CNTRLPLANE-3234: wire KMS health reporter status writer

[ibihim]

What

• bump library-go
• wire up health reporter
• add kms v2 test suite

Why

• library-go contains new changes, that conflict with the current stub.
• health reporter is now working and can generate useful data.
• Something was off with the test suite, following @gangwgr suggestion.

[openshift-ci-robot]

@ibihim: This pull request explicitly references no jira issue.

Details

In response to this:

What

Replaces the nil, nil operator-client stub in the kms-health-reporter command registration with the real status writer from library-go: writers.NewAuthenticationWriter.

The reporter now SSA-applies KMS plugin health reports to Authentication/cluster at .status.oauthAPIServer.encryptionStatus, using the per-node fieldManager (kms-health-reporter-<node>) that library-go derives from --node-name, so reporters on different nodes co-own the health reports without conflicts.

Why now

The latest library-go reworked the health reporter integration: the v1helpers.OperatorClient factory hook was replaced by a narrow EncryptionStatusWriter (kms/health + kms/health/writers packages). The old stub no longer matches the API, and since the new Config.Run calls the writer unconditionally, a nil writer is no longer a safe placeholder.

library-go pin

Uses the same fork pin as openshift/cluster-kube-apiserver-operator#2223 and #2224 (gangwgr/library-go@7c4cf6073c53), which contains the kms/health/writers package. Intended to be swapped to an upstream openshift/library-go bump before merge.

Sibling PRs: openshift/cluster-kube-apiserver-operator#2224

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

Walkthrough

The authentication operator's KMS health command now uses a concrete authentication writer. The library-go requirement is updated, and KMS test selection is split into separate suites with an openshift/kms dependency.

Changes

KMS Health and Test Integration

Layer / File(s)	Summary
Authentication KMS health wiring cmd/authentication-operator/main.go, go.mod	Registers kmshealth.NewCommand with kmswriters.NewAuthenticationWriter and updates the required github.com/openshift/library-go version.
KMS test suite routing cmd/cluster-authentication-operator-tests-ext/main.go	Excludes encryption-kms-2 tests from encryption-kms and adds a serialized encryption-kms-2 suite dependent on openshift/kms.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• openshift/cluster-authentication-operator#944: Also changes encryption/KMS test suite selection and filtering.

Suggested labels: lgtm

Suggested reviewers: gangwgr

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Container-Privileges	❌ Error	The vendored KMS preflight pod template adds hostNetwork: true (and runAsUser: 0) in kms-preflight-pod.yaml.	Remove or justify the insecure pod settings in the changed manifest, or exclude vendored third-party manifests from this check.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No Ginkgo test titles changed; the patch only updates command wiring, vendored library code, and no *_test.go files.
Test Structure And Quality	✅ Passed	No Ginkgo/Gomega test files were changed; the diff only updates command/vendor code, so the checklist is not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; changes only rewire KMS health command wiring and bump vendored library-go, so MicroShift compatibility is not implicated.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the PR only rewires KMS health command wiring and updates vendored library-go code.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: PR only rewires KMS health reporter writer; no new affinity, nodeSelector, tolerations, replica, or topology-aware scheduling logic in auth operator.
Ote Binary Stdout Contract	✅ Passed	No process-level stdout writes were added; the auth-operator main only rewires KMS command registration and the OTE entrypoint still logs to stderr.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only rewires kms-health command and updates vendored library-go; no new Ginkgo e2e tests, IPv4 literals, or external connectivity assumptions found.
No-Weak-Crypto	✅ Passed	Diff only rewires the KMS health writer and bumps library-go; no added weak crypto, custom crypto, or secret comparisons appear in changed lines.
No-Sensitive-Data-In-Logs	✅ Passed	The diff adds no logs with secrets/PII; the only logging is generic startup/error reporting and no new sensitive fields are introduced.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: wiring the KMS health reporter to use the authentication status writer.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Tools execution failed with the following error:

Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@ibihim: This pull request references CNTRLPLANE-3234 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

What

Replaces the nil, nil operator-client stub in the kms-health-reporter command registration with the real status writer from library-go: writers.NewAuthenticationWriter.

The reporter now SSA-applies KMS plugin health reports to Authentication/cluster at .status.oauthAPIServer.encryptionStatus, using the per-node fieldManager (kms-health-reporter-<node>) that library-go derives from --node-name, so reporters on different nodes co-own the health reports without conflicts.

Why now

The latest library-go reworked the health reporter integration: the v1helpers.OperatorClient factory hook was replaced by a narrow EncryptionStatusWriter (kms/health + kms/health/writers packages). The old stub no longer matches the API, and since the new Config.Run calls the writer unconditionally, a nil writer is no longer a safe placeholder.

library-go pin

Uses the same fork pin as openshift/cluster-kube-apiserver-operator#2223 and #2224 (gangwgr/library-go@7c4cf6073c53), which contains the kms/health/writers package. Intended to be swapped to an upstream openshift/library-go bump before merge.

Sibling PRs: openshift/cluster-kube-apiserver-operator#2224

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

• Improved the authentication operator’s KMS health command so it now uses the appropriate authentication-backed writer when checking and reporting health.

• Chores

• Updated a dependency source used by the operator to a newer library revision.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tjungblu]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tjungblu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [tjungblu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ardaguclu]

/hold
Go.mod is wrong

[tjungblu]

/hold gomod is also wrong here

[ibihim]

/retest

[ibihim]

lol

[tjungblu]

/retest

[tjungblu]

/lgtm

[gangwgr]

/unhold

[gangwgr]

/test e2e-aws-operator-encryption-kms-2

[tjungblu]

/lgtm

[gangwgr]

/verified by ci runs

[openshift-ci-robot]

@gangwgr: This PR has been marked as verified by ci runs.

Details

In response to this:

/verified by ci runs

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@ibihim: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.