CNTRLPLANE-3237: kms preflight: replace CoreV1Interface with SecretsGetter and ConfigMapsGetter

[p0lyn0mial]

xref: #2392

Summary by CodeRabbit

• Refactor
  • Improved KMS preflight resource access by handling secrets and configuration data through dedicated interfaces.
  • Maintained existing KMS configuration hash and preflight behavior while updating internal integrations.

[openshift-ci-robot]

@p0lyn0mial: This pull request references CNTRLPLANE-3237 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2feaa8d3-ab6c-43b7-9e42-08f19066cf59

📥 Commits

Reviewing files that changed from the base of the PR and between d58e72c and 14b3497.

📒 Files selected for processing (2)

• pkg/operator/encryption/controllers/kms_preflight_controller.go
• pkg/operator/encryption/controllers/kms_preflight_controller_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• pkg/operator/encryption/controllers/kms_preflight_controller_test.go
• pkg/operator/encryption/controllers/kms_preflight_controller.go

---

Walkthrough

The KMS preflight controller replaces its combined Kubernetes core client with separate Secrets and ConfigMaps getter clients. The resource provider, constructor, hash construction, and tests now use the separated clients.

Changes

KMS client separation

Layer / File(s)	Summary
Typed resource provider clients pkg/operator/encryption/controllers/kms_preflight_controller.go	The resource provider accepts separate Secrets and ConfigMaps getter clients and uses the matching client for each resource type.
Controller client wiring and validation pkg/operator/encryption/controllers/kms_preflight_controller.go, pkg/operator/encryption/controllers/kms_preflight_controller_test.go	The controller stores and passes separate clients. Hash construction and test setup use the updated constructor and provider arguments.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: ardaguclu, dgrisonnet

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes replacing CoreV1Interface with SecretsGetter and ConfigMapsGetter in KMS preflight functionality.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The changed test file uses standard Go t.Run with 48 static scenario names; no Ginkgo titles or runtime-derived values appear, and the PR changes no test titles.
Test Structure And Quality	✅ Passed	The changed tests use Go subtests with fresh fake clients, not Ginkgo; they add no cluster waits or resource creation, and each scenario has focused checks with diagnostic errors.
Microshift Test Compatibility	✅ Passed	The commit adds no Ginkgo e2e tests. It changes controller wiring and existing Go unit-test call sites only, so MicroShift API compatibility checks do not apply.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The patch changes only controller code and standard Go unit tests; it adds no Ginkgo e2e tests or multi-node assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The diff only changes Kubernetes client interfaces and constructor wiring; it adds no replicas, affinity, topology spread, selectors, tolerations, or disruption budgets.
Ote Binary Stdout Contract	✅ Passed	The PR only changes Kubernetes client wiring and test call sites; it adds no main/init/suite setup or stdout writes. The existing klog call is inside controller sync logic.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR adds no Ginkgo e2e tests; its only test changes update fake client arguments. No new IPv4 or external-connectivity assumptions are introduced.
No-Weak-Crypto	✅ Passed	The commit only replaces CoreV1Interface wiring; it adds no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparison.
Container-Privileges	✅ Passed	The PR changes only two Go files and adds no privilege indicators; the adjacent KMS manifest's existing hostNetwork setting is unchanged.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only changes typed client wiring; it adds no logging and does not log Secret or ConfigMap values, credentials, tokens, or API keys.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[ardaguclu]

/lgtm
/approve

[ardaguclu]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ardaguclu, p0lyn0mial

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• pkg/operator/encryption/OWNERS [ardaguclu,p0lyn0mial]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@p0lyn0mial: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.