CNTRLPLANE-3237: kms preflight: introduce kmsConfigHasherResourceProvider interface

[p0lyn0mial]

splitting #2392

Summary by CodeRabbit

• Refactor

  • Improved KMS configuration handling for referenced Secrets and ConfigMaps.
  • Preserved existing configuration hashing behavior and error handling.
  • Improved separation of resource retrieval from KMS configuration processing.

• Tests

  • Updated coverage to verify resource retrieval during KMS configuration processing.

[coderabbitai]

Walkthrough

KMS config hashing now uses an injected resource-provider interface for Secret and ConfigMap retrieval. The Kubernetes CoreV1 client provides the implementation, and controller and test call sites pass the wrapper.

Changes

KMS resource-provider wiring

Layer / File(s)	Summary
Provider abstraction and hasher wiring pkg/operator/encryption/controllers/kms_preflight_controller.go, pkg/operator/encryption/controllers/kms_preflight_controller_test.go	The hasher accepts and validates a resource provider, uses it for Secret and ConfigMap retrieval, and receives a CoreV1-backed provider from the controller and test.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• openshift/library-go#2392: Directly refactors the KMS config hasher resource-provider implementation, constructor, and test wiring.

Suggested reviewers: dgrisonnet

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The commit changes no test titles; both t.Run calls use scenario.name, and all scenario names are fixed descriptive literals with no runtime values.
Test Structure And Quality	✅ Passed	The changed test uses Go testing.T and fake clientsets, not Ginkgo; it adds no cluster waits or unmanaged resources, and the new constructor failure includes context.
Microshift Test Compatibility	✅ Passed	The pull request adds no Ginkgo e2e tests. Its only test changes are in standard Go TestKMSConfigHasher, with no MicroShift-incompatible API or feature references.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request adds no new Ginkgo e2e tests. It only updates the existing Go unit test TestKMSConfigHasher, so SNO multi-node compatibility rules do not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	The diff changes only KMS Secret/ConfigMap hashing and tests; it adds no affinity, topology spread, replicas, node selectors, tolerations, or PDB scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR changes only library/controller hashing code and a unit test; no main, init, TestMain, suite setup, or process-level stdout write was added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request changes only controller code and a standard Go TestKMSConfigHasher unit test; it adds no Ginkgo e2e tests, IPv4 assumptions, or external connectivity.
No-Weak-Crypto	✅ Passed	The PR adds only resource-provider plumbing. The diff adds no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or secret/token comparisons; existing FNV hashing is unchanged.
Container-Privileges	✅ Passed	The patch changes only Go files. It adds no flagged privilege settings or manifests; the existing conditional hostNetwork setting is unchanged.
No-Sensitive-Data-In-Logs	✅ Passed	The diff adds no logging and does not emit Secret or ConfigMap values; it only injects resource fetching. Existing error text and hash logging remain unchanged.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the introduction of the kmsConfigHasherResourceProvider interface, which is the main change in the pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[ardaguclu]

Do we need nil check?

[p0lyn0mial]

added

[ardaguclu]

Don't we need a newCoreClientKMSConfigHashResourceProvider function that accepts coreClient?

[p0lyn0mial]

added

[ardaguclu]

/lgtm
/approve

[openshift-ci]

New changes are detected. LGTM label has been removed.

[p0lyn0mial]

the latest push replaced panic with returning an err.

[openshift-ci-robot]

@p0lyn0mial: This pull request references CNTRLPLANE-3237 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

splitting #2392

Summary by CodeRabbit

• Refactor

• Improved KMS configuration handling for referenced Secrets and ConfigMaps.

• Preserved existing configuration hashing behavior and error handling.

• Improved separation of resource retrieval from KMS configuration processing.

• Tests

• Updated coverage to verify resource retrieval during KMS configuration processing.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[ardaguclu]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ardaguclu, p0lyn0mial

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• pkg/operator/encryption/OWNERS [ardaguclu,p0lyn0mial]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@p0lyn0mial: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.