Migrate kms operator tests cases to library-go

[gangwgr]

Migrate kms operator tests cases to library-go

Summary by CodeRabbit

• Tests
  • Added coverage for migrating KAS, Auth, and OAS between KMS-backed encryption providers.
  • Added validation that resources remain encrypted and continue using KMS after migration.
  • Added a preflight deployment scenario to verify generated encryption configuration against the live service.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e93564da-49d2-44fc-abc9-87ded7369134

📥 Commits

Reviewing files that changed from the base of the PR and between 0387a19 and ed1809b.

📒 Files selected for processing (1)

• test/library/encryption/kms/scenarios.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

Added KMS-to-KMS migration scenarios for KAS, Auth, and OAS. Added a KAS preflight deployment scenario that runs kms-preflight against the live operand and validates the generated encryption configuration.

Changes

KMS encryption scenarios

Layer / File(s)	Summary
KAS preflight deployment scenario test/library/encryption/kms/scenarios.go	Adds dependencies and constructs a KAS preflight scenario. The scenario discovers the operator image, runs kms-preflight against the live operand, records events, and validates the encryption configuration.
KMS-to-KMS migration assertions test/library/encryption/kms/scenarios.go	Adds KAS, Auth, and OAS migration wrappers. The wrappers retain existing encryption assertions and verify KMS encryption for each operator’s selector and resource type.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to ed180

This PR makes a localized test migration change, and no actionable merge-blocking risk remains beyond normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant Scenario as KAS preflight scenario
  participant Discovery as Operator image discovery
  participant Operand as Live operand
  participant Preflight as kms-preflight
  participant Config as Encryption configuration
  Scenario->>Discovery: Discover operator image
  Scenario->>Operand: Deploy preflight command
  Operand->>Preflight: Run kms-preflight
  Preflight->>Config: Generate configuration
  Scenario->>Config: Validate configuration

Loading

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Container-Privileges	❌ Error	The new PreflightDeployScenario calls NewStaticPodPreflightDeployer, which sets StaticPod=true and renders hostNetwork: true in the deployed KMS preflight pod.	Use the normal preflight deployer without hostNetwork, or remove this scenario's static-pod mode and validate the operand through a non-host-networked pod.
Test Structure And Quality	⚠️ Warning	The added KMS migration scenarios reuse CreateAndStoreWellKnownTokenOfLife, which creates the cluster-scoped OAuthAccessToken without registering cleanup; the migration runner has no cleanup hook.	Add migration-test cleanup, preferably via t.Cleanup or an AfterEach-equivalent, for the OAuthAccessToken and other well-known resources created by each scenario.

✅ Passed checks (13 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the migration of KMS operator test cases to library-go, which matches the pull request objective and changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The diff adds no Ginkgo title calls; generated migration step names use only static provider types and ResourceName values, while shuffling changes order only.
Microshift Test Compatibility	✅ Passed	The diff adds only library scenario factories; structural searches found no new Ginkgo It/Describe/Context/When declarations, and the new exports have no test call sites.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The diff adds only library scenario factories and helper callbacks; it adds no Ginkgo It/Describe/Context/When test and contains no multi-node or HA assumption.
Topology-Aware Scheduling Compatibility	✅ Passed	The commit changes only test/library/encryption/kms/scenarios.go; it adds test scenarios and preflight wiring, with no affinity, topology, replica, selector, toleration, or manifest changes.
Ote Binary Stdout Contract	✅ Passed	The PR diff adds scenario factories and test callbacks only; no process-level stdout writes, suite hooks, or logging configuration changes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR adds scenario builders, not Ginkgo It/Describe tests. The only service address path uses net.JoinHostPort with a cluster Service IP; no IPv4 literals or public endpoints were added.
No-Weak-Crypto	✅ Passed	The exact diff adds KMS scenario wiring and preflight deployment calls only; it introduces no weak algorithm, cipher mode, custom crypto, or secret/token comparison.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds no sensitive logging. The new in-memory recorder handles only RBAC event names/errors, and provider setup logs service addresses and secret names, not credentials or tokens.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: gangwgr
Once this PR has been reviewed and has the lgtm label, please assign ardaguclu for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• test/library/encryption/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@gangwgr: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[p0lyn0mial]

could you open a test PR in kas-o so that we could see how the usage will look like ?

[gangwgr]

test running here openshift/cluster-kube-apiserver-operator#2270