Skip to content

NO-JIRA: Dynamic namespace instead of hard coded openshift-config-managed - #2401

Closed
ardaguclu wants to merge 1 commit into
openshift:masterfrom
ardaguclu:dynamic-ns
Closed

NO-JIRA: Dynamic namespace instead of hard coded openshift-config-managed#2401
ardaguclu wants to merge 1 commit into
openshift:masterfrom
ardaguclu:dynamic-ns

Conversation

@ardaguclu

@ardaguclu ardaguclu commented Aug 4, 2026

Copy link
Copy Markdown
Member

Summary by CodeRabbit

  • Bug Fixes
    • Encryption controllers now consistently operate within their configured namespace.
    • Encryption keys, state, configuration, and synchronization secrets are created, monitored, updated, and removed in the correct namespace.
    • Prevents reliance on a fixed namespace, improving support for component-specific encryption configurations.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 4, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@ardaguclu: This pull request explicitly references no jira issue.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
openshift-ci Bot requested review from dgrisonnet and p0lyn0mial August 4, 2026 06:21
@openshift-ci

openshift-ci Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ardaguclu
Once this PR has been reviewed and has the lgtm label, please assign p0lyn0mial for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Aug 4, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: aaf5d4d0-f509-42f8-875b-13f9336ae789

📥 Commits

Reviewing files that changed from the base of the PR and between 0339b89 and 6a536cf.

📒 Files selected for processing (16)
  • pkg/operator/apiserver/controllerset/apiservercontrollerset.go
  • pkg/operator/encryption/controllers.go
  • pkg/operator/encryption/controllers/condition_controller.go
  • pkg/operator/encryption/controllers/key_controller.go
  • pkg/operator/encryption/controllers/key_controller_test.go
  • pkg/operator/encryption/controllers/migration_controller.go
  • pkg/operator/encryption/controllers/migration_controller_test.go
  • pkg/operator/encryption/controllers/prune_controller.go
  • pkg/operator/encryption/controllers/prune_controller_test.go
  • pkg/operator/encryption/controllers/state_controller.go
  • pkg/operator/encryption/controllers/state_controller_test.go
  • pkg/operator/encryption/preconditions.go
  • pkg/operator/encryption/secrets/secrets.go
  • pkg/operator/encryption/secrets/secrets_test.go
  • pkg/operator/encryption/statemachine/transition.go
  • test/e2e-encryption/encryption_test.go
🚧 Files skipped from review as they are similar to previous changes (15)
  • pkg/operator/encryption/controllers/migration_controller_test.go
  • pkg/operator/encryption/controllers/state_controller_test.go
  • test/e2e-encryption/encryption_test.go
  • pkg/operator/encryption/controllers/prune_controller_test.go
  • pkg/operator/encryption/preconditions.go
  • pkg/operator/encryption/controllers.go
  • pkg/operator/encryption/secrets/secrets_test.go
  • pkg/operator/encryption/controllers/prune_controller.go
  • pkg/operator/encryption/controllers/condition_controller.go
  • pkg/operator/encryption/controllers/migration_controller.go
  • pkg/operator/encryption/controllers/state_controller.go
  • pkg/operator/encryption/secrets/secrets.go
  • pkg/operator/encryption/controllers/key_controller_test.go
  • pkg/operator/encryption/statemachine/transition.go
  • pkg/operator/encryption/controllers/key_controller.go

Walkthrough

Encryption controller APIs now accept a namespace. Controllers, informers, Secret operations, state retrieval, and integration setup use the supplied namespace instead of a fixed namespace.

Changes

Encryption namespace propagation

Layer / File(s) Summary
Namespace-aware encryption contracts
pkg/operator/encryption/controllers.go, pkg/operator/encryption/preconditions.go, pkg/operator/encryption/secrets/secrets.go, pkg/operator/encryption/statemachine/transition.go
Shared encryption APIs now accept the target namespace. Secret creation and listing use that namespace.
Controller namespace usage
pkg/operator/encryption/controllers/*_controller.go
Encryption controllers store the namespace and use it for informers, state lookup, Secret creation, validation, migration, updates, and deletion.
Construction wiring and validation
pkg/operator/apiserver/controllerset/apiservercontrollerset.go, pkg/operator/encryption/controllers/*_test.go, pkg/operator/encryption/secrets/secrets_test.go, test/e2e-encryption/encryption_test.go
Production and test call sites pass openshift-config-managed to the updated APIs.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

  • openshift/library-go#2399: Both changes modify encryption controllers, Secret namespace handling, and state-transition APIs.

Suggested reviewers: p0lyn0mial, dgrisonnet

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 30.77% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (14 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly describes replacing the hard-coded encryption secret namespace with a dynamic namespace.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The patch contains no Ginkgo title calls. Changed tests use static Go test names such as TestKeyController and TestEncryptionIntegration; only constructor arguments changed.
Test Structure And Quality ✅ Passed The changed tests use standard Go testing, not Ginkgo. The patch only updates constructor arguments and adds no Ginkgo test structure or wait/cleanup behavior.
Microshift Test Compatibility ✅ Passed The diff adds no Ginkgo It/Describe/Context/When tests. The e2e change only adds a namespace argument to existing testing.TestEncryptionIntegration.
Single Node Openshift (Sno) Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the existing standard Go TestEncryptionIntegration only changed a constructor argument and adds no multi-node assumptions.
Topology-Aware Scheduling Compatibility ✅ Passed The PR only propagates an encryption Secret namespace through controllers and secret operations; its diff adds no affinity, topology spread, toleration, node selector, replica, or PDB constraints.
Ote Binary Stdout Contract ✅ Passed The diff adds only namespace arguments and controller wiring. No process-level stdout writes were added; existing fmt.Printf calls are inside the individual TestEncryptionIntegration test.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No new Ginkgo tests were added; all added test lines only pass a namespace argument, with no IPv4 assumptions or external connectivity requirements.
No-Weak-Crypto ✅ Passed The PR adds namespace plumbing only. Diff scans found no MD5, SHA1, DES, RC4, Blowfish, ECB, crypto imports, custom crypto, or secret/token comparisons.
Container-Privileges ✅ Passed The PR changes 16 Go files only; the diff adds no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root settings.
No-Sensitive-Data-In-Logs ✅ Passed The patch adds no logging calls and changes no log messages; existing logs expose only secret names, namespaces, resource names, counts, or configuration metadata, not secret values or tokens.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
pkg/operator/encryption/secrets/secrets_test.go (1)

226-226: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Assert the namespace written by FromKeyState.

TestRoundtrip compares only KeyState; ToKeyState ignores Secret.Namespace. The test can pass even if FromKeyState ignores the new argument. Use a non-default namespace and assert s.Namespace.

Suggested assertion
-			s, err := FromKeyState("openshift-config-managed", tt.component, tt.ks)
+			const namespace = "custom-config-managed"
+			s, err := FromKeyState(namespace, tt.component, tt.ks)
 			if err != nil {
 				t.Fatalf("unexpected FromKeyState() error: %v", err)
 			}
+			if s.Namespace != namespace {
+				t.Fatalf("unexpected namespace: got %q, want %q", s.Namespace, namespace)
+			}
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/operator/encryption/secrets/secrets_test.go` at line 226, Update
TestRoundtrip around the FromKeyState call to pass a non-default namespace and
assert that the returned Secret’s Namespace matches it. Keep the existing
KeyState comparison, ensuring the test verifies both round-trip state and
namespace propagation.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/operator/apiserver/controllerset/apiservercontrollerset.go`:
- Line 506: Replace the hard-coded "openshift-config-managed" argument in
encryptionControllerBuilder.build with the configured namespace, and thread that
value through WithEncryptionControllers into encryptionControllerBuilder so
NewControllers uses it for all encryption secret operations.

---

Nitpick comments:
In `@pkg/operator/encryption/secrets/secrets_test.go`:
- Line 226: Update TestRoundtrip around the FromKeyState call to pass a
non-default namespace and assert that the returned Secret’s Namespace matches
it. Keep the existing KeyState comparison, ensuring the test verifies both
round-trip state and namespace propagation.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 52415f2d-841e-4c53-b8b7-696c7823f48e

📥 Commits

Reviewing files that changed from the base of the PR and between c271b5c and 0339b89.

📒 Files selected for processing (16)
  • pkg/operator/apiserver/controllerset/apiservercontrollerset.go
  • pkg/operator/encryption/controllers.go
  • pkg/operator/encryption/controllers/condition_controller.go
  • pkg/operator/encryption/controllers/key_controller.go
  • pkg/operator/encryption/controllers/key_controller_test.go
  • pkg/operator/encryption/controllers/migration_controller.go
  • pkg/operator/encryption/controllers/migration_controller_test.go
  • pkg/operator/encryption/controllers/prune_controller.go
  • pkg/operator/encryption/controllers/prune_controller_test.go
  • pkg/operator/encryption/controllers/state_controller.go
  • pkg/operator/encryption/controllers/state_controller_test.go
  • pkg/operator/encryption/preconditions.go
  • pkg/operator/encryption/secrets/secrets.go
  • pkg/operator/encryption/secrets/secrets_test.go
  • pkg/operator/encryption/statemachine/transition.go
  • test/e2e-encryption/encryption_test.go

Comment thread pkg/operator/apiserver/controllerset/apiservercontrollerset.go Outdated
@openshift-ci

openshift-ci Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

@ardaguclu: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@ardaguclu

Copy link
Copy Markdown
Member Author

#2402 supersedes this PR
/close

@openshift-ci openshift-ci Bot closed this Aug 5, 2026
@openshift-ci

openshift-ci Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

@ardaguclu: Closed this PR.

Details

In response to this:

#2402 supersedes this PR
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@ardaguclu
ardaguclu deleted the dynamic-ns branch August 5, 2026 06:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants