kms: don't resync preflight controller when apiserver changes

[bertinatto]

When the user changes apiserver/cluster, the preflight controller currently resyncs. However, the controller will only be able to run the checks if the ObservedConfigHash field was set accordingly by the key controller. In that case, it's better to just rely operator client for that status update instead.

Summary by CodeRabbit

• Bug Fixes
  • Improved KMS preflight synchronization behavior by preventing unnecessary syncs from API server events.
  • KMS preflight checks continue to update based on operator status changes and periodic refreshes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 79594a21-bfa0-4a2f-8bc2-e2f8d3224774

📥 Commits

Reviewing files that changed from the base of the PR and between ed1b434 and aa0760a.

📒 Files selected for processing (1)

• pkg/operator/encryption/controllers/kms_preflight_controller.go

💤 Files with no reviewable changes (1)

• pkg/operator/encryption/controllers/kms_preflight_controller.go

---

Walkthrough

The KMS preflight controller no longer registers the API server informer for sync-triggering events. It continues watching the operator client informer, with periodic resync behavior unchanged.

Changes

KMS preflight controller

Layer / File(s)	Summary
Restrict informer event sources pkg/operator/encryption/controllers/kms_preflight_controller.go	NewKMSPreflightController configures WithInformers(...) with only operatorClient.Informer().

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• openshift/library-go#2377: Updates informer and event wiring in the same KMS preflight controller.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: stopping KMS preflight controller resyncs on apiserver changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only changes a non-test controller file; no *_test.go files were modified, so no Ginkgo test titles were introduced or edited.
Test Structure And Quality	✅ Passed	No Ginkgo tests were changed; the PR is a one-line controller wiring update, so this test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	Only a controller informer change was made; no new Ginkgo tests or e2e specs were added, so MicroShift compatibility isn’t implicated.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No Ginkgo e2e tests were added or modified; the only change is a controller informer wiring removal.
Topology-Aware Scheduling Compatibility	✅ Passed	Change only rewires controller informers; it adds no replicas, affinity, topology spread, node selectors, or taints, so no topology-aware scheduling issue.
Ote Binary Stdout Contract	✅ Passed	Touched code only changes informer wiring in a controller; no main/init/TestMain/suite setup or stdout writes were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only a controller informer wiring line changed; no Ginkgo/e2e tests were added or modified.
No-Weak-Crypto	✅ Passed	Commit only removes an apiserver informer; grep found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or secret/token comparisons.
Container-Privileges	✅ Passed	Only change is informer wiring in a Go controller; no container/K8s manifest privilege fields were modified in the PR.
No-Sensitive-Data-In-Logs	✅ Passed	The only log in the changed file emits config hashes, not secrets, tokens, PII, hostnames, or customer data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[p0lyn0mial]

thanks

/lgtm
/retest

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bertinatto, p0lyn0mial

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• pkg/operator/encryption/OWNERS [bertinatto,p0lyn0mial]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@bertinatto: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.