Skip to content

CNTRLPLANE-3237: Kms plugin health report clean up #2931

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
p0lyn0mial wants to merge 2 commits into
base: master
Choose a base branch
from
Open

CNTRLPLANE-3237: Kms plugin health report clean up #2931

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
efb27c3
operator/v1: rename KMSPluginHealthReport fields and remove compatibi…
p0lyn0mial Jul 14, 2026
df6021b
make update
p0lyn0mial Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions openapi/generated_openapi/zz_generated.openapi.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

22 changes: 11 additions & 11 deletions openapi/openapi.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33973,15 +33973,15 @@
"type": "object",
"properties": {
"healthReports": {
"description": "healthReports contains all KMS plugin health reports. When omitted, no health reports are available. Each entry must have a unique combination of nodeName and keyId.",
"description": "healthReports contains all KMS plugin health reports. When omitted, no health reports are available. Each entry must have a unique combination of nodeName and keyID.",
"type": "array",
"items": {
"default": {},
"$ref": "#/definitions/com.github.openshift.api.operator.v1.KMSPluginHealthReport"
},
"x-kubernetes-list-map-keys": [
"nodeName",
"keyId"
"keyID"
],
"x-kubernetes-list-type": "map"
}
Expand All @@ -33991,30 +33991,30 @@
"type": "object",
"required": [
"nodeName",
"keyId",
"keyID",
"status",
"lastCheckedTime",
"kekId"
"remoteKeyID"
],
"properties": {
"detail": {
"description": "detail contains additional error/health information for the respective KMS plugin. When omitted, no additional error or health information is provided. When set, the value must be between 1 and 1024 characters.",
"type": "string"
},
"kekId": {
"description": "kekId refers to the remote KEK id from KMS v2 StatusResponse.key_id. This is not a cryptographic key, but a unique representation of the KEK. The value must be between 1 and 1024 characters.",
"type": "string"
},
"keyId": {
"description": "keyId is the encryption-key-secret id (kms-{keyId}.sock), a unique identifier of the plugin on that node. This is not a cryptographic key used to encrypt/decrypt any resources. The value must be between 1 and 512 characters.",
"keyID": {
"description": "keyID is the encryption-key-secret id (kms-{keyID}.sock), a unique identifier of the plugin on that node. This is not a cryptographic key used to encrypt/decrypt any resources. The value must be between 1 and 512 characters.",
"type": "string"
},
"lastCheckedTime": {
"description": "lastCheckedTime is a timestamp of when the probe was last checked.",
"$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time"
},
"nodeName": {
"description": "nodeName is the name of the node this instance of the plugin runs on. The combination of nodeName and keyId makes this health report unique. The value must be a valid Kubernetes node name: a lowercase RFC 1123 subdomain consisting of lowercase alphanumeric characters, '-' or '.', starting and ending with an alphanumeric character, and be at most 253 characters in length.",
"description": "nodeName is the name of the node this instance of the plugin runs on. The combination of nodeName and keyID makes this health report unique. The value must be a valid Kubernetes node name: a lowercase RFC 1123 subdomain consisting of lowercase alphanumeric characters, '-' or '.', starting and ending with an alphanumeric character, and be at most 253 characters in length.",
"type": "string"
},
"remoteKeyID": {
"description": "remoteKeyID refers to the remote KEK id from KMS v2 StatusResponse.key_id. This is not a cryptographic key, but a unique representation of the KEK. The value must be between 1 and 1024 characters.",
"type": "string"
},
"status": {
Expand Down
52 changes: 26 additions & 26 deletions operator/v1/tests/authentications.operator.openshift.io/KMSEncryption.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,10 @@ tests:
encryptionStatus:
healthReports:
- nodeName: node-a
keyId: key-1
keyID: key-1
status: Healthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-1
remoteKeyID: kek-1
expected: |
apiVersion: operator.openshift.io/v1
kind: Authentication
Expand All @@ -40,11 +40,11 @@ tests:
encryptionStatus:
healthReports:
- nodeName: node-a
keyId: key-1
keyID: key-1
status: Healthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-1
- name: Should accept multiple health reports with unique nodeName/keyId combinations
remoteKeyID: kek-1
- name: Should accept multiple health reports with unique nodeName/keyID combinations
initial: |
apiVersion: operator.openshift.io/v1
kind: Authentication
Expand All @@ -62,21 +62,21 @@ tests:
encryptionStatus:
healthReports:
- nodeName: node-a
keyId: key-1
keyID: key-1
status: Healthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-1
remoteKeyID: kek-1
- nodeName: node-a
keyId: key-2
keyID: key-2
status: Unhealthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-2
remoteKeyID: kek-2
detail: plugin unreachable
- nodeName: node-b
keyId: key-1
keyID: key-1
status: Error
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: arn:aws:kms:us-east-1:123456789012:key/abc
remoteKeyID: arn:aws:kms:us-east-1:123456789012:key/abc
detail: authentication failed
expected: |
apiVersion: operator.openshift.io/v1
Expand All @@ -91,23 +91,23 @@ tests:
encryptionStatus:
healthReports:
- nodeName: node-a
keyId: key-1
keyID: key-1
status: Healthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-1
remoteKeyID: kek-1
- nodeName: node-a
keyId: key-2
keyID: key-2
status: Unhealthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-2
remoteKeyID: kek-2
detail: plugin unreachable
- nodeName: node-b
keyId: key-1
keyID: key-1
status: Error
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: arn:aws:kms:us-east-1:123456789012:key/abc
remoteKeyID: arn:aws:kms:us-east-1:123456789012:key/abc
detail: authentication failed
- name: Should reject duplicate nodeName/keyId health reports
- name: Should reject duplicate nodeName/keyID health reports
initial: |
apiVersion: operator.openshift.io/v1
kind: Authentication
Expand All @@ -119,10 +119,10 @@ tests:
encryptionStatus:
healthReports:
- nodeName: node-a
keyId: key-1
keyID: key-1
status: Healthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-1
remoteKeyID: kek-1
updated: |
apiVersion: operator.openshift.io/v1
kind: Authentication
Expand All @@ -134,15 +134,15 @@ tests:
encryptionStatus:
healthReports:
- nodeName: node-a
keyId: key-1
keyID: key-1
status: Healthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-1
remoteKeyID: kek-1
- nodeName: node-a
keyId: key-1
keyID: key-1
status: Unhealthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-2
remoteKeyID: kek-2
detail: plugin error
expectedStatusError: "Duplicate value"
- name: Should reject an invalid nodeName in health reports
Expand All @@ -163,8 +163,8 @@ tests:
encryptionStatus:
healthReports:
- nodeName: INVALID
keyId: key-1
keyID: key-1
status: Healthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-1
remoteKeyID: kek-1
expectedStatusError: "nodeName must be a lowercase RFC 1123 subdomain"
52 changes: 26 additions & 26 deletions operator/v1/tests/kubeapiservers.operator.openshift.io/KMSEncryption.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,10 +18,10 @@ tests:
encryptionStatus:
healthReports:
- nodeName: node-a
keyId: key-1
keyID: key-1
status: Healthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-1
remoteKeyID: kek-1
expected: |
apiVersion: operator.openshift.io/v1
kind: KubeAPIServer
Expand All @@ -32,11 +32,11 @@ tests:
encryptionStatus:
healthReports:
- nodeName: node-a
keyId: key-1
keyID: key-1
status: Healthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-1
- name: Should accept multiple health reports with unique nodeName/keyId combinations
remoteKeyID: kek-1
- name: Should accept multiple health reports with unique nodeName/keyID combinations
initial: |
apiVersion: operator.openshift.io/v1
kind: KubeAPIServer
Expand All @@ -49,21 +49,21 @@ tests:
encryptionStatus:
healthReports:
- nodeName: node-a
keyId: key-1
keyID: key-1
status: Healthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-1
remoteKeyID: kek-1
- nodeName: node-a
keyId: key-2
keyID: key-2
status: Unhealthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-2
remoteKeyID: kek-2
detail: plugin unreachable
- nodeName: node-b
keyId: key-1
keyID: key-1
status: Error
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: arn:aws:kms:us-east-1:123456789012:key/abc
remoteKeyID: arn:aws:kms:us-east-1:123456789012:key/abc
detail: authentication failed
expected: |
apiVersion: operator.openshift.io/v1
Expand All @@ -75,23 +75,23 @@ tests:
encryptionStatus:
healthReports:
- nodeName: node-a
keyId: key-1
keyID: key-1
status: Healthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-1
remoteKeyID: kek-1
- nodeName: node-a
keyId: key-2
keyID: key-2
status: Unhealthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-2
remoteKeyID: kek-2
detail: plugin unreachable
- nodeName: node-b
keyId: key-1
keyID: key-1
status: Error
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: arn:aws:kms:us-east-1:123456789012:key/abc
remoteKeyID: arn:aws:kms:us-east-1:123456789012:key/abc
detail: authentication failed
- name: Should reject duplicate nodeName/keyId health reports
- name: Should reject duplicate nodeName/keyID health reports
initial: |
apiVersion: operator.openshift.io/v1
kind: KubeAPIServer
Expand All @@ -100,10 +100,10 @@ tests:
encryptionStatus:
healthReports:
- nodeName: node-a
keyId: key-1
keyID: key-1
status: Healthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-1
remoteKeyID: kek-1
updated: |
apiVersion: operator.openshift.io/v1
kind: KubeAPIServer
Expand All @@ -112,15 +112,15 @@ tests:
encryptionStatus:
healthReports:
- nodeName: node-a
keyId: key-1
keyID: key-1
status: Healthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-1
remoteKeyID: kek-1
- nodeName: node-a
keyId: key-1
keyID: key-1
status: Unhealthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-2
remoteKeyID: kek-2
detail: plugin error
expectedStatusError: "Duplicate value"
- name: Should reject an invalid nodeName in health reports
Expand All @@ -136,8 +136,8 @@ tests:
encryptionStatus:
healthReports:
- nodeName: INVALID
keyId: key-1
keyID: key-1
status: Healthy
lastCheckedTime: "2026-01-01T00:00:00Z"
kekId: kek-1
remoteKeyID: kek-1
expectedStatusError: "nodeName must be a lowercase RFC 1123 subdomain"
Loading