430/files#r2094914672
created_at: 2025-05-19T06:17:37Z
author_association: MEMBER
diff_hunk: @@ -67,11 +67,27 @@ tests:
   commands: GOFLAGS="-mod=readonly" make go-test
   container:
     from: src
-- as: e2e-vault
+- as: e2e-vault-fips
   steps:
     cluster_profile: azure4
     dependencies:
       SECRETS_STORE_CSI_DRIVER_IMAGE: secrets-store-csi-driver
+    env:
+      FIPS_ENABLED: "true"
+    test:
+    - ref: fips-check-fips-or-die
+    - ref: fips-check-node-scan
+    - as: test-e2e-vault
+      cli: latest
+      commands: |
+        # the test assumes the default namespace is used
+        oc project default
+        make e2e-vault
+      from: secrets-store-csi-driver-test
+      resources:
+        requests:
+          cpu: 50m
+          memory: 100Mi
path: ci-operator/config/openshift/secrets-store-csi-driver/openshift-secrets-store-csi-driver-main.yaml
user: login: chiragkyal
body: Same as https://github.com/openshift/release/pull/64430/files#r2094914672
created_at: 2025-05-19T06:17:54Z
author_association: MEMBER

PR comments:
user: login: openshift-ci[bot]
created_at: 2025-05-01T06:44:49Z
body: Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with `/test all`
author_association: CONTRIBUTOR
user: login: chiragkyal
created_at: 2025-05-01T06:46:26Z
body: /pj-rehearse
author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-05-01T06:46:29Z
body: @chiragkyal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.
author_association: CONTRIBUTOR
user: login: chiragkyal
created_at: 2025-05-05T12:29:28Z
body: 
/pj-rehearse


author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-05-05T12:29:30Z
body: @chiragkyal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.
author_association: CONTRIBUTOR
user: login: chiragkyal
created_at: 2025-05-12T17:41:58Z
body: 
/pj-rehearse


author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-05-12T17:42:00Z
body: @chiragkyal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.
author_association: CONTRIBUTOR
user: login: chiragkyal
created_at: 2025-05-13T05:57:07Z
body: /pj-rehearse pull-ci-openshift-secrets-store-csi-driver-operator-main-operator-e2e-vault-fips
author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-05-13T05:57:10Z
body: @chiragkyal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.
author_association: CONTRIBUTOR
user: login: chiragkyal
created_at: 2025-05-13T13:17:39Z
body: 
/pj-rehearse


author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-05-13T13:17:43Z
body: @chiragkyal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.
author_association: CONTRIBUTOR
user: login: chiragkyal
created_at: 2025-05-13T13:46:55Z
body: /pj-rehearse pull-ci-openshift-secrets-store-csi-driver-operator-main-operator-e2e-vault-fips
author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-05-13T13:46:58Z
body: @chiragkyal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.
author_association: CONTRIBUTOR
user: login: openshift-ci-robot
created_at: 2025-05-14T05:18:59Z
body: @chiragkyal: This pull request references [SSCSI-97](https://issues.redhat.com//browse/SSCSI-97) which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

<details>

In response to [this](https://github.com/openshift/release/pull/64430):

>Add FIPS scanning and E2E in FIPS for SSCSI Driver and Operator
>
>Use `fips-check-image-scan` step for the following images
>- secrets-store-csi-driver
>- secrets-store-csi-driver-operator
>- secrets-store-csi-mustgather
>
>Add new E2E jobs which will run on FIPS enabled clusters. Include `fips-check-fips-or-die` and `fips-check-node-scan` steps to ensure that the tests are indeed running on a FIPS enabled clusters. 
>
>- operator-e2e-fips
>- operator-e2e-vault-fips
>- e2e-vault-fips


Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Frelease).  If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
</details>
author_association: CONTRIBUTOR
user: login: arkadeepsen
created_at: 2025-05-14T13:37:58Z
body: @chiragkyal do we need both the fips and non fips e2e tests?
author_association: MEMBER
user: login: chiragkyal
created_at: 2025-05-14T13:40:56Z
body: > @chiragkyal do we need both the fips and non fips e2e tests?

I think ideally we should have both; it would confirm that our component works in both environments. 
author_association: MEMBER
user: login: arkadeepsen
created_at: 2025-05-14T14:51:32Z
body: > > @chiragkyal do we need both the fips and non fips e2e tests?
> 
> I think ideally we should have both; it would confirm that our component works in both environments.

I think we are interested only in fips compliance. Whether it works in non-fips environment or not should not matter to us, right? 
author_association: MEMBER
user: login: chiragkyal
created_at: 2025-05-14T16:40:41Z
body: > > > @chiragkyal do we need both the fips and non fips e2e tests?
> 
> > 
> 
> > I think ideally we should have both; it would confirm that our component works in both environments.
> 
> 
> 
> I think we are interested only in fips compliance. Whether it works in non-fips environment or not should not matter to us, right? 

Not sure if I have understood it correctly. We already have e2e jobs running on non-fips cluster and through this PR we are adding jobs which will run on fips cluster. I think we care for both the scenarios.

Are you suggesting to have any one of them? If yes, which one would it be? 
author_association: MEMBER
user: login: arkadeepsen
created_at: 2025-05-15T10:41:38Z
body: > > > > @chiragkyal do we need both the fips and non fips e2e tests?
> > 
> > 
> > > 
> > 
> > 
> > > I think ideally we should have both; it would confirm that our component works in both environments.
> > 
> > 
> > I think we are interested only in fips compliance. Whether it works in non-fips environment or not should not matter to us, right?
> 
> Not sure if I have understood it correctly. We already have e2e jobs running on non-fips cluster and through this PR we are adding jobs which will run on fips cluster. I think we care for both the scenarios.
> 
> Are you suggesting to have any one of them? If yes, which one would it be?

The FIPS configuration can be added to the existing e2e tests. Adding another CI job for the same test is redundant, IMO.
author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-05-15T12:09:57Z
body: @chiragkyal: This pull request references [SSCSI-97](https://issues.redhat.com//browse/SSCSI-97) which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

<details>

In response to [this](https://github.com/openshift/release/pull/64430):

>Add FIPS scanning and E2E in FIPS for SSCSI Driver and Operator
>
>Use `fips-check-image-scan` step for the following images
>- secrets-store-csi-driver
>- secrets-store-csi-driver-operator
>- secrets-store-csi-mustgather
>
>Modify existing E2E jobs to run on FIPS enabled clusters. Include `fips-check-fips-or-die` and `fips-check-node-scan` steps to ensure that the tests are indeed running on a FIPS enabled clusters. 
>
>- operator-e2e-fips
>- operator-e2e-vault-fips
>- e2e-vault-fips


Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Frelease).  If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
</details>
author_association: CONTRIBUTOR
user: login: chiragkyal
created_at: 2025-05-15T12:10:16Z
body: 
/pj-rehearse


author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-05-15T12:10:18Z
body: @chiragkyal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.
author_association: CONTRIBUTOR
user: login: chiragkyal
created_at: 2025-05-15T17:39:17Z
body: The intention of 
```
- ref: fips-check-fips-or-die
- ref: fips-check-node-scan
```
are to pre-check the FIPS cluster for any possible issues; and we should add them prior to the actual e2e tests to fail early, and avoid unnecessary e2e runs. For SSCSI, the `make e2e` targets are present inside the workflows. 
In my [previous  changes](https://github.com/openshift/release/compare/b8ed83d2cbc6e9ad1b823057a22b20a21aba78e0..8979436700985960bc8db33cd45b6786b663291b), I kept the checks outside the workflow, but that would cause them to run after the actual e2e.

Now if I am moving them inside the workflow; it's impacting all of the previous releases since we share the same workflow across releases (4.14 - 4.20), and I don't think we were/want to claim FIPS compliant from 4.14. 

I have to revert the changes and move the checks out of the workflow. 
author_association: MEMBER
user: login: chiragkyal
created_at: 2025-05-16T07:05:39Z
body: 
/pj-rehearse


author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-05-16T07:05:42Z
body: @chiragkyal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.
author_association: CONTRIBUTOR
user: login: chiragkyal
created_at: 2025-05-16T07:21:15Z
body: /pj-rehearse pull-ci-openshift-secrets-store-csi-driver-operator-main-operator-e2e-vault-fips
author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-05-16T07:21:19Z
body: @chiragkyal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.
author_association: CONTRIBUTOR
user: login: chiragkyal
created_at: 2025-05-16T09:45:20Z
body: /pj-rehearse pull-ci-openshift-secrets-store-csi-driver-main-e2e-vault-fips
author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-05-16T09:45:23Z
body: @chiragkyal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.
author_association: CONTRIBUTOR
user: login: chiragkyal
created_at: 2025-05-16T10:55:06Z
body: /pj-rehearse pull-ci-openshift-secrets-store-csi-driver-operator-main-operator-e2e-vault-fips
author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-05-16T10:55:09Z
body: @chiragkyal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.
author_association: CONTRIBUTOR
user: login: chiragkyal
created_at: 2025-05-16T12:57:52Z
body: 
/pj-rehearse


author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-05-16T12:57:56Z
body: @chiragkyal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.
author_association: CONTRIBUTOR
user: login: chiragkyal
created_at: 2025-05-16T13:35:10Z
body: 
/pj-rehearse


author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-05-16T13:35:14Z
body: @chiragkyal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.
author_association: CONTRIBUTOR
user: login: chiragkyal
created_at: 2025-05-16T13:39:48Z
body: 
/pj-rehearse pull-ci-openshift-secrets-store-csi-driver-operator-main-operator-e2e-vault-fips


author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-05-16T13:39:51Z
body: @chiragkyal: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.
author_association: CONTRIBUTOR
user: login: arkadeepsen
created_at: 2025-05-19T08:51:33Z
body: /lgtm
/hold
for @mytreya-rh to take a final look
author_association: MEMBER
user: login: mytreya-rh
created_at: 2025-05-21T04:04:04Z
body: /lgtm
author_association: CONTRIBUTOR
user: login: openshift-ci[bot]
created_at: 2025-05-21T04:04:29Z
body: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/openshift/release/pull/64430#issuecomment-2890183580" title="LGTM">arkadeepsen</a>*, *<a href="https://github.com/openshift/release/pull/64430#" title="Author self-approved">chiragkyal</a>*, *<a href="https://github.com/openshift/release/pull/64430#issuecomment-2896491566" title="LGTM">mytreya-rh</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=openshift%2Frelease).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[ci-operator/config/openshift/secrets-store-csi-driver/OWNERS](https://github.com/openshift/release/blob/master/ci-operator/config/openshift/secrets-store-csi-driver/OWNERS)~~ [arkadeepsen,mytreya-rh]
- ~~[ci-operator/config/openshift/secrets-store-csi-driver-operator/OWNERS](https://github.com/openshift/release/blob/master/ci-operator/config/openshift/secrets-store-csi-driver-operator/OWNERS)~~ [arkadeepsen,mytreya-rh]
- ~~[ci-operator/jobs/openshift/secrets-store-csi-driver/OWNERS](https://github.com/openshift/release/blob/master/ci-operator/jobs/openshift/secrets-store-csi-driver/OWNERS)~~ [arkadeepsen,mytreya-rh]
- ~~[ci-operator/jobs/openshift/secrets-store-csi-driver-operator/OWNERS](https://github.com/openshift/release/blob/master/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/OWNERS)~~ [arkadeepsen,mytreya-rh]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
author_association: CONTRIBUTOR
user: login: arkadeepsen
created_at: 2025-05-21T04:27:00Z
body: /hold cancel
author_association: MEMBER
user: login: arkadeepsen
created_at: 2025-05-21T04:44:16Z
body: /pj-rehearse ack
author_association: MEMBER
user: login: openshift-ci-robot
created_at: 2025-05-21T04:44:19Z
body: @arkadeepsen: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.
author_association: CONTRIBUTOR
user: login: openshift-ci[bot]
created_at: 2025-05-21T05:03:52Z
body: @chiragkyal: all tests **passed!**


[Full PR test history](https://prow.ci.openshift.org/pr-history?org=openshift&repo=release&pr=64430). [Your PR dashboard](https://prow.ci.openshift.org/pr?query=is:pr+state:open+author:chiragkyal).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
author_association: CONTRIBUTOR