feat: add hardening scan support for multiple services and update workflows

.github/workflows/consul.yaml

@@ -26,7 +26,7 @@ on:
         required: false
         default: ubuntu-latest
       scope:
-        description: Consul Test Scope (pr or nightly)
+        description: Consul Test Scope (pr, nightly or hardening)
         type: string
         required: false
         default: pr
@@ -57,7 +57,7 @@ on:
         required: false
         default: ubuntu-latest
       scope:
-        description: Consul Test Scope (pr or nightly)
+        description: Consul Test Scope (pr, nightly or hardening)
         type: string
         required: false
         default: pr
@@ -120,8 +120,10 @@ jobs:
             CONFIG_FILE="./workflow-config/consul_nightly.yaml"
           elif [[ "$SCOPE" == "pr" ]]; then
             CONFIG_FILE="./workflow-config/consul.yaml"
+          elif [[ "$SCOPE" == "hardening" ]]; then
+            CONFIG_FILE="./workflow-config/consul_hardening.yaml"
           else
-            echo "::error::Invalid scope parameter '$SCOPE'. Must be 'pr' or 'nightly'."
+            echo "::error::Invalid scope parameter '$SCOPE'. Must be 'pr', 'nightly' or 'hardening'."
             exit 1
           fi
           ./scripts/matrix.sh "$LATEST_TAG" "$CONFIG_FILE" "$SERVICE_BRANCH"
@@ -348,6 +350,17 @@ jobs:
         if: matrix.test.sequence == 'upgrade'
         run: sleep 90s
 
+      - name: Hardening Check
+        if: inputs.scope == 'hardening'
+        uses: netcracker/qubership-workflow-hub/actions/k8s-hardening-scan@main
+        with:
+          namespaces: consul
+          output-file: consul-hardening-scan.json
+          install-kubescape: true
+          execute-trivy-scan: false
+          fail-on-mandatory-checks: true
+          config-file: ${{ inputs.repository_name }}/.github/hardening-config.yaml
+
       - name: Verify Consul upgrade
         if: matrix.test.sequence == 'upgrade'
         uses: ./qubership-test-pipelines/actions/shared/verify_installation

.github/workflows/monitoring.yaml

@@ -30,6 +30,11 @@ on:
         type: string
         required: false
         default: multi-node
+      scope:
+        description: Monitoring Test Scope (pr, nightly or hardening)
+        type: string
+        required: false
+        default: pr
       skip_tests:
         description: Skip all tests (for doc-only changes)
         type: boolean
@@ -62,6 +67,11 @@ on:
         type: string
         required: false
         default: multi-node
+      scope:
+        description: Monitoring Test Scope (pr, nightly or hardening)
+        type: string
+        required: false
+        default: pr
       skip_tests:
         description: Skip all tests (for doc-only changes)
         type: boolean
@@ -100,12 +110,23 @@ jobs:
       - name: Process versions file and matrix generation
         id: process-versions
         env:
+          SCOPE: ${{ inputs.scope }}
           LATEST_TAG: ${{ steps.get-latest-tag.outputs.latest_tag }}
           SERVICE_BRANCH: ${{ inputs.service_branch }}
         working-directory: ${{ github.workspace }}/qubership-test-pipelines
         run: |
           chmod +x ./scripts/matrix.sh
-          ./scripts/matrix.sh "$LATEST_TAG" ./workflow-config/monitoring.yaml "$SERVICE_BRANCH"
+          if [[ "$SCOPE" == "nightly" ]]; then
+            CONFIG_FILE="./workflow-config/monitoring_nightly.yaml"
+          elif [[ "$SCOPE" == "pr" ]]; then
+            CONFIG_FILE="./workflow-config/monitoring.yaml"
+          elif [[ "$SCOPE" == "hardening" ]]; then
+            CONFIG_FILE="./workflow-config/monitoring_hardening.yaml"
+          else
+            echo "::error::Invalid scope parameter '$SCOPE'. Must be 'pr', 'nightly' or 'hardening'."
+            exit 1
+          fi
+          ./scripts/matrix.sh "$LATEST_TAG" "$CONFIG_FILE" "$SERVICE_BRANCH"
 
   Monitoring-Test-Cases:
     if: ${{ !inputs.skip_tests }}
@@ -209,6 +230,17 @@ jobs:
         if: matrix.test.sequence == 'upgrade'
         run: sleep 2m
 
+      - name: Hardening Check
+        if: inputs.scope == 'hardening'
+        uses: netcracker/qubership-workflow-hub/actions/k8s-hardening-scan@main
+        with:
+          namespaces: monitoring
+          output-file: monitoring-hardening-scan.json
+          install-kubescape: true
+          execute-trivy-scan: true
+          fail-on-mandatory-checks: true
+          config-file: ${{ inputs.repository_name }}/.github/hardening-config.yaml
+
       - name: Get Upgraded Monitoring CR name
         if: matrix.test.sequence == 'upgrade'
         uses: ./qubership-test-pipelines/actions/shared/get_crds

.github/workflows/opensearch.yaml

@@ -25,7 +25,7 @@ on:
         required: false
         default: ubuntu-latest
       scope:
-        description: Opensearch Test Scope (pr or nightly)
+        description: Opensearch Test Scope (pr, nightly or hardening)
         type: string
         required: false
         default: pr
@@ -55,7 +55,7 @@ on:
         required: false
         default: ubuntu-latest
       scope:
-        description: Opensearch Test Scope (pr or nightly)
+        description: Opensearch Test Scope (pr, nightly or hardening)
         type: string
         required: false
         default: pr
@@ -117,8 +117,10 @@ jobs:
             CONFIG_FILE="./workflow-config/opensearch_nightly.yaml"
           elif [[ "$SCOPE" == "pr" ]]; then
             CONFIG_FILE="./workflow-config/opensearch.yaml"
+          elif [[ "$SCOPE" == "hardening" ]]; then
+            CONFIG_FILE="./workflow-config/opensearch_hardening.yaml"
           else
-            echo "::error::Invalid scope parameter '$SCOPE'. Must be 'pr' or 'nightly'."
+            echo "::error::Invalid scope parameter '$SCOPE'. Must be 'pr', 'nightly' or 'hardening'."
             exit 1
           fi
           ./scripts/matrix.sh "$LATEST_TAG" "$CONFIG_FILE" "$SERVICE_BRANCH"
@@ -351,6 +353,17 @@ jobs:
         if: ${{ matrix.test.sequence == 'upgrade' }}
         run: sleep 1m
 
+      - name: Hardening Check
+        if: inputs.scope == 'hardening'
+        uses: netcracker/qubership-workflow-hub/actions/k8s-hardening-scan@main
+        with:
+          namespaces: opensearch
+          output-file: opensearch-hardening-scan.json
+          install-kubescape: true
+          execute-trivy-scan: true
+          fail-on-mandatory-checks: true
+          config-file: ${{ inputs.repository_name }}/.github/hardening-config.yaml
+
       - name: Verify Opensearch upgrade to [${{ matrix.test.upgrade_version }}]
         if: ${{ matrix.test.sequence == 'upgrade' }}
         uses: ./qubership-test-pipelines/actions/shared/verify_installation

.github/workflows/pgskipper.yaml

@@ -25,6 +25,11 @@ on:
         type: string
         required: false
         default: ubuntu-latest
+      scope:
+        description: Pgskipper Test Scope (pr, nightly or hardening)
+        type: string
+        required: false
+        default: pr
       service_versions_json:
         description: PostgreSQL image versions as JSON
         type: string
@@ -62,6 +67,11 @@ on:
         type: string
         required: false
         default: ubuntu-latest
+      scope:
+        description: Pgskipper Test Scope (pr, nightly or hardening)
+        type: string
+        required: false
+        default: pr
       service_versions_json:
         description: PostgreSQL image versions as JSON
         type: string
@@ -123,12 +133,23 @@ jobs:
       - name: Process versions file and matrix generation
         id: process-versions
         env:
+          SCOPE: ${{ inputs.scope }}
           LATEST_TAG: ${{ steps.get-latest-tag.outputs.latest_tag }}
           SERVICE_BRANCH: ${{ inputs.service_branch }}
         working-directory: ${{ github.workspace }}/qubership-test-pipelines
         run: |
           chmod +x ./scripts/matrix.sh
-          ./scripts/matrix.sh "$LATEST_TAG" ./workflow-config/pgskipper.yaml "$SERVICE_BRANCH"
+          if [[ "$SCOPE" == "nightly" ]]; then
+            CONFIG_FILE="./workflow-config/pgskipper_nightly.yaml"
+          elif [[ "$SCOPE" == "pr" ]]; then
+            CONFIG_FILE="./workflow-config/pgskipper.yaml"
+          elif [[ "$SCOPE" == "hardening" ]]; then
+            CONFIG_FILE="./workflow-config/pgskipper_hardening.yaml"
+          else
+            echo "::error::Invalid scope parameter '$SCOPE'. Must be 'pr', 'nightly' or 'hardening'."
+            exit 1
+          fi
+          ./scripts/matrix.sh "$LATEST_TAG" "$CONFIG_FILE" "$SERVICE_BRANCH"
 
       - name: Parse JSON into matrix
         id: parse-matrix
@@ -344,6 +365,17 @@ jobs:
         if: matrix.test.sequence == 'upgrade'
         run: sleep 10s
 
+      - name: Hardening Check
+        if: inputs.scope == 'hardening'
+        uses: netcracker/qubership-workflow-hub/actions/k8s-hardening-scan@6a2de8d62ac5b6998e30f923613c998c263ea9f2 # v2.2.2
+        with:
+          namespaces: pgskipper
+          output-file: pgskipper-hardening-scan.json
+          install-kubescape: true
+          execute-trivy-scan: false
+          fail-on-mandatory-checks: true
+          config-file: ${{ inputs.repository_name }}/.github/hardening-config.yaml
+
       - name: Verify Pgskipper Services upgrade
         if: matrix.test.sequence == 'upgrade'
         uses: ./qubership-test-pipelines/actions/shared/verify_installation

.github/workflows/rabbitmq.yaml

@@ -26,7 +26,7 @@ on:
         required: false
         default: ubuntu-latest
       scope:
-        description: RabbitMQ Test Scope (pr or nightly)
+        description: RabbitMQ Test Scope (pr, nightly or hardening)
         type: string
         required: false
         default: pr
@@ -56,7 +56,7 @@ on:
         required: false
         default: ubuntu-latest
       scope:
-        description: RabbitMQ Test Scope (pr or nightly)
+        description: RabbitMQ Test Scope (pr, nightly or hardening)
         type: string
         required: false
         default: pr
@@ -119,8 +119,10 @@ jobs:
             CONFIG_FILE="./workflow-config/rabbitmq_nightly.yaml"
           elif [[ "$SCOPE" == "pr" ]]; then
             CONFIG_FILE="./workflow-config/rabbitmq.yaml"
+          elif [[ "$SCOPE" == "hardening" ]]; then
+            CONFIG_FILE="./workflow-config/rabbitmq_hardening.yaml"
           else
-            echo "::error::Invalid scope parameter '$SCOPE'. Must be 'pr' or 'nightly'."
+            echo "::error::Invalid scope parameter '$SCOPE'. Must be 'pr', 'nightly' or 'hardening'."
             exit 1
           fi
           ./scripts/matrix.sh "$LATEST_TAG" "$CONFIG_FILE" "$SERVICE_BRANCH"
@@ -308,6 +310,17 @@ jobs:
         if: ${{ matrix.test.sequence == 'upgrade' }}
         run: sleep 1m
 
+      - name: Hardening Check
+        if: inputs.scope == 'hardening'
+        uses: netcracker/qubership-workflow-hub/actions/k8s-hardening-scan@6a2de8d62ac5b6998e30f923613c998c263ea9f2 # v2.2.2
+        with:
+          namespaces: rabbitmq
+          output-file: rabbitmq-hardening-scan.json
+          install-kubescape: true
+          execute-trivy-scan: false
+          fail-on-mandatory-checks: true
+          config-file: ${{ inputs.repository_name }}/.github/hardening-config.yaml
+
       - name: Verify RabbitMQ upgrade
         if: ${{ matrix.test.sequence == 'upgrade' }}
         uses: ./qubership-test-pipelines/actions/shared/verify_installation

.github/workflows/zookeeper.yaml

@@ -24,6 +24,11 @@ on:
         type: string
         required: false
         default: ubuntu-latest
+      scope:
+        description: Zookeeper Test Scope (pr, nightly or hardening)
+        type: string
+        required: false
+        default: pr
       skip_tests:
         description: Skip all tests (for doc-only changes)
         type: boolean
@@ -54,6 +59,11 @@ on:
         type: boolean
         required: false
         default: false
+      scope:
+        description: Zookeeper Test Scope (pr, nightly or hardening)
+        type: string
+        required: false
+        default: pr
 
     secrets:
       AWS_S3_ACCESS_KEY_ID:
@@ -108,10 +118,21 @@ jobs:
         env:
           LATEST_TAG: ${{ steps.get-latest-tag.outputs.latest_tag }}
           SERVICE_BRANCH: ${{ inputs.service_branch }}
+          SCOPE: ${{ inputs.scope }}
         working-directory: ${{ github.workspace }}/qubership-test-pipelines
         run: |
           chmod +x ./scripts/matrix.sh
-          ./scripts/matrix.sh "$LATEST_TAG" ./workflow-config/zookeeper.yaml "$SERVICE_BRANCH"
+          if [[ "$SCOPE" == "nightly" ]]; then
+            CONFIG_FILE="./workflow-config/zookeeper_nightly.yaml"
+          elif [[ "$SCOPE" == "pr" ]]; then
+            CONFIG_FILE="./workflow-config/zookeeper.yaml"
+          elif [[ "$SCOPE" == "hardening" ]]; then
+            CONFIG_FILE="./workflow-config/zookeeper_hardening.yaml"
+          else
+            echo "::error::Invalid scope parameter '$SCOPE'. Must be 'pr', 'nightly' or 'hardening'."
+            exit 1
+          fi
+          ./scripts/matrix.sh "$LATEST_TAG" "$CONFIG_FILE" "$SERVICE_BRANCH"
 
   Zookeeper-Test-Cases:
     if: ${{ !inputs.skip_tests }}
@@ -273,6 +294,17 @@ jobs:
         if: matrix.test.sequence == 'upgrade'
         run: sleep 1m
 
+      - name: Hardening Check
+        if: inputs.scope == 'hardening'
+        uses: netcracker/qubership-workflow-hub/actions/k8s-hardening-scan@6a2de8d62ac5b6998e30f923613c998c263ea9f2 # v2.2.2
+        with:
+          namespaces: zookeeper
+          output-file: zookeeper-hardening-scan.json
+          install-kubescape: true
+          execute-trivy-scan: false
+          fail-on-mandatory-checks: true
+          config-file: ${{ inputs.repository_name }}/.github/hardening-config.yaml
+
       - name: Verify Zookeeper upgrade
         if: matrix.test.sequence == 'upgrade'
         uses: ./qubership-test-pipelines/actions/shared/verify_installation
@@ -306,7 +338,7 @@ jobs:
 
   # 15-Clean [LATEST] TLS
   Clean-Latest-TLS:
-    if: ${{ !inputs.skip_tests }}
+    if: ${{ !inputs.skip_tests && inputs.scope != 'hardening' }}
     runs-on: ${{ inputs.runner_type }}
     name: Clean [${{ inputs.service_branch }}] TLS
     steps:
@@ -407,7 +439,7 @@ jobs:
 
   # 16-Clean [LATEST] TLS Secrets
   Clean-Latest-TLS-Secrets:
-    if: ${{ !inputs.skip_tests }}
+    if: ${{ !inputs.skip_tests && inputs.scope != 'hardening' }}
     runs-on: ${{ inputs.runner_type }}
     needs: Clean-Latest-TLS
     name: Clean [${{ inputs.service_branch }}] TLS Secrets
@@ -467,7 +499,7 @@ jobs:
 
   # 17-Upgrade [LATEST] TLS Certificates -> Clean [LATEST] TLS Certificates
   Clean-Latest-TLS-Certificates:
-    if: ${{ !inputs.skip_tests }}
+    if: ${{ !inputs.skip_tests && inputs.scope != 'hardening' }}
     runs-on: ${{ inputs.runner_type }}
     needs: Clean-Latest-TLS
     name: Clean [${{ inputs.service_branch }}] TLS Certificates
@@ -529,7 +561,7 @@ jobs:
   final-status-check:
     if: ${{ always() }}
     runs-on: ubuntu-latest
-    needs: [Zookeeper-Test-Cases, Clean-Latest-TLS-Certificates, Clean-Latest-TLS-Secrets]
+    needs: [Zookeeper-Test-Cases, Clean-Latest-TLS, Clean-Latest-TLS-Certificates, Clean-Latest-TLS-Secrets]
     steps:
       - name: Checkout pipeline
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v5.1.0