Uploaded image for project: 'OpenShift Windows Containers'
  1. OpenShift Windows Containers
  2. WINC-1586

Add periodic CI job that runs Windows E2E tests on FIPS-enabled clusters

XMLWordPrintable

    • Icon: Story Story
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • None
    • None
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • False
    • None
    • None
    • None
    • WINC - Sprint 284

      *Developer story
      *
      As a Windows Machine Config Operator developer, I want a periodic CI job that runs Windows E2E tests on FIPS-enabled clusters so that I can ensure the operator works correctly in FIPS mode and catch compliance issues early

      *Description
      *
      Introduce a periodic job in the openshift/release repository that:
      Provisions a FIPS-enabled OpenShift cluster
      Runs Windows E2E operator tests against this cluster
      Enforces FIPS compliance checks (SSH key validation, etc.)
      Fails if any FIPS compliance violations are detected

      This will help ensure that Windows nodes and the Windows Machine Config Operator function correctly in FIPS environments

      Required

      Document FIPS requirements for OpenSSH version in BYOH case
      Create a new periodic job configuration in openshift/release repository for Windows E2E tests with FIPS enabled
      Set FIPS_ENABLED=true environment variable in the job configuration
      Ensure the job uses FIPS-compliant SSH keys (RSA ≥2048 bits or ECDSA with NIST P-curves)
      Configure appropriate frequency for the periodic job
      Set up failure notifications to the appropriate team channels

      Engineering Details
      Related files:
      Current test script: ci-operator/step-registry/windows/e2e/operator/test/windows-e2e-operator-test-commands.sh

      FIPS_ENABLED environment variable

      In openshift/release repository:
      Add new periodic job definition in ci-operator/jobs/openshift/windows-machine-config-operator/

      References:
      OpenShift CI documentation: https://docs.ci.openshift.org/
      FIPS 140-2 requirements: RSA ≥2048 bits, ECDSA P-256/P-384/P-521, no ED25519, no DSA

      Acceptance Criteria
      A new periodic job is configured in the openshift/release repository that runs Windows E2E tests with FIPS_ENABLED=true weekly
      The job provisions a FIPS-enabled OpenShift cluster successfully
      Enforces FIPS compliance checks and fails the job if violations are detected
      Job failures trigger appropriate notifications in team channel

              Unassigned Unassigned
              jvaldes@redhat.com Jose Valdes
              None
              None
              None
              None
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: