CNTRLPLANE-3237: kms key controller preflight support- #747 - #965
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
|
@p0lyn0mial: This pull request references CNTRLPLANE-3237 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (13)
WalkthroughThe change updates the ChangesOAuth encryption integration
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ardaguclu The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
Scheduling required tests: Scheduling tests matching the |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/operator/starter.go`:
- Around line 719-720: Replace NewAlwaysSucceedKMSPreflightDeployer() in the
starter setup with the real KMS preflight deployer used for production
validation, and wire it with the existing configuration and dependencies. Ensure
invalid KMS configuration fails the key-creation gate, and add coverage for that
failing configuration through the relevant starter or OAuth encryption tests.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 0bb14af3-2c1b-4f11-9cd3-c94563c9fc4e
⛔ Files ignored due to path filters (6)
go.sumis excluded by!**/*.sumvendor/github.com/openshift/library-go/pkg/operator/apiserver/controllerset/apiservercontrollerset.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/key_controller.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/preflight/deployer.gois excluded by!**/vendor/**,!vendor/**vendor/modules.txtis excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (2)
go.modpkg/operator/starter.go
| authEncryptionStatusProvider, | ||
| kmspreflight.NewAlwaysSucceedKMSPreflightDeployer(), |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n -C 8 \
'NewAlwaysSucceedKMSPreflightDeployer|EncryptionKMSPreflight|KMSPreflight|encryption-config' \
--glob '*.go' --glob '*.yaml' --glob '*.yml' .Repository: openshift/cluster-authentication-operator
Length of output: 50398
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- starter wiring ---'
sed -n '680,740p' pkg/operator/starter.go
printf '%s\n' '--- non-vendor KMS/encryption references ---'
rg -n -C 5 \
'NewAlwaysSucceedKMSPreflightDeployer|KMSPreflight|EncryptionConfig|encryption-config|kms' \
--glob '*.go' --glob '*.yaml' --glob '*.yml' \
--glob '!vendor/**' .
printf '%s\n' '--- library implementation and controller references ---'
rg -n -C 12 \
'type AlwaysSucceed|NewAlwaysSucceedKMSPreflightDeployer|AlwaysSucceedKMSPreflightDeployer|preflight.*Succeeded|KMSPreflight' \
vendor/github.com/openshift/library-go/pkg/operator/encryption/kms \
vendor/github.com/openshift/library-go/pkg/operator/encryption \
--glob '*.go'Repository: openshift/cluster-authentication-operator
Length of output: 50398
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- exact always-succeed implementation ---'
rg -l \
'NewAlwaysSucceedKMSPreflightDeployer|AlwaysSucceedKMSPreflightDeployer' \
vendor/github.com/openshift/library-go --glob '*.go' |
while IFS= read -r file; do
echo "FILE: $file"
cat -n "$file"
done
printf '%s\n' '--- encryption controller wiring and gate ---'
rg -l \
'WithEncryptionControllers|KMSPreflightDeployer|KMSPreflight|Preflight.*Succeeded|Succeeded.*Preflight' \
vendor/github.com/openshift/library-go/pkg/operator --glob '*.go' |
while IFS= read -r file; do
echo "FILE: $file"
rg -n -C 15 \
'WithEncryptionControllers|KMSPreflightDeployer|KMSPreflight|Preflight.*Succeeded|Succeeded.*Preflight' \
"$file"
doneRepository: openshift/cluster-authentication-operator
Length of output: 39169
Use a real KMS preflight deployer in production.
NewAlwaysSucceedKMSPreflightDeployer() fabricates a successful result, so invalid KMS configuration can pass the key-creation gate. OAuth API server encryption supports KMS. Add coverage for a failing KMS configuration.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pkg/operator/starter.go` around lines 719 - 720, Replace
NewAlwaysSucceedKMSPreflightDeployer() in the starter setup with the real KMS
preflight deployer used for production validation, and wire it with the existing
configuration and dependencies. Ensure invalid KMS configuration fails the
key-creation gate, and add coverage for that failing configuration through the
relevant starter or OAuth encryption tests.
|
/hold until the kms jobs post their results. |
openshift-ci
Bot
added
the
do-not-merge/hold
decaa40 to
6ade05a
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
|
/lgtm |
|
Scheduling required tests: Scheduling tests matching the |
|
/hold cancel |
openshift-ci
Bot
removed
the
do-not-merge/hold
openshift-ci-robot
added
the
verified
|
@ardaguclu: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
removed
the
verified
|
/lgtm |
|
@p0lyn0mial: This pull request references CNTRLPLANE-3237 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Scheduling required tests: Scheduling tests matching the |
|
/verified by CI |
openshift-ci-robot
added
the
verified
|
@p0lyn0mial: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@p0lyn0mial: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
Summary by CodeRabbit