Enable fips checks and add basic E2E

.tekton/images-mirror-set.yaml

@@ -0,0 +1,58 @@
+---
+apiVersion: operator.openshift.io/v1alpha1
+kind: ImageDigestMirrorSet
+metadata:
+  name: registries
+spec:
+  imageDigestMirrors:
+    - mirrors:
+        - quay.io/securesign/certificate-transparency-go
+      source: registry.redhat.io/rhtas/certificate-transparency-rhel9
+    - mirrors:
+        - quay.io/securesign/client-server
+      source: registry.redhat.io/rhtas/client-server-rhel9
+    - mirrors:
+        - quay.io/securesign/rhtas-operator-bundle
+      source: registry.redhat.io/rhtas/rhtas-operator-bundle
+    - mirrors:
+        - quay.io/securesign/rhtas-operator
+      source: registry.redhat.io/rhtas/rhtas-rhel9-operator
+    - mirrors:
+        - quay.io/securesign/fulcio-server
+      source: registry.redhat.io/rhtas/fulcio-rhel9
+    - mirrors:
+        - quay.io/securesign/rekor-server
+      source: registry.redhat.io/rhtas/rekor-server-rhel9
+    - mirrors:
+        - quay.io/securesign/rekor-backfill-redis
+      source: registry.redhat.io/rhtas/rekor-backfill-redis-rhel9
+    - mirrors:
+        - quay.io/securesign/rekor-search-ui
+      source: registry.redhat.io/rhtas/rekor-search-ui-rhel9
+    - mirrors:
+        - quay.io/securesign/trillian-logserver
+      source: registry.redhat.io/rhtas/trillian-logserver-rhel9
+    - mirrors:
+        - quay.io/securesign/trillian-logsigner
+      source: registry.redhat.io/rhtas/trillian-logsigner-rhel9
+    - mirrors:
+        - quay.io/securesign/trillian-database
+      source: registry.redhat.io/rhtas/trillian-database-rhel9
+    - mirrors:
+        - quay.io/securesign/trillian-redis
+      source: registry.redhat.io/rhtas/trillian-redis-rhel9
+    - mirrors:
+        - quay.io/securesign/trillian-createtree
+      source: registry.redhat.io/rhtas/createtree-rhel9
+    - mirrors:
+        - quay.io/securesign/segment-backup-job
+      source: registry.redhat.io/rhtas/segment-reporting-rhel9
+    - mirrors:
+        - quay.io/securesign/timestamp-authority
+      source: registry.redhat.io/rhtas/timestamp-authority-rhel9
+    - mirrors:
+        - quay.io/securesign/rekor-monitor
+      source: registry.redhat.io/rhtas/rekor-monitor-rhel9
+    - mirrors:
+        - quay.io/securesign/tuffer
+      source: registry.redhat.io/rhtas/tuffer-rhel9

.tekton/rhtas-operator-bundle-pull-request.yaml

@@ -40,9 +40,11 @@ spec:
   - name: image-expires-after
     value: 5d
   - name: manager-pipelinerun-selector
-    value: appstudio.openshift.io/application=operator,appstudio.openshift.io/component=rhtas-operator,pipelinesascode.tekton.dev/sha={{revision}},pipelinesascode.tekton.dev/event-type in (pull_request,incoming)
+    value: appstudio.openshift.io/application=operator,appstudio.openshift.io/component=rhtas-operator,pipelinesascode.tekton.dev/sha={{revision}},pipelinesascode.tekton.dev/event-type in (pull_request,incoming,retest-all-comment)
   - name: manager-registry-url
     value: registry.redhat.io/rhtas/rhtas-rhel9-operator
+  - name: fips-check
+    value: "true"
   pipelineRef:
     params:
     - name: url

.tekton/rhtas-operator-bundle-push.yaml

@@ -37,9 +37,11 @@ spec:
   - name: hermetic
     value: "true"
   - name: manager-pipelinerun-selector
-    value: appstudio.openshift.io/application=operator,appstudio.openshift.io/component=rhtas-operator,pipelinesascode.tekton.dev/sha={{revision}},pipelinesascode.tekton.dev/event-type in (push,incoming)
+    value: appstudio.openshift.io/application=operator,appstudio.openshift.io/component=rhtas-operator,pipelinesascode.tekton.dev/sha={{revision}},pipelinesascode.tekton.dev/event-type in (push,incoming,retest-all-comment)
   - name: manager-registry-url
     value: registry.redhat.io/rhtas/rhtas-rhel9-operator
+  - name: fips-check
+    value: "true"
   pipelineRef:
     params:
     - name: url

.tekton/rhtas-operator-pull-request.yaml

@@ -44,6 +44,8 @@ spec:
     value: '{"type": "gomod", "path": "."}'
   - name: image-expires-after
     value: 5d
+  - name: fips-check
+    value: "true"
   pipelineRef:
     params:
     - name: url

.tekton/rhtas-operator-push.yaml

@@ -41,6 +41,8 @@ spec:
     value: "true"
   - name: prefetch-input
     value: '{"type": "gomod", "path": "."}'
+  - name: fips-check
+    value: "true"
   pipelineRef:
     params:
     - name: url

Dockerfile.rhtas-operator.rh

@@ -52,7 +52,7 @@ LABEL version=$VERSION
 
 LABEL features.operators.openshift.io/cni="false"
 LABEL features.operators.openshift.io/disconnected="true"
-LABEL features.operators.openshift.io/fips-compliant="false"
+LABEL features.operators.openshift.io/fips-compliant="true"
 LABEL features.operators.openshift.io/proxy-aware="true"
 LABEL features.operators.openshift.io/cnf="false"
 LABEL features.operators.openshift.io/csi="false"

bundle.Dockerfile

@@ -55,7 +55,7 @@ LABEL com.redhat.component="rhtas-operator-bundle"
 LABEL name="rhtas/rhtas-operator-bundle"
 LABEL features.operators.openshift.io/cni="false"
 LABEL features.operators.openshift.io/disconnected="true"
-LABEL features.operators.openshift.io/fips-compliant="false"
+LABEL features.operators.openshift.io/fips-compliant="true"
 LABEL features.operators.openshift.io/proxy-aware="false"
 LABEL features.operators.openshift.io/cnf="false"
 LABEL features.operators.openshift.io/csi="false"

config/default/images.env

@@ -2,7 +2,7 @@ RELATED_IMAGE_TRILLIAN_LOG_SIGNER=registry.redhat.io/rhtas/trillian-logsigner-rh
 RELATED_IMAGE_TRILLIAN_LOG_SERVER=registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:9ecb8cbb0e1a1d3043a377992ad1795f01ae7491b04ea8e9914263361fc9d51c
 RELATED_IMAGE_TRILLIAN_DB=registry.redhat.io/rhtas/trillian-database-rhel9@sha256:1295d965ba4f2415742e5b1f858abcac8b03d45708051bc51f28a0e70ce1d417
 RELATED_IMAGE_TRILLIAN_NETCAT=registry.redhat.io/openshift4/ose-tools-rhel9@sha256:47eec19e875c3db11a31ccf4c199ef52cf0d2df3b7c424868f55f9e0d0dd43df
-RELATED_IMAGE_CREATETREE=registry.redhat.io/rhtas/createtree-rhel9@sha256:bcfc0d077428a5587c8f0cbb4e066684db1bceab06476ffcb5017d153d117269
+RELATED_IMAGE_CREATETREE=registry.redhat.io/rhtas/createtree-rhel9@sha256:caebefdc6670bdf70cf1a1a6a52f163c0dafbc47d5788aace6e3b7f6f52c00bf
 RELATED_IMAGE_FULCIO_SERVER=registry.redhat.io/rhtas/fulcio-rhel9@sha256:85f602f5cd1642d687a448f2a819245f477cfd82ab840f9825d0de4d6dba1c24
 RELATED_IMAGE_REKOR_REDIS=registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:e191b4c125faf618a56621e44b8bf272c7ece583ee8a15733b8243d05ffb2c62
 RELATED_IMAGE_REKOR_SERVER=registry.redhat.io/rhtas/rekor-server-rhel9@sha256:af2a7907c2a4578c92622b024cfc7ca0061750b7d2306c032ac8a538695c635c

config/manifests/bases/rhtas-operator.clusterserviceversion.yaml

@@ -9,7 +9,7 @@ metadata:
     features.operators.openshift.io/cni: "false"
     features.operators.openshift.io/csi: "false"
     features.operators.openshift.io/disconnected: "true"
-    features.operators.openshift.io/fips-compliant: "false"
+    features.operators.openshift.io/fips-compliant: "true"
     features.operators.openshift.io/proxy-aware: "true"
     features.operators.openshift.io/tls-profiles: "false"
     features.operators.openshift.io/token-auth-aws: "false"