NO-JIRA: add KMS preflight deploy e2e to encryption-kms-2 by tjungblu · Pull Request #956 · openshift/cluster-authentication-operator

tjungblu · 2026-07-24T10:11:56Z

Summary

Adds TestKMSPreflightDeploy to test/e2e-encryption-kms/encryption_kms_2.go with [Suite:encryption-kms-2] so it runs in the *-2 job.
Uses NewPodPreflightDeployer against openshift-oauth-apiserver and asserts the preflight pod does not use hostNetwork.
Depends on library-go d8f45c2 (already vendored via NO-JIRA: Automatic agentic rebase: Update library-go to d8f45c2 #954), mirroring the KAS-O wiring in NO-JIRA: fake bump for preflight drift test cluster-kube-apiserver-operator#2233.

Test plan

Confirm package builds (go test -c ./test/e2e-encryption-kms/)
CI encryption-kms-2 job picks up TestKMSPreflightDeploy
Preflight deploy succeeds and asserts non-hostNetwork on oauth-apiserver

Made with Cursor

Summary by CodeRabbit

Tests
- Added a feature-gated end-to-end test for KMS preflight deployments.
- Validated that the resulting preflight pods/deployment output matches the expected operand and encryption configuration.
- Ensured coverage for Vault-based encryption provider configuration during preflight deployment.

openshift-merge-bot · 2026-07-24T10:11:59Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-07-24T10:12:00Z

@tjungblu: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

Adds TestKMSPreflightDeploy to test/e2e-encryption-kms/encryption_kms_2.go with [Suite:encryption-kms-2] so it runs in the *-2 job.

Uses NewPodPreflightDeployer against openshift-oauth-apiserver and asserts the preflight pod does not use hostNetwork.

Depends on library-go d8f45c2 (already vendored via NO-JIRA: Automatic agentic rebase: Update library-go to d8f45c2 #954), mirroring the KAS-O wiring in NO-JIRA: fake bump for preflight drift test cluster-kube-apiserver-operator#2233.

Test plan

Confirm package builds (go test -c ./test/e2e-encryption-kms/)

CI encryption-kms-2 job picks up TestKMSPreflightDeploy

Preflight deploy succeeds and asserts non-hostNetwork on oauth-apiserver

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-07-24T10:12:53Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 35667310-1eed-4742-ad4f-2454209da9cf

📥 Commits

Reviewing files that changed from the base of the PR and between 91a4292 and 340d966.

📒 Files selected for processing (1)

test/e2e-encryption-kms/encryption_kms_2.go

🚧 Files skipped from review as they are similar to previous changes (1)

test/e2e-encryption-kms/encryption_kms_2.go

Walkthrough

The KMS encryption e2e suite adds a feature-gated preflight deployment test using Vault encryption configuration, the authentication-operator image, and an in-memory events recorder.

Changes

KMS preflight deployment

Layer / File(s)	Summary
Configure and run preflight validation `test/e2e-encryption-kms/encryption_kms_2.go`	Adds preflight deployment dependencies and a gated Ginkgo test that configures the Vault scenario, creates a `PodPreflightDeployer`, and validates the resulting pod against the operand.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: bertinatto, gangwgr

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Microshift Test Compatibility	⚠️ Warning	It adds an unguarded e2e that uses config.openshift.io types and targets openshift-oauth-apiserver/openshift-authentication-operator, with no MicroShift skip or apigroup label.	Add a MicroShift guard or [Skipped:MicroShift]/[apigroup:...] label, or avoid MicroShift-incompatible OpenShift-specific config/operand namespaces in this test.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: adding a KMS preflight deploy e2e test to encryption-kms-2.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The new Ginkgo titles are static literals; no generated IDs, timestamps, names, or other run-to-run varying data appear in any test title.
Test Structure And Quality	✅ Passed	PASS: the new It is single-purpose, relies on shared helpers for cleanup and bounded waits, and follows the package’s existing Ginkgo pattern.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The new test uses NewPodPreflightDeployer, and the pod template only sets hostNetwork in StaticPod mode; no multi-node/topology assumptions or SNO skips are present.
Topology-Aware Scheduling Compatibility	✅ Passed	Only an e2e test was added; no deployment manifests, controllers, replicas, node selectors, anti-affinity, or spread constraints changed.
Ote Binary Stdout Contract	✅ Passed	The new preflight code runs only inside a Ginkgo It; package-level init/TestMain contain no stdout writes or logging setup.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The new Ginkgo test uses only cluster-internal deployment/image and Vault service helpers; no IPv4 literals, IP parsing, or public internet calls were found.
No-Weak-Crypto	✅ Passed	The new test only wires preflight deployment and Vault helpers; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret-comparison code was added.
Container-Privileges	✅ Passed	Only a new test was added; it uses NewPodPreflightDeployer and introduces no privileged, hostNetwork, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The diff adds no logging calls; it only wires a preflight deployer with fixed identifiers and no passwords, tokens, PII, or hostnames are emitted.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

ardaguclu · 2026-07-27T06:41:05Z

+			)
+		},
+		CreateEncryptionConfigFunc: library.VaultPreflightEncryptionConfigSecret,
+		AssertDeployFunc: func(ctx context.Context, t testing.TB, cs library.ClientSet, namespace string, deployer *preflight.PodPreflightDeployer) {


Suggested change

AssertDeployFunc: func(ctx context.Context, t testing.TB, cs library.ClientSet, namespace string, deployer *preflight.PodPreflightDeployer) {

AssertDeployFunc: library.AssertPreflightDeploy,

ardaguclu · 2026-07-27T06:42:25Z

+	)
+	library.TestPreflightDeployAndPodMatchesOperand(ctx, t, library.PreflightDeployScenario{
+		BasicScenario: library.BasicScenario{
+			Namespace:     operandNS,


Can you please document why do we use operandNS comparing to the other scenarios?

Documented why preflight targets the operand namespace here and switched to the shared library.AssertPreflightDeploy helper.

Wire library-go TestPreflightDeployAndPodMatchesOperand into the encryption-kms-2 suite so oauth-apiserver preflight Deploy is covered. Co-authored-by: Cursor <cursoragent@cursor.com>

Document why the preflight scenario targets the operand namespace and reuse the shared deploy assertion helper. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

openshift-ci · 2026-07-27T08:39:02Z

@tjungblu: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

ardaguclu · 2026-07-27T09:04:58Z

/lgtm
/approve
we need to see the job green

openshift-merge-bot · 2026-07-27T09:05:33Z

Scheduling required tests:
/test e2e-agnostic
/test e2e-agnostic-upgrade
/test e2e-console-login
/test e2e-gcp-operator-disruptive
/test e2e-oidc
/test e2e-operator

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-operator-encryption-kms
/test e2e-aws-operator-encryption-kms-2
/test e2e-operator-encryption

openshift-ci · 2026-07-27T09:06:06Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ardaguclu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [ardaguclu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 24, 2026

openshift-ci Bot requested review from bertinatto and gangwgr July 24, 2026 10:12

This was referenced Jul 24, 2026

[Auto-Generated] KMS Team PR Dashboard openshift/library-go#2268

Open

[Auto-Generated] Personal Workflow Brief tjungblu/agent#5

Open

NO-JIRA: add KMS preflight deploy e2e to encryption-kms-2 openshift/cluster-openshift-apiserver-operator#739

Open

ardaguclu reviewed Jul 27, 2026

View reviewed changes

tjungblu and others added 2 commits July 27, 2026 09:05

NO-JIRA: add KMS preflight deploy e2e to encryption-kms-2

544e659

Wire library-go TestPreflightDeployAndPodMatchesOperand into the encryption-kms-2 suite so oauth-apiserver preflight Deploy is covered. Co-authored-by: Cursor <cursoragent@cursor.com>

NO-JIRA: address preflight e2e review feedback

91a4292

Document why the preflight scenario targets the operand namespace and reuse the shared deploy assertion helper. Co-authored-by: Cursor <cursoragent@cursor.com>

tjungblu force-pushed the preflight-drift-test branch from 44e2221 to 91a4292 Compare July 27, 2026 07:05

NO-JIRA: gofmt encryption_kms_2.go

340d966

Co-authored-by: Cursor <cursoragent@cursor.com>

openshift-ci Bot assigned ardaguclu Jul 27, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 27, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

NO-JIRA: add KMS preflight deploy e2e to encryption-kms-2#956

NO-JIRA: add KMS preflight deploy e2e to encryption-kms-2#956
tjungblu wants to merge 3 commits into
openshift:masterfrom
tjungblu:preflight-drift-test

tjungblu commented Jul 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

openshift-merge-bot Bot commented Jul 24, 2026

Uh oh!

openshift-ci-robot commented Jul 24, 2026

Summary

Test plan

Uh oh!

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading

❌ Failed checks (1 warning)

Uh oh!

ardaguclu Jul 27, 2026

Uh oh!

ardaguclu Jul 27, 2026

Uh oh!

tjungblu Jul 27, 2026

Uh oh!

openshift-ci Bot commented Jul 27, 2026

Uh oh!

ardaguclu commented Jul 27, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 27, 2026

Uh oh!

openshift-ci Bot commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	AssertDeployFunc: func(ctx context.Context, t testing.TB, cs library.ClientSet, namespace string, deployer *preflight.PodPreflightDeployer) {
	AssertDeployFunc: library.AssertPreflightDeploy,

Uh oh!

Conversation

tjungblu commented Jul 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Jul 24, 2026

Uh oh!

openshift-ci-robot commented Jul 24, 2026

Summary

Test plan

Uh oh!

coderabbitai Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

ardaguclu Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

ardaguclu Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

tjungblu Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Jul 27, 2026

Uh oh!

ardaguclu commented Jul 27, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 27, 2026

Uh oh!

openshift-ci Bot commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tjungblu commented Jul 24, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading