NO-JIRA: update KMS tests changes with latest library-go bump

[gangwgr]

update KMS tests changes with latest library-go bump

Summary by CodeRabbit

• Bug Fixes
  • Improved API server encryption controller setup for more reliable encryption configuration handling.
  • Enhanced encryption-related integration coverage, including KMS scenarios, to improve confidence in encrypted data workflows.
  • Updated supporting components to maintain compatibility with the latest encryption behavior and validation.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@gangwgr: This pull request explicitly references no jira issue.

Details

In response to this:

update KMS tests changes with latest library-go bump

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7afdb2e9-0874-42d2-9f8a-cd766c7dc659

📥 Commits

Reviewing files that changed from the base of the PR and between 08aa4a0 and fca0a68.

⛔ Files ignored due to path filters (11)

• go.sum is excluded by !**/*.sum
• vendor/github.com/openshift/library-go/pkg/crypto/crypto.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/library-go/pkg/operator/apiserver/controllerset/apiservercontrollerset.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/key_controller.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/kms_preflight_controller.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/encryption_status_provider.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/library-go/pkg/operator/encryption/statemachine/transition.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/library-go/test/library/encryption/helpers.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/library-go/test/library/encryption/kms/scenarios.go is excluded by !**/vendor/**, !vendor/**
• vendor/modules.txt is excluded by !**/vendor/**, !vendor/**

📒 Files selected for processing (3)

• go.mod
• pkg/operator/starter.go
• test/e2e-encryption-kms/encryption_kms.go

---

Walkthrough

The change updates library-go, configures the API server encryption controllers with a no-op configuration computer, and replaces local KMS test setup with shared library scenarios.

Changes

Encryption integration

Layer / File(s)	Summary
Encryption controller library update go.mod, pkg/operator/starter.go	Updates the library-go dependency and configures the API server encryption controllers with NoopEncryptionConfigurationComputer.
Shared KMS test scenarios test/e2e-encryption-kms/encryption_kms.go	Removes local KMS setup and uses librarykms.EncryptionTurnOnAndOffScenarios and librarykms.EncryptionProvidersMigrationScenarios with the shared test runners.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to fca0a

The change presents no actionable merge-blocking risk; it is merge-ready after normal checks and review.

Suggested reviewers: bertinatto, ardaguclu, p0lyn0mial

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 3 warnings)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	New KAS/Auth scenarios activate VerifyResources failure logs that hex-dump raw etcd Secret and OAuth token values, exposing sensitive data.	Redact raw etcd values from VerifyResources errors. Report only the key, resource type, and encryption status.
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Test Structure And Quality	⚠️ Warning	New KMS scenarios create cluster-scoped TokenOfLife plus SecretOfLife and RouteOfLife, but the Ginkgo tests have no AfterEach/Delete cleanup; the old tests deleted their namespace.	Register failure-safe cleanup with AfterEach or DeferCleanup. Delete the token, secret, and route after each test, or use disposable namespaces.
Microshift Test Compatibility	⚠️ Warning	The changed helpers activate Auth scenarios with oauth.openshift.io targets, an unavailable MicroShift API group; the Ginkgo tests have no MicroShift skip or apigroup guard.	MicroShift compatibility notice: add [apigroup:oauth.openshift.io] or [Skipped:MicroShift], or run /payload-job periodic-ci-openshift-microshift-release-4.22-periodics-e2e-aws-ovn-ocp-conformance-serial.

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the library-go dependency update and the related KMS test changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR adds no dynamic Ginkgo title values. Changed tests use static Describe and It strings; random providers and resource names remain in test bodies or scenario data.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR adds no new Ginkgo tests; existing KMS tests remain unchanged in registration and the new scenarios use API resources without multi-node or HA assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The patch changes encryption-controller wiring and KMS test scenarios only; no added scheduling fields or topology constraints were found, and manifests are unchanged.
Ote Binary Stdout Contract	✅ Passed	The PR adds no stdout writes in OTE main, TestMain, or suite setup; new scenario code uses fmt.Sprintf, and changed vendored files add no output or init calls.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The patch adds no Ginkgo declarations or IPv4 literals. KMS uses cluster-local Vault services, and service addresses use net.JoinHostPort for IPv6 safety.
No-Weak-Crypto	✅ Passed	The complete PR diff adds no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or non-constant-time secret comparison; added crypto code only maps modern TLS curves.
Container-Privileges	✅ Passed	The PR diff adds no privilege-related manifest fields. Existing privileged bindata entries are identical in HEAD^ and HEAD.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign benluddy for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[gangwgr]

/pipeline required

[openshift-merge-bot]

Scheduling required tests:
/test e2e-aws-operator
/test e2e-aws-ovn
/test e2e-upgrade

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-operator-encryption-kms
/test e2e-aws-operator-encryption-kms-2
/test e2e-gcp-operator-encryption-aescbc
/test e2e-gcp-operator-encryption-aesgcm
/test e2e-gcp-operator-encryption-rotation-aescbc
/test e2e-gcp-operator-encryption-rotation-aesgcm

[gangwgr]

/retest

[gangwgr]

/test e2e-aws-operator-encryption-kms-2

[openshift-ci]

@gangwgr: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[gangwgr]

/verified by ci runs

[openshift-ci-robot]

@gangwgr: This PR has been marked as verified by ci runs.

Details

In response to this:

/verified by ci runs

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.