NO-JIRA: address preflight e2e review feedback

Document why the preflight scenario targets the operand namespace and
reuse the shared deploy assertion helper.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: tjungblu

test/e2e-encryption-kms/encryption_kms_2.go

@@ -5,8 +5,6 @@ import (
 	"testing"
 
 	g "github.com/onsi/ginkgo/v2"
-	"github.com/stretchr/testify/require"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/utils/clock"
 
@@ -62,6 +60,9 @@ func testKMSEncryptionKMSToKMSMigration(ctx context.Context, t testing.TB) {
 
 func testKMSPreflightDeploy(ctx context.Context, t testing.TB) {
 	const (
+		// Preflight deploys into the operand namespace because the library-go
+		// scenario validates the actual workload pod wiring there, unlike the
+		// migration scenarios that operate on the rendered encryption config.
 		operandNS  = "openshift-oauth-apiserver"
 		operatorNS = "openshift-authentication-operator"
 	)
@@ -79,12 +80,7 @@ func testKMSPreflightDeploy(ctx context.Context, t testing.TB) {
 			)
 		},
 		CreateEncryptionConfigFunc: library.VaultPreflightEncryptionConfigSecret,
-		AssertDeployFunc: func(ctx context.Context, t testing.TB, cs library.ClientSet, namespace string, deployer *preflight.PodPreflightDeployer) {
-			library.AssertPreflightDeploy(ctx, t, cs, namespace, deployer)
-			pod, err := cs.Kube.CoreV1().Pods(namespace).Get(ctx, preflight.PodName, metav1.GetOptions{})
-			require.NoError(t, err)
-			require.False(t, pod.Spec.HostNetwork, "non-static preflight should not use hostNetwork")
-		},
+		AssertDeployFunc:           library.AssertPreflightDeploy,
 		EncryptionProvider: librarykms.DefaultVaultEncryptionProvider(ctx, t),
 	})
 }