{"id":45440538,"url":"https://github.com/redhat-best-practices-for-k8s/certsuite-operator","last_synced_at":"2026-02-22T03:43:29.254Z","repository":{"id":197835194,"uuid":"643156663","full_name":"redhat-best-practices-for-k8s/certsuite-operator","owner":"redhat-best-practices-for-k8s","description":"Certification Suite Operator","archived":false,"fork":false,"pushed_at":"2026-02-04T16:22:10.000Z","size":909,"stargazers_count":0,"open_issues_count":3,"forks_count":4,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-02-05T00:17:35.693Z","etag":null,"topics":["certification","cnf","openshift"],"latest_commit_sha":null,"homepage":"https://github.com/redhat-best-practices-for-k8s/certsuite-operator","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/redhat-best-practices-for-k8s.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2023-05-20T09:19:45.000Z","updated_at":"2026-02-04T16:22:17.000Z","dependencies_parsed_at":null,"dependency_job_id":"6dbd2d30-2eec-4f67-a83b-53cde4679158","html_url":"https://github.com/redhat-best-practices-for-k8s/certsuite-operator","commit_stats":null,"previous_names":["greyerof/tnf-op","redhat-best-practices-for-k8s/certsuite-operator","test-network-function/cnf-certsuite-operator"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/redhat-best-practices-for-k8s/certsuite-operator","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redhat-best-practices-for-k8s%2Fcertsuite-operator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redhat-best-practices-for-k8s%2Fcertsuite-operator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redhat-best-practices-for-k8s%2Fcertsuite-operator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redhat-best-practices-for-k8s%2Fcertsuite-operator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/redhat-best-practices-for-k8s","download_url":"https://codeload.github.com/redhat-best-practices-for-k8s/certsuite-operator/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/redhat-best-practices-for-k8s%2Fcertsuite-operator/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29704419,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-22T03:17:42.375Z","status":"ssl_error","status_checked_at":"2026-02-22T03:17:31.622Z","response_time":110,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["certification","cnf","openshift"],"created_at":"2026-02-22T03:43:28.678Z","updated_at":"2026-02-22T03:43:29.248Z","avatar_url":"https://github.com/redhat-best-practices-for-k8s.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Certification Suite Operator\n\n[![red hat](https://img.shields.io/badge/red%20hat---?color=gray\u0026logo=redhat\u0026logoColor=red\u0026style=flat)](https://www.redhat.com)\n[![openshift](https://img.shields.io/badge/openshift---?color=gray\u0026logo=redhatopenshift\u0026logoColor=red\u0026style=flat)](https://www.redhat.com/en/technologies/cloud-computing/openshift)\n\n## Description\n\nKubernetes/Openshift Operator (scaffolded with operator-sdk) running the\n[Certification Suite Container](https://github.com/redhat-best-practices-for-k8s/certsuite-operator).\n\nThe Certification Suites provide a set of test cases for the\nContainerized Network Functions/Cloud Native Functions (CNFs) to verify if\nbest practices for deployment on Red Hat OpenShift clusters are followed.\n\n### How does it work?\n\nThe Operator registers a CRD in the cluster: `CertsuiteRun`.\n\nIn order to fire up the Certification Suite, the user must create\na CertsuiteRun CR, also informally referred as Run CR, which\nhas to be created with a Config Map containing the cnf certification suites configuration,\nand a Secret containing the preflight suite credentials.\n**Note:** All resources mentioned above should be created in the operator's\ninstallation namespace (by default `certsuite-operator`)\n\nSee resources relationship diagram:\n\n![run config](doc/uml/run_config.png)\n\nWhen the CR is deployed, a new pod with two containers is created:\n\n1. Container built with the cnf certification image in order to run the suites.\n2. Container (sidecar) which updates the Run CR's status fields containing the\nCertification suites results based on results claim file created by the\nprevious container.\n\n**See diagram summarizing the process:**\n\n![Use Case Run](doc/uml/use_case_run.png)\n\n## Getting Started\n\nYou’ll need a Kubernetes cluster to run against.\nYou can use [KIND](https://sigs.k8s.io/kind) to get a local cluster for testing,\nor run against a remote cluster.\n**Note:** Your controller will automatically use the current context in your\nkubeconfig file (i.e. whatever cluster `kubectl cluster-info` shows).\n\n### Install operator\n\n#### Initial steps\n\nClone Cnf Certification Operator repo:\n\n```sh\ngit clone https://github.com/redhat-best-practices-for-k8s/certsuite-operator.git\n```\n\n#### Option 1: Using OLM subscription\n\n1. Export OLM catalog image and namespace:\n\n    ```sh\n    export OLM_CATALOG=\u003cyour-registry.com\u003e/\u003cyour-repo\u003e/certsuite-operator-catalog:\u003cversion\u003e\n    export OLM_INSTALL_NAMESPACE=\u003cyour-namespace\u003e\n    ```\n\n    **Note:** If the catalog image and namespace aren't provided,\n    they will be set by default to:\n\n    ```sh\n    OLM_CATALOG=quay.io/redhat-best-practices-for-k8s/certsuite-operator-catalog:latest\n    OLM_INSTALL_NAMESPACE=certsuite-operator\n    ```\n\n2. Install Cnf Certification Operator:\\\n    Use the following make target to install the operator using OLM subscription:\n\n    ```sh\n    make olm-install\n    ```\n\n3. Verify Installation:\n    Run the following command and expect a similar output:\n\n    \u003c!-- markdownlint-disable --\u003e\n    ```sh\n    $ oc get pods -n $OLM_INSTALL_NAMESPACE\n    NAME                                                              READY   STATUS      RESTARTS   AGE\n    afa1738b451274ef681c19ae8e8a6dcc50f65568056ef97355a4a2fe14hbhpn   0/1     Completed   0          3m32s\n    certsuite-controller-manager-67f68cd4cb-625ww                     2/2     Running     0          3m18s\n    certsuite-operator-olm-catalog-mkmqw                              1/1     Running     0          3m45s\n    ```\n    \u003c!-- markdownlint-enable --\u003e\n\n    **Note:** If `OLM_INSTALL_NAMESPACE` environment variable wasn't exported\n    in previous steps, use `certsuite-operator` as namespace instead.\n\n#### Option 2: Manually building and deploying the operator\n\nIn order to Install the operator by manually building and deploying it,\nthe `cert-manager` has to be installed at first:\n\n```sh\nkubectl apply -f https://github.com/jetstack/cert-manager/releases/latest/download/cert-manager.yaml\n```\n\n##### Option 2.1: Use your own registry account\n\n1. Export images environment variables:\n\n    ```sh\n    export IMG=\u003cyour-registry.com\u003e/\u003cyour-repo\u003e/certsuite-operator:\u003cversion\u003e\n    export SIDECAR_IMG=\u003cyour-registry.com\u003e/\u003cyour-repo\u003e/certsuite-operator-sidecar:\u003cversion\u003e\n    ```\n\n2. Build and upload the controller image to your registry account:\n\n    ```sh\n    make docker-build docker-push\n    ```\n\n3. Build and upload the side car image to your registry account:\n\n    ```sh\n    docker build -f certsuite-sidecar/Dockerfile -t $SIDECAR_IMG .\n    docker push $SIDECAR_IMG\n    ```\n\n4. Deploy the operator, using the previously uploaded controller image,\n and the built side car image:\n\n    ```sh\n    make deploy\n    ```\n\n##### Option 2.2: Use local images\n\n1. Export images environment variables (optional):\n\n    ```sh\n    export IMG=\u003cyour-certsuite-operator-image-name\u003e\n    export SIDECAR_IMG=\u003cyour-sidecar-app-image-name\u003e\n    ```\n\n    **Note**: if the images aren't provided,\n    scripts of next steps will use default images:\n\n    ```sh\n    IMG=ci-certsuite-op:v0.0.1-test\n    SIDECAR_IMG=ci-certsuite-op-sidecar:v0.0.1-test\n    ```\n\n2. Build controller and side car images:\n\n    ```sh\n    scripts/ci/build.sh\n    ```\n\n3. Deploy previously built images by preloading them into the kind cluster's nodes:\n\n    ```sh\n    scripts/ci/deploy.sh\n    ```\n\n### Test it out\n\nUse our samples to test out the cnf certification operator, with the following command:\n\n```sh\nmake deploy-samples\n```\n\n**Note**: Current sample CertsuiteRun CR configures\nthe Certification Suite to run the \"observability\" test suite only.\nIt can be modified by changing manually the `labelsFilter` of the [sample CR](https://github.com/redhat-best-practices-for-k8s/certsuite-operator/blob/main/config/samples/cnf-certifications_v1alpha1_certsuiterun.yaml).\n\n### How to customize the Certification Suite run\n\n1. Create Resources\n\n    In order to use the cnf certification suite operator,\n    you'll have to create yaml files for the following resources:\n\n    1. Config map:\\\n    Containing the cnf certification configuration file\n    content under the `tnf_config.yaml` key.\\\n    (see [Certification configuration description](https://redhat-best-practices-for-k8s.github.io/certsuite-operator/configuration/))\n\n    2. Secret:\\\n    Containing cnf preflight suite credentials\n    under the `preflight_dockerconfig.json` key.\\\n    (see [Preflight Integration description](https://redhat-best-practices-for-k8s.github.io/certsuite-operator/runtime-env/#disable-intrusive-tests))\n\n    3. CertsuiteRun CR:\\\n    Containing the following Spec fields that has to be filled in:\n        - **labelsFilter**: Wanted label filtering the cnf certification tests suite.\n        - **logLevel**: Wanted log level of cnf certification tests suite run.\\\n        Log level options: \"info\", \"debug\", \"warn\", \"error\"\n        - **timeout**: Wanted timeout for the the cnf certification tests.\n        - **configMapName**: Name of the config map defined at stage 1.\n        - **preflightSecretName**: Name of the preflight Secret\n        defined at stage 2.\n        - **enableDataCollection**: Set to \"true\" to enable data collection,\n        or \"false\" otherwise.\\\n        **Note:** When setting this field to true, the claim file will be sent to\n        a server external to the cluster. see\n        [collector repository](https://github.com/redhat-best-practices-for-k8s/collector)\n        for more details\n        - **showAllResultsLogs**: Set to \"true\" to show all result's logs,\n        and not only logs of failed test cases.\n        This field is set to \"false\" by default.\n        - **showCompliantResourcesAlways**: Set to \"true\" to show compliant\n        resources of all results. and not only compliant and non-compliant\n        resources of failed test cases. This field is set to \"false\" by default.\n\n        See a [sample CertsuiteRun CR](https://github.com/redhat-best-practices-for-k8s/certsuite-operator/blob/main/config/samples/cnf-certifications_v1alpha1_certsuiterun.yaml)\n\n2. Apply resources into the cluster\n\n    After creating all the yaml files for required resources,\n    use the following commands to apply them into the cluster:\n\n    ```sh\n    oc apply -f /path/to/config/map.yaml\n    oc apply -f /path/to/preflight/secret.yaml\n    oc apply -f /path/to/certsuiteRun.yaml\n    ```\n\n    **Note**: The same config map and secret can be reused\n    by different CertsuiteRun CR's.\n\n### Review results\n\nIf all of the resources were applied successfully, the cnf certification suites\nwill run on a new created `pod` in the `certsuite-operator` namespace.\nThe pod has the name with the form `certsuite-job-run-N`:\n\n\u003c!-- markdownlint-disable --\u003e\n```sh\n$ oc get pods -n certsuite-operator \nNAME                                                READY   STATUS      RESTARTS   AGE\ncertsuite-controller-manager-6c6bb6d965-jslmd   2/2     Running     0          21h\ncertsuite-job-run-1                                 0/2     Completed   0          21h\n```\n\u003c!-- markdownlint-enable --\u003e\n\nCheck whether the pod creation and the cnf certification suites run were successful\nby checking CertsuiteRun CR's status.\nIn the successful case, expect to see the following status:\n\n```sh\n$ oc get certsuiteruns.cnf-certifications.redhat.com -n certsuite-operator\nNAME                              AGE   STATUS\ncertsuiterun-sample   50m   CertSuiteFinished\n```\n\nThe status `CertSuiteFinished` means the Cert Suite pod has finished running\nall the test cases, so the results can be inspected in field `report` of the Run\nCR's (certsuiterun-sample) status subresource.\n\n- Results: For every test case, contains its result and logs.\nIf the the result is \"skipped\" or \"failed\" contains also the skip\\failure reason.\n\n    See example:\n\n    \u003c!-- markdownlint-disable --\u003e\n    ```sh\n    status:\n       report:\n            results:\n                - logs: |\n                    INFO  [Feb 15 13:05:50.749] [check.go: 263] [observability-pod-disruption-budget] Running check (labels: [common observability-pod-disruption-budget observability])\n                    INFO  [Feb 15 13:05:50.749] [suite.go: 193] [observability-pod-disruption-budget] Testing Deployment \"deployment: test ns: tnf\"\n                    INFO  [Feb 15 13:05:50.749] [suite.go: 206] [observability-pod-disruption-budget] PDB \"test-pdb-min\" is valid for Deployment: \"test\"\n                    INFO  [Feb 15 13:05:50.749] [suite.go: 224] [observability-pod-disruption-budget] Testing StatefulSet \"statefulset: test ns: tnf\"\n                    INFO  [Feb 15 13:05:50.749] [suite.go: 237] [observability-pod-disruption-budget] PDB \"test-pdb-max\" is valid for StatefulSet: \"test\"\n                    INFO  [Feb 15 13:05:50.749] [checksdb.go: 115] [observability-pod-disruption-budget] Recording result \"PASSED\", claimID: {Id:observability-pod-disruption-budget Suite:observability Tags:common}\n                    result: passed\n                    testCaseName: observability-pod-disruption-budget\n                - logs: |\n                    INFO  [Feb 15 13:05:50.723] [checksgroup.go: 83] [operator-install-source] Skipping check operator-install-source, reason: no matching labels\n                    INFO  [Feb 15 13:05:50.723] [checksdb.go: 115] [operator-install-source] Recording result \"SKIPPED\", claimID: {Id:operator-install-source Suite:operator Tags:common}\n                    reason: no matching labels\n                    result: skipped\n                    testCaseName: operator-install-source\n                - logs: |\n                    INFO  [Feb 15 13:05:50.749] [checksgroup.go: 83] [affiliated-certification-helmchart-is-certified] Skipping check affiliated-certification-helmchart-is-certified, reason: no matching labels\n                    INFO  [Feb 15 13:05:50.749] [checksdb.go: 115] [affiliated-certification-helmchart-is-certified] Recording result \"SKIPPED\", claimID: {Id:affiliated-certification-helmchart-is-certified Suite:affiliated-certification Tags:common}\n                    reason: no matching labels\n                    result: skipped\n                    testCaseName: affiliated-certification-helmchart-is-certified\n    ```\n    \u003c!-- markdownlint-enable --\u003e\n\n- Summary: Summarize the total number of tests by their results.\n- Verdict: Specifies the overall result of the certificattion suites run.\\\nPoissible verdicts: \"pass\", \"skip\", \"fail\", \"error\".\n\nRun the following command to ensure its creation:\n\n\u003c!-- markdownlint-disable --\u003e\n```sh\n$ oc get certsuiteruns.cnf-certifications.redhat.com -n certsuite-operator certsuiterun-sample -o json | jq '.status.report.verdict'\n\"pass\"\n```\n\u003c!-- markdownlint-enable --\u003e\n\n### Uninstall CRDs\n\nTo delete the CRDs from the cluster:\n\n```sh\nmake uninstall\n```\n\n### Undeploy controller\n\n#### Option 1: Operator was installed using OLM subscription\n\nUninstall operator:\n\n```sh\nmake olm-uninstall\n```\n\n#### Option 2: Operator was Manually built and deployed\n\nUndeploy the controller from the cluster:\n\n```sh\nmake undeploy\n```\n\n**NOTE:** Run `make --help` for more information on all potential `make` targets\n\nMore information can be found via the [Kubebuilder Documentation](https://book.kubebuilder.io/introduction.html)\n\n## License\n\nCopyright 2023.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n```plaintext\nhttp://www.apache.org/licenses/LICENSE-2.0\n```\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fredhat-best-practices-for-k8s%2Fcertsuite-operator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fredhat-best-practices-for-k8s%2Fcertsuite-operator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fredhat-best-practices-for-k8s%2Fcertsuite-operator/lists"}