WIP: with encryptionstatusclient

[p0lyn0mial]

xref: openshift/cluster-kube-apiserver-operator#2225

xref: openshift/api#2916

Summary by CodeRabbit

• New Features

  • KMS preflight checks now record success or failure results, configuration details, and remote key identifiers in encryption status.
  • KMS health monitoring now publishes status through a unified status client.
  • Preflight reporting distinguishes remote key identifiers more clearly.

• Bug Fixes

  • Failed preflight checks now persist their results before reporting the failure, improving visibility during troubleshooting.

• Tests

  • Added coverage for status updates, remote key identifiers, and health-reporting metadata.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Walkthrough

Adds a shared KMS encryption status client, persists preflight results including remote key IDs, and migrates KMS health reporting from dedicated writers to server-side status application. It also renames the preflight pod condition and updates module resolution.

Changes

KMS status reporting

Layer / File(s)	Summary
Status client and preflight result persistence pkg/operator/encryption/kms/encryptionstatus/client.go, pkg/operator/encryption/controllers/kms_preflight_controller.go, pkg/operator/encryption/kms/preflight/*, pkg/operator/encryption/controllers/kms_preflight_controller_test.go	Defines status read/apply/update operations, records successful or failed preflight results, captures remote key IDs, and updates related pod-condition tests.
Health reporter status-client integration pkg/operator/encryption/kms/health/cmd.go, pkg/operator/encryption/kms/health/options.go, pkg/operator/encryption/kms/health/cmd_test.go, pkg/operator/encryption/kms/health/writers/writers.go	Uses KMSEncryptionStatusClient.ApplyKMSEncryptionStatus with the configured field manager and removes the previous writer implementations.

Module resolution

Layer / File(s)	Summary
Dependency revision and local replacements go.mod	Updates the OpenShift API revision and adds local replacements for OpenShift API modules.

Estimated code review effort: 3 (Moderate) | ~30 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PreflightPod
  participant KMSPreflightController
  participant KMSEncryptionStatusClient
  PreflightPod->>KMSPreflightController: Report preflight conditions
  KMSPreflightController->>KMSEncryptionStatusClient: Update Preflight.Result
  KMSEncryptionStatusClient-->>KMSPreflightController: Persist status

Loading

Suggested reviewers: ibihim

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is related to the change, but it is too vague and marked as WIP, so it doesn't clearly summarize the main update.	Replace it with a concise, descriptive title that states the main change, such as adding KMSEncryptionStatusClient integration.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No changed test titles contain dynamic data; all t.Run and Test names in the touched files are static and deterministic.
Test Structure And Quality	✅ Passed	PASS: The touched tests are unit/table-driven, use explicit cleanup/timeout where needed, and introduce no Ginkgo-style waits or resource leaks.
Microshift Test Compatibility	✅ Passed	PASS: No new Ginkgo e2e tests were added; the changed tests are plain Go unit tests, so MicroShift API compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The PR only updates standard Go unit tests under pkg/operator/...; I found no Ginkgo e2e tests or multi-node/SNO assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR only changes KMS status reporting/preflight result plumbing; I found no node selectors, affinities, spread constraints, replica logic, or control-plane/worker assumptions in the touched code.
Ote Binary Stdout Contract	✅ Passed	No new stdout writes appear in process-level code; modified files only add klog logging, and vendored klog defaults to stderr.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The diff only changes unit-test helpers in pod_status.go/test; no Ginkgo e2e tests, IPv4-only assumptions, or external network calls were added.
No-Weak-Crypto	✅ Passed	PASS: The changed files add no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, no custom crypto, and no non-constant-time secret/token comparisons.
Container-Privileges	✅ Passed	The PR diff only changes pod status condition names in Go code; no container/K8s manifests or privilege settings appear in the touched files.
No-Sensitive-Data-In-Logs	✅ Passed	No changed log call exposes secrets/PII; the modified logs only emit startup config and operational status, not credentials or customer data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

⚔️ Resolve merge conflicts

• Resolve merge conflict in branch kms-preflight-check

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: p0lyn0mial

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [p0lyn0mial]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Around line 153-156: Remove the machine-specific replace directives for
github.com/openshift/api and github.com/openshift/client-go from go.mod.
Preserve the existing pinned module versions so dependency resolution remains
reproducible; use an uncommitted go.work or equivalent local override only for
development.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 9737c22a-195f-40cb-a6ac-be6282edbea6

📥 Commits

Reviewing files that changed from the base of the PR and between 795ac1a and 83e4384.

⛔ Files ignored due to path filters (85)

• go.sum is excluded by !**/*.sum
• vendor/github.com/openshift/api/.golangci.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/Makefile is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/apps/.codegen.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/authorization/.codegen.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/build/.codegen.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/cloudnetwork/.codegen.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/register.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/types_cluster_version.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/types_crio_credential_provider_config.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/types_infrastructure.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/types_network.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/config/v1/zz_generated.model_name.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/features.md is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/features/features.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/image/.codegen.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/network/.codegen.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/networkoperator/.codegen.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/oauth/.codegen.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/operator/v1/types_authentication.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/operator/v1/types_csi_cluster_driver.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/osin/v1/types.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/osin/v1/zz_generated.swagger_doc_generated.go is excluded by !**/vendor/**, !vendor/**, !**/zz_generated*
• vendor/github.com/openshift/api/project/.codegen.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/quota/.codegen.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/route/.codegen.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/samples/.codegen.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/security/.codegen.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/template/.codegen.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/api/user/.codegen.yaml is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/apps/applyconfigurations/internal/internal.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/criocredentialproviderconfig.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/criocredentialproviderconfigspec.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/criocredentialproviderconfigstatus.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/infrastructurespec.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/networkobservabilityspec.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/remotewriteauthorization.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/remotewritespec.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/applyconfigurations/utils.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1/config_client.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1/criocredentialproviderconfig.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1/fake/fake_config_client.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1/fake/fake_criocredentialproviderconfig.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1/generated_expansion.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/criocredentialproviderconfig.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/informers/externalversions/config/v1/interface.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/informers/externalversions/generic.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/listers/config/v1/criocredentialproviderconfig.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/config/listers/config/v1/expansion_generated.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/internal/internal.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/authenticationconfigmapreference.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/authenticationproxyconfig.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/authenticationspec.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/awsnetworkloadbalancerparameters.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/csidriverconfigspec.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/customsecretrotation.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollerspec.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollerstatus.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/kmsencryptionstatus.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/kmspreflightcheck.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/kmspreflightresult.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/managedtokenrequests.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/secretsstorecsidriverconfigspec.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/secretsstoresecretrotation.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/secretsstoretokenrequest.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/secretsstoretokenrequests.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operator/applyconfigurations/utils.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/operatorcontrolplane/applyconfigurations/internal/internal.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/quota/applyconfigurations/internal/internal.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/route/applyconfigurations/internal/internal.go is excluded by !**/vendor/**, !vendor/**
• vendor/github.com/openshift/client-go/user/applyconfigurations/internal/internal.go is excluded by !**/vendor/**, !vendor/**
• vendor/modules.txt is excluded by !**/vendor/**, !vendor/**

📒 Files selected for processing (10)

• go.mod
• pkg/operator/encryption/controllers/kms_preflight_controller.go
• pkg/operator/encryption/controllers/kms_preflight_controller_test.go
• pkg/operator/encryption/kms/encryptionstatus/client.go
• pkg/operator/encryption/kms/health/cmd.go
• pkg/operator/encryption/kms/health/cmd_test.go
• pkg/operator/encryption/kms/health/options.go
• pkg/operator/encryption/kms/health/writers/writers.go
• pkg/operator/encryption/kms/preflight/pod_status.go
• pkg/operator/encryption/kms/preflight/pod_status_test.go

💤 Files with no reviewable changes (1)

• pkg/operator/encryption/kms/health/writers/writers.go

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Remove the machine-specific module replacements.

Lines 154-156 resolve dependencies from /Users/lszaszki/..., so CI and other developers will fail before compilation unless they reproduce that local filesystem. These replacements also bypass the pinned module revision and make builds depend on untracked local source.

Remove them from go.mod; use an uncommitted local go.work or equivalent developer-only override when needed.

As per path instructions, dependency resolution must remain pinned and reproducible.

Proposed fix

-replace github.com/openshift/api => /Users/lszaszki/go/src/github.com/openshift/api
-replace github.com/openshift/client-go => /Users/lszaszki/go/src/github.com/openshift/client-go

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	replace github.com/openshift/api => /Users/lszaszki/go/src/github.com/openshift/api
	replace github.com/openshift/client-go => /Users/lszaszki/go/src/github.com/openshift/client-go

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 153 - 156, Remove the machine-specific replace
directives for github.com/openshift/api and github.com/openshift/client-go from
go.mod. Preserve the existing pinned module versions so dependency resolution
remains reproducible; use an uncommitted go.work or equivalent local override
only for development.

Source: Path instructions