docs(ROSAENG-61476): add PQC readiness assessment for osdctl - #961
docs(ROSAENG-61476): add PQC readiness assessment for osdctl#961fullsend-ai-coder[bot] wants to merge 2 commits into
Conversation
Add a Post-Quantum Cryptography readiness assessment document that inventories all cryptographic paths in osdctl and maps upstream dependencies for PQC migration. Key findings: - EC2 Ed25519 key pair creation in jumphost code is the primary actionable item (single-line constant change when AWS supports PQC key types) - Hive SSH key retrieval is algorithm-agnostic and requires no code changes - No direct crypto/* standard library imports exist in osdctl source; all crypto operations are delegated to AWS SDK and Kubernetes API - Both active crypto paths are blocked on upstream providers This is a discovery/inventory task for HCMSEC-3301 Phase 1-2. No production code changes are included. Related to ROSAENG-61476
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: fullsend-ai-coder[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @fullsend-ai-coder[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
🤖 Finished Review · ✅ Success · Started 3:10 AM UTC · Completed 3:27 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $5.40 |
|
Risk Assessment: moderate (2/5) DetailsDocumentation-only PR by a bot adding a single new markdown file (224 lines); blast_radius=medium and new-file Tier 2 baseline lift the score above 1, but no protected paths, security-sensitive files, CI, or dependency changes keep it at moderate. Previous runRisk Assessment: moderate (2/5) DetailsDocumentation-only PR by a bot adding a single new markdown file. No protected paths, no security-sensitive files, no CI or dependency changes. The only file is brand new with no git history (Tier 2 baseline). No linked GitHub issue. |
ReviewFindingsLow
Previous runReviewFindingsMedium
Low
Next steps:
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Fix · ✅ Success · Started 3:29 AM UTC · Completed 3:37 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.40 |
- Move pqc-assessment.md from docs/ to docs/assessments/ to separate hand-authored assessment from auto-generated CLI reference docs - Fix technical inaccuracy: parseCertificate() parses standalone certificate resources, not ManifestWork resources Addresses #961
🔧 Fix agent — iteration 1 (bot-triggered)Addressed both review findings: (1) moved pqc-assessment.md to docs/assessments/ to separate it from auto-generated CLI reference docs, and (2) fixed technical inaccuracy about parseCertificate() data source from ManifestWork to standalone certificate resources. Fixed (2):
Tests: passedNext steps:
|
|
🤖 Finished Review · ✅ Success · Started 3:39 AM UTC · Completed 3:53 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $4.30 |
Superseded by updated review
fullsend-ai-review
Bot
added
the
ready-for-merge
Summary
Adds a Post-Quantum Cryptography (PQC) readiness assessment document for osdctl as part of the ROSA PQC initiative (HCMSEC-3301, Phase 1-2: Discovery & Dependency Mapping).
The assessment inventories all cryptographic paths in the repository, maps upstream dependencies, and evaluates migration readiness:
cmd/jumphost/create.go): The only directly actionable crypto path — a single-lineKeyTypeconstant change when AWS EC2 supports PQC key types. Blocked on AWS.cmd/cluster/ssh/key.go): Algorithm-agnostic code that retrieves opaque key bytes. No osdctl changes needed — blocked on OpenShift/Hive installer.crypto/*imports: All cryptographic operations are delegated to AWS SDK and Kubernetes API.The document also includes an upstream dependency map, SSM Session Manager evaluation as an SSH alternative, and timeline alignment with HCMSEC-3301 Phase 3/4 milestones.
Testing
go vet ./...to confirm no Go code was affectedRelated to https://redhat.atlassian.net/browse/ROSAENG-61476
Post-script verification
agent/ROSAENG-61476-pqc-assessment)c02ab22b7faf938a24ff7f1a084ae3c650f07759..HEAD)