Add support for fips e2e #324
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Reviewer's GuideAdds FIPS-enabled end-to-end integration test scenarios for multiple OCP versions and updates the operator e2e pipeline and supporting stepactions to handle FIPS mode and a configurable Keycloak distribution (rhsso vs rhbk) with correct OIDC issuer URLs. Sequence diagram for FIPS-enabled operator e2e pipeline trigger and executionsequenceDiagram
actor Developer
participant AppStudio
participant IntegrationService
participant IntegrationTestScenario_v4_19_e2e_fips
participant GitResolver
participant RhtasOperatorE2EPipeline
participant StepActionInstallKeycloak
participant StepActionInstallTAS
participant OCPCluster
participant Keycloak
Developer->>AppStudio: Push change to component_rhtas_operator_v4_19
AppStudio->>IntegrationService: Create Snapshot for component update
IntegrationService->>IntegrationTestScenario_v4_19_e2e_fips: Match context component_rhtas_operator_v4_19
IntegrationTestScenario_v4_19_e2e_fips-->>IntegrationService: Params OCP_VERSION=4.19 FIPS_ENABLED=true KEYCLOAK_DISTRIBUTION=rhbk
IntegrationService->>GitResolver: Resolve pipelines rhtas-operator-e2e.yaml
GitResolver-->>IntegrationService: Tekton Pipeline definition
IntegrationService->>RhtasOperatorE2EPipeline: Create PipelineRun with params including FIPS_ENABLED and KEYCLOAK_DISTRIBUTION
RhtasOperatorE2EPipeline->>StepActionInstallKeycloak: Execute install-keycloak with FIPS_ENABLED KEYCLOAK_DISTRIBUTION
StepActionInstallKeycloak->>Keycloak: Deploy Keycloak in requested distribution
StepActionInstallKeycloak->>Keycloak: Configure OIDC issuer URL based on distribution
StepActionInstallKeycloak->>Keycloak: Apply FIPS mode settings when FIPS_ENABLED=true
Keycloak-->>StepActionInstallKeycloak: Ready with correct issuer and FIPS configuration
RhtasOperatorE2EPipeline->>StepActionInstallTAS: Execute install-tas with FIPS_ENABLED
StepActionInstallTAS->>OCPCluster: Deploy TAS components with FIPS configuration
OCPCluster-->>StepActionInstallTAS: TAS ready
RhtasOperatorE2EPipeline->>OCPCluster: Run end_to_end_tests
OCPCluster-->>RhtasOperatorE2EPipeline: Test results
RhtasOperatorE2EPipeline-->>IntegrationService: Report PipelineRun status
IntegrationService-->>AppStudio: Integration test result for Snapshot
AppStudio-->>Developer: Surface FIPS e2e test outcome
Flow diagram for Keycloak distribution and FIPS configuration in e2e pipelineflowchart TD
Start[Start PipelineRun with params\nFIPS_ENABLED and KEYCLOAK_DISTRIBUTION]
Start --> CheckDistribution
CheckDistribution{KEYCLOAK_DISTRIBUTION value}
CheckDistribution -->|rhbk| UseRHBK
CheckDistribution -->|rhsso| UseRHSSO
CheckDistribution -->|other| FailInvalidDistribution
UseRHBK[Install rhbk Keycloak\nSet OIDC issuer URL for rhbk]
UseRHSSO[Install rhsso Keycloak\nSet OIDC issuer URL for rhsso]
FailInvalidDistribution[Fail pipeline\nUnsupported Keycloak distribution]
UseRHBK --> CheckFIPS
UseRHSSO --> CheckFIPS
CheckFIPS{FIPS_ENABLED}
CheckFIPS -->|true| EnableFIPS
CheckFIPS -->|false| SkipFIPS
EnableFIPS[Configure Keycloak and TAS components\nwith FIPS compatible settings]
SkipFIPS[Proceed without FIPS specific configuration]
EnableFIPS --> ContinueTests
SkipFIPS --> ContinueTests
ContinueTests[Run end to end tests against OCP cluster]
ContinueTests --> End[Report e2e result back to IntegrationService]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes - here's some feedback:
- The new FIPS
IntegrationTestScenarioresources for each OCP version (4.16–4.20 and overlay) are almost identical; consider refactoring them into a shared template/patch (e.g., using kustomize overlays or templating) to reduce duplication and ease future maintenance. - You are modeling
FIPS_ENABLEDas a string parameter throughout and then comparing it textually in bash ([[ "$FIPS_ENABLED" == "true" ]]); if possible, switching this to a boolean Tekton param (and/or normalizing the accepted values in the script) would make the behavior less error-prone.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The new FIPS `IntegrationTestScenario` resources for each OCP version (4.16–4.20 and overlay) are almost identical; consider refactoring them into a shared template/patch (e.g., using kustomize overlays or templating) to reduce duplication and ease future maintenance.
- You are modeling `FIPS_ENABLED` as a string parameter throughout and then comparing it textually in bash (`[[ "$FIPS_ENABLED" == "true" ]]`); if possible, switching this to a boolean Tekton param (and/or normalizing the accepted values in the script) would make the behavior less error-prone.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Configuration Diff2 document(s) impacted: + 0 added
- 0 removed
! 2 modifiedDiff@@ spec.resources @@
# projctl.konflux.dev/v1beta1/ProjectDevelopmentStreamTemplate/rhtas-tenant/operator-template
! + one list entry added:
+ - apiVersion: appstudio.redhat.com/v1beta2
+ kind: IntegrationTestScenario
+ metadata:
+ name: rhtas-operator-e2e-test{{.nameSuffix}}-fips
+ labels:
+ test.appstudio.openshift.io/optional: "true"
+ spec:
+ application: {{.application}}{{.nameSuffix}}
+ contexts:
+ - name: group
+ description: "runs the integration test for a group Snapshot"
+ params:
+ - name: FIPS_ENABLED
+ value: "true"
+ - name: KEYCLOAK_DISTRIBUTION
+ value: rhbk
+ resolverRef:
+ params:
+ - name: url
+ value: "https://github.com/securesign/pipelines.git"
+ - name: revision
+ value: main
+ - name: pathInRepo
+ value: pipelines/integration-test/rhtas-operator-e2e.yaml
+ resolver: git
+ resourceKind: pipelinerun
@@ spec.resources @@
# projctl.konflux.dev/v1beta1/ProjectDevelopmentStreamTemplate/rhtas-tenant/rhtas-fbc-template
! + five list entries added:
+ - apiVersion: appstudio.redhat.com/v1beta2
+ kind: IntegrationTestScenario
+ metadata:
+ name: {{.application}}{{.nameSuffix}}-v4-16-e2e-fips
+ labels:
+ test.appstudio.openshift.io/optional: "true"
+ spec:
+ application: {{.application}}{{.nameSuffix}}
+ contexts:
+ - name: component_{{.application}}{{.nameSuffix}}-v4-16
+ description: "execute the integration test when component {{.application}}{{.nameSuffix}}-v4-16 updates"
+ params:
+ - name: OCP_VERSION
+ value: 4.16
+ - name: FIPS_ENABLED
+ value: "true"
+ - name: KEYCLOAK_DISTRIBUTION
+ value: rhbk
+ resolverRef:
+ params:
+ - name: url
+ value: "https://github.com/securesign/pipelines.git"
+ - name: revision
+ value: main
+ - name: pathInRepo
+ value: pipelines/rhtas-operator-e2e.yaml
+ resolver: git
+ resourceKind: pipeline
+ - apiVersion: appstudio.redhat.com/v1beta2
+ kind: IntegrationTestScenario
+ metadata:
+ name: {{.application}}{{.nameSuffix}}-v4-17-e2e-fips
+ labels:
+ test.appstudio.openshift.io/optional: "true"
+ spec:
+ application: {{.application}}{{.nameSuffix}}
+ contexts:
+ - name: component_{{.application}}{{.nameSuffix}}-v4-17
+ description: "execute the integration test when component {{.application}}{{.nameSuffix}}-v4-17 updates"
+ params:
+ - name: OCP_VERSION
+ value: 4.17
+ - name: FIPS_ENABLED
+ value: "true"
+ - name: KEYCLOAK_DISTRIBUTION
+ value: rhbk
+ resolverRef:
+ params:
+ - name: url
+ value: "https://github.com/securesign/pipelines.git"
+ - name: revision
+ value: main
+ - name: pathInRepo
+ value: pipelines/rhtas-operator-e2e.yaml
+ resolver: git
+ resourceKind: pipeline
+ - apiVersion: appstudio.redhat.com/v1beta2
+ kind: IntegrationTestScenario
+ metadata:
+ name: {{.application}}{{.nameSuffix}}-v4-18-e2e-fips
+ labels:
+ test.appstudio.openshift.io/optional: "true"
+ spec:
+ application: {{.application}}{{.nameSuffix}}
+ contexts:
+ - name: component_{{.application}}{{.nameSuffix}}-v4-18
+ description: "execute the integration test when component {{.application}}{{.nameSuffix}}-v4-18 updates"
+ params:
+ - name: OCP_VERSION
+ value: 4.18
+ - name: FIPS_ENABLED
+ value: "true"
+ - name: KEYCLOAK_DISTRIBUTION
+ value: rhbk
+ resolverRef:
+ params:
+ - name: url
+ value: "https://github.com/securesign/pipelines.git"
+ - name: revision
+ value: main
+ - name: pathInRepo
+ value: pipelines/rhtas-operator-e2e.yaml
+ resolver: git
+ resourceKind: pipeline
+ - apiVersion: appstudio.redhat.com/v1beta2
+ kind: IntegrationTestScenario
+ metadata:
+ name: {{.application}}{{.nameSuffix}}-v4-19-e2e-fips
+ labels:
+ test.appstudio.openshift.io/optional: "true"
+ spec:
+ application: {{.application}}{{.nameSuffix}}
+ contexts:
+ - name: component_{{.application}}{{.nameSuffix}}-v4-19
+ description: "execute the integration test when component {{.application}}{{.nameSuffix}}-v4-19 updates"
+ params:
+ - name: OCP_VERSION
+ value: 4.19
+ - name: FIPS_ENABLED
+ value: "true"
+ - name: KEYCLOAK_DISTRIBUTION
+ value: rhbk
+ resolverRef:
+ params:
+ - name: url
+ value: "https://github.com/securesign/pipelines.git"
+ - name: revision
+ value: main
+ - name: pathInRepo
+ value: pipelines/rhtas-operator-e2e.yaml
+ resolver: git
+ resourceKind: pipeline
+ - apiVersion: appstudio.redhat.com/v1beta2
+ kind: IntegrationTestScenario
+ metadata:
+ name: {{.application}}{{.nameSuffix}}-v4-20-e2e-fips
+ labels:
+ test.appstudio.openshift.io/optional: "true"
+ spec:
+ application: {{.application}}{{.nameSuffix}}
+ contexts:
+ - name: component_{{.application}}{{.nameSuffix}}-v4-20
+ description: "execute the integration test when component {{.application}}{{.nameSuffix}}-v4-20 updates"
+ params:
+ - name: OCP_VERSION
+ value: 4.20
+ - name: FIPS_ENABLED
+ value: "true"
+ - name: KEYCLOAK_DISTRIBUTION
+ value: rhbk
+ resolverRef:
+ params:
+ - name: url
+ value: "https://github.com/securesign/pipelines.git"
+ - name: revision
+ value: main
+ - name: pathInRepo
+ value: pipelines/rhtas-operator-e2e.yaml
+ resolver: git
+ resourceKind: pipeline📦 Artifacts: base-output.yaml, head-output.yaml, dyff-output.txt |
osmman
approved these changes
Dec 1, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary by Sourcery
Add optional FIPS-enabled end-to-end integration test scenarios across supported OCP versions and extend the operator e2e pipeline to parameterize FIPS mode and Keycloak distribution while wiring through issuer URL handling.
New Features:
Enhancements: