Add Konflux onboarding and reusable TLS scan pipeline

[richardsonnick]

Summary

Adds konflux/ packaging so:

1. tls-scanner can be onboarded to Konflux (Application / Component / ImageRepository drafts using Dockerfile.local).
2. Layered products can reuse a git-resolved compliance-scan Pipeline from their own IntegrationTestScenario, parameterized by a target-cluster kubeconfig Secret.
3. This repo can self-test Snapshot builds via smoke + TLS-fixture Job pipelines.

These CRs are not auto-applied from git — someone with tenant access must oc apply them. Only the Pipeline YAMLs are fetched at run time via resolverRef.

What's included

Path	Role
konflux/application.yaml / component.yaml	Onboard build (PaC generates .tekton/ separately)
konflux/pipelines/tls-scanner-compliance-scan.yaml	Reusable Job-deploy scan for layered products
konflux/pipelines/tls-scanner-self-test.yaml	Smoke + fixture + Job scan for this repo
konflux/pipelines/tls-scanner-smoke-test.yaml	Light --version / --help check
konflux/integration-test-scenario.yaml	Optional ITS drafts (revision currently feat/konflux-tls-scan)
konflux/README.md	Apply order + consumer instructions

How to exercise this PR in Konflux

1. Fill <TENANT_NAMESPACE> and apply application.yaml → component.yaml → merge Konflux's PaC onboarding PR when it appears.
2. Apply integration-test-scenario.yaml (already points revision at this branch).
3. Open/retest this PR — look for optional integration checks (tls-scanner-self-test, tls-scanner-smoke-test).
4. Before merge: flip ITS revision values back to main and re-apply.

Until step 1–2 happen, GitHub will not show Konflux checks (there is no existing Application/Component for this repo).

Layered-product usage (after merge)

See konflux/README.md — consumers add one ITS pointing at:

konflux/pipelines/tls-scanner-compliance-scan.yaml

with TARGET_KUBECONFIG_SECRET set to their ephemeral env kubeconfig Secret. Pin revision to a tag/commit rather than tracking main unless intentional.

Test plan

• YAML parses (python3 -c yaml.safe_load_all on all konflux/**/*.yaml)
• Tenant admin applies Application + Component; PaC PR appears and merges
• ITS applied with revision: feat/konflux-tls-scan
• PR shows optional Konflux checks; smoke and/or self-test logs visible in Tekton UI
• Confirm TEST_OUTPUT result is written
• Flip ITS revision to main before merge
• (Follow-up) First layered product wires compliance-scan with their kubeconfig Secret

Made with Cursor

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: richardsonnick

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [richardsonnick]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@richardsonnick: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.