CNTRLPLANE-3237: kms: report EncryptionKMSPreflightControllerProgressing in preflight controller

[p0lyn0mial]

// "Terminal" means no automatic forward progress is possible; admin/config-change required.
// Transient errors (deploy, cleanup, status API failures) are not terminal — the controller retries them.
// *pe denotes a *preflightError (a definitive conclusion); plain err denotes a transient k8s API error.
//
//	Scenario  Description                                       requeue  err   Degraded  Progressing  Terminal
//	--------  ------------------------------------------------  -------  ----  --------  -----------  --------
//	1         No preflight required — cleanup                   false    nil   False     False        No
//	1a        Already Succeeded — cleanup, no pod work          false    nil   False     False        No
//	2a        No pod, already Failed — surface error            false    *pe   True      False        Yes
//	2b        No pod, Deploy success                            true     nil   False     True         No
//	2b        No pod, Deploy error                              true     err   True      False        No
//	3a        Pod Failed — keep for inspection                  false    *pe   True      False        Yes
//	3b        No hash, pod Running, no timeout                  true     nil   False     True         No
//	3b        No hash, timeout exceeded                         true     *pe   True      False        Yes
//	3b        No hash, pod Succeeded without reporting          false    *pe   True      False        Yes
//	3c        Stale pod — Cleanup success                       true     nil   False     True         No
//	3c        Stale pod — Cleanup error                         true     err   True      False        No
//	3d        Hash matches, no result, pod Running, no timeout  true     nil   False     True         No
//	3d        Hash matches, no result, timeout exceeded         true     *pe   True      False        Yes
//	3d        Hash matches, no result, pod Succeeded            false    *pe   True      False        Yes
//	3e        Check passed — write result + Cleanup, success    false    nil   False     False        No
//	3e        Check passed — write result fails                 false    err   True      False        No
//	3f        Check failed — write result + keep pod            false    *pe   True      False        Yes

Summary by CodeRabbit

• Bug Fixes
  • Improved encryption preflight status reporting with clearer progress states during deployment, configuration checks, readiness waits, and cleanup.
  • More accurately distinguishes active progress from completed, degraded, or failed preflight checks.
  • Improved handling and reporting of preflight pod failures and cleanup scenarios.

[openshift-ci-robot]

@p0lyn0mial: This pull request references CNTRLPLANE-3237 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

// "Terminal" means no automatic forward progress is possible; admin/config-change required.
// Transient errors (deploy, cleanup, status API failures) are not terminal — the controller retries them.
// *pe denotes a *preflightError (a definitive conclusion); plain err denotes a transient k8s API error.
//
//	Scenario  Description                                       requeue  err   Degraded  Progressing  Terminal
//	--------  ------------------------------------------------  -------  ----  --------  -----------  --------
//	1         No preflight required — cleanup                   false    nil   False     False        No
//	1a        Already Succeeded — cleanup, no pod work          false    nil   False     False        No
//	2a        No pod, already Failed — surface error            false    *pe   True      False        Yes
//	2b        No pod, Deploy success                            true     nil   False     True         No
//	2b        No pod, Deploy error                              true     err   True      False        No
//	3a        Pod Failed — keep for inspection                  false    *pe   True      False        Yes
//	3b        No hash, pod Running, no timeout                  true     nil   False     True         No
//	3b        No hash, timeout exceeded                         true     *pe   True      False        Yes
//	3b        No hash, pod Succeeded without reporting          false    *pe   True      False        Yes
//	3c        Stale pod — Cleanup success                       true     nil   False     True         No
//	3c        Stale pod — Cleanup error                         true     err   True      False        No
//	3d        Hash matches, no result, pod Running, no timeout  true     nil   False     True         No
//	3d        Hash matches, no result, timeout exceeded         true     *pe   True      False        Yes
//	3d        Hash matches, no result, pod Succeeded            false    *pe   True      False        Yes
//	3e        Check passed — write result + Cleanup, success    false    nil   False     False        No
//	3e        Check passed — write result fails                 false    err   True      False        No
//	3f        Check failed — write result + keep pod            false    *pe   True      False        Yes

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4e155af9-bfcc-4f4e-aad2-3abce3196568

📥 Commits

Reviewing files that changed from the base of the PR and between 0aacacf and ec1a16d.

📒 Files selected for processing (2)

• pkg/operator/encryption/controllers/kms_preflight_controller.go
• pkg/operator/encryption/controllers/kms_preflight_controller_test.go

---

Walkthrough

The KMS preflight controller now reports progressing conditions with reason and message metadata for active preflight states, clears progress when inactive, and updates lifecycle error handling. Table-driven tests cover progressing and terminal condition outcomes.

Changes

KMS preflight progress reporting

Layer / File(s)	Summary
Structured preflight progress outcomes pkg/operator/encryption/controllers/kms_preflight_controller.go	runPreflightChecks returns progress metadata alongside requeue and error results, covering deployment, waiting, cleanup, timeout, and result-writing paths.
Operator condition application pkg/operator/encryption/controllers/kms_preflight_controller.go	sync applies degraded and progressing conditions, clears progressing when the controller should not run, and records active progress reasons and messages.
Condition expectation coverage pkg/operator/encryption/controllers/kms_preflight_controller_test.go	Preflight scenarios verify progressing status, reasons, messages, terminal outcomes, and initial fake-client conditions.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• openshift/library-go#2375: Both changes modify the KMS preflight controller and its runPreflightChecks flow.

Suggested labels: do-not-merge/work-in-progress

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding EncryptionKMSPreflightControllerProgressing reporting in the KMS preflight controller.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The edited test file’s 47 scenario names are all static strings; no Ginkgo titles or dynamic tokens (timestamps, UUIDs, names, suffixes) appear.
Test Structure And Quality	✅ Passed	PASS: This is a table-driven testing test, not Ginkgo; it uses fake clients, no waits, local setup, and clear assertion messages consistent with repo patterns.
Microshift Test Compatibility	✅ Passed	Only a controller and table-driven unit test changed; no Ginkgo e2e specs or MicroShift-unsupported OpenShift APIs/features were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the changed tests are standard Go unit tests with no multi-node or SNO assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	Diff only updates KMS preflight status/condition logic and tests; no pod specs, selectors, affinity, spread, replicas, or topology code changed.
Ote Binary Stdout Contract	✅ Passed	PASS: The changed controller/test files contain no main/init/TestMain/BeforeSuite hooks or stdout print calls; output is limited to error formatting and t.Run.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo/e2e tests were added; the changes are controller/unit tests with no IPv4-only or external connectivity assumptions.
No-Weak-Crypto	✅ Passed	No flagged weak crypto, custom crypto, or secret/token comparisons found; the only crypto-like code is FNV-32 config hashing and plain config-hash checks.
Container-Privileges	✅ Passed	Only controller/test code changed; no privileged/hostPID/hostNetwork/etc. settings were added or modified, and no K8s manifest files were touched.
No-Sensitive-Data-In-Logs	✅ Passed	Changed code logs only config hashes at V(4); no raw secrets, tokens, hostnames, PII, or customer data are emitted.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[ardaguclu]

/lgtm
/hold
in case @bertinatto or @tjungblu may want to look at

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ardaguclu, p0lyn0mial

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• pkg/operator/encryption/OWNERS [ardaguclu,p0lyn0mial]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tjungblu]

All good from my side

/hold cancel

[openshift-ci]

@p0lyn0mial: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.