NO-JIRA: update KMS tests with bump library-go changes

[gangwgr]

update KMS tests with bump library-go changes

Summary by CodeRabbit

• Bug Fixes
  • Improved OAuth API server encryption configuration handling.
  • Updated encryption testing to use standardized KMS test scenarios, improving test consistency and reliability.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@gangwgr: This pull request explicitly references no jira issue.

Details

In response to this:

update KMS tests with bump library-go changes

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 484c5989-5086-4e91-aa68-490cd1d99135

📥 Commits

Reviewing files that changed from the base of the PR and between df55109 and 60e533b.

⛔ Files ignored due to path filters (11)

• go.sum is excluded by !**/*.sum
• vendor/github.com/openshift/library-go/pkg/crypto/crypto.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/library-go/pkg/operator/apiserver/controllerset/apiservercontrollerset.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/key_controller.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/kms_preflight_controller.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/encryption_status_provider.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/library-go/pkg/operator/encryption/statemachine/transition.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/library-go/test/library/encryption/helpers.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/library-go/test/library/encryption/kms/scenarios.go is excluded by !**/vendor/**, !vendor/**
• vendor/modules.txt is excluded by !**/vendor/**, !vendor/**

📒 Files selected for processing (3)

• go.mod
• pkg/operator/starter.go
• test/e2e-encryption-kms/encryption_kms.go

---

Walkthrough

The change updates the library-go dependency, configures OAuth API server encryption controllers with NoopEncryptionConfigurationComputer, and replaces locally constructed KMS test scenarios with shared librarykms factories.

Changes

Encryption configuration and validation

Layer / File(s)	Summary
Library update and OAuth encryption wiring go.mod, pkg/operator/starter.go	The library-go dependency is upgraded. The OAuth API server encryption controller configuration now includes NoopEncryptionConfigurationComputer.
Shared KMS scenario integration test/e2e-encryption-kms/encryption_kms.go	The KMS tests now use librarykms.EncryptionTurnOnAndOffScenarios and librarykms.EncryptionProvidersMigrationScenarios instead of locally constructed scenarios.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to 60e53

The PR updates KMS tests and library-go dependencies. No actionable merge-blocking risk remains; it is merge-ready after normal checks and review, with documentation alignment as an optional follow-up if broader scenario coverage is intended.

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Test Structure And Quality	⚠️ Warning	The new KMS factories create SecretOfLife, RouteOfLife, and the cluster-scoped TokenOfLife, but no BeforeEach/AfterEach, DeferCleanup, or t.Cleanup removes them.	Register cleanup for every created resource, including the cluster-scoped OAuth token, through Ginkgo DeferCleanup or t.Cleanup.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the library-go dependency update and related KMS test changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR keeps all Ginkgo titles as static string literals; the diff adds no It/Describe/Context title changes, and new scenario factories do not define Ginkgo titles.
Microshift Test Compatibility	✅ Passed	The diff adds no Ginkgo tests; it only changes existing It bodies. New scenarios use core Secret/ConfigMap and supported Route resources, while OAuth/config usage was pre-existing.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The diff adds no Ginkgo It/Describe/Context/When tests. Existing tests now use encryption scenario factories, which contain no SNO-sensitive node, affinity, failover, drain, or multi-endpoint assum...
Topology-Aware Scheduling Compatibility	✅ Passed	The diff adds only encryption-controller wiring and KMS test scenarios; it adds no manifests or affinity, spread, replica, node-selector, toleration, or PDB scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR diff adds no process-level stdout writes; it only wires encryption configuration and moves KMS scenario construction into test helpers.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR adds no Ginkgo tests. It only updates existing tests; added scenario code has no IPv4 literals or public endpoints, and Vault uses cluster-internal service DNS.
No-Weak-Crypto	✅ Passed	The diff adds only standard TLS curve mapping and KMS wiring. No weak primitive or custom crypto is added; SHA1/RC4/3DES references in vendored crypto.go predate the commit.
Container-Privileges	✅ Passed	The PR changes only Go/module/vendor files; added diff lines contain no privilege fields, and no container or Kubernetes manifest is changed.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds no sensitive logging. Its only logging change records a Secret name and Kubernetes create error; new KMS scenarios contain no logging calls or secret/token values.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign ingvagabund for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[gangwgr]

/pipeline required

[openshift-merge-bot]

Scheduling required tests:
/test e2e-agnostic
/test e2e-agnostic-upgrade
/test e2e-console-login
/test e2e-gcp-operator-disruptive
/test e2e-oidc
/test e2e-operator

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-operator-encryption-kms
/test e2e-aws-operator-encryption-kms-2
/test e2e-gcp-operator-encryption-perf
/test e2e-gcp-operator-encryption-rotation
/test e2e-operator-encryption

[gangwgr]

/test e2e-gcp-operator-encryption-perf

[gangwgr]

/test e2e-aws-operator-encryption-kms

[openshift-ci]

@gangwgr: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-operator-encryption-kms	60e533b	link	false	/test e2e-aws-operator-encryption-kms

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.