CNTRLPLANE-3361: kms: add Slack discussion link to Vault resource requests numbers

[bertinatto]

/assign @p0lyn0mial

Summary by CodeRabbit

• Documentation
  • Clarified Vault sidecar configuration with an additional note to aid understanding of expected sidecar behavior.

[openshift-ci-robot]

@bertinatto: This pull request references CNTRLPLANE-3361 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

/assign @p0lyn0mial

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 014e20c2-ce09-4a6f-81c4-7ac7b613e35d

📥 Commits

Reviewing files that changed from the base of the PR and between 0bc82cd and 24045fb.

📒 Files selected for processing (1)

• pkg/operator/encryption/kms/pluginlifecycle/vault.go

✅ Files skipped from review due to trivial changes (1)

• pkg/operator/encryption/kms/pluginlifecycle/vault.go

---

Walkthrough

A single inline comment was added to BuildSidecarContainer in the Vault plugin lifecycle file, documenting a Slack discussion link related to Vault sidecar behavior and configuration.

Changes

Vault sidecar documentation

Layer / File(s)	Summary
Slack discussion reference comment pkg/operator/encryption/kms/pluginlifecycle/vault.go	An inline comment was added to BuildSidecarContainer referencing an external Slack discussion about Vault sidecar behavior and configuration.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• openshift/library-go#2254: Yes—both main and retrieved PR modify pkg/operator/encryption/kms/pluginlifecycle/vault.go’s BuildSidecarContainer’s Vault sidecar behavior, with the retrieved PR specifically changing CPU/memory request values.
• openshift/library-go#2251: Both PRs touch pkg/operator/encryption/kms/pluginlifecycle/vault.go’s BuildSidecarContainer, with the main PR adding a Vault-sidecar comment while the retrieved PR adds a TLS-skip-verify workaround/flag to the same sidecar construction.

Suggested labels

approved, lgtm

Suggested reviewers

• p0lyn0mial
• dgrisonnet

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: adding a Slack discussion link comment to the Vault sidecar container builder, which matches the single-line code modification shown in the summary.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR adds a comment to production code (vault.go), not Ginkgo tests. Custom check for Ginkgo test names is not applicable to this PR.
Test Structure And Quality	✅ Passed	PR only adds a comment to vault.go (production code), not test files. Custom check requires reviewing Ginkgo test code, which is not modified in this PR.
Microshift Test Compatibility	✅ Passed	This PR adds a Slack discussion link comment to vault.go and creates standard Go tests (not Ginkgo e2e tests), so the MicroShift compatibility check does not apply.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only adds a comment to non-test file vault.go; no new Ginkgo e2e tests added, so check not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PR adds only a comment with a Slack link to BuildSidecarContainer(), which creates a corev1.Container spec. No scheduling constraints, deployment manifests, or topology-dependent logic are introduced.
Ote Binary Stdout Contract	✅ Passed	File contains no process-level code (main, init, BeforeSuite, etc.) or stdout writes. Change is only a documentation comment within a method.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added in this PR. The change only adds a Slack discussion link comment to vault.go, which does not require IPv6/disconnected network compatibility checks.
No-Weak-Crypto	✅ Passed	PR adds only a Slack discussion link comment to vault.go. No weak crypto patterns, custom implementations, or insecure secret comparisons detected.
Container-Privileges	✅ Passed	PR only adds a Slack link comment. The Vault KMS container has no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds only a code comment containing a Slack URL reference, not logging code. The comment is documentation and does not expose passwords, tokens, API keys, PII, or other sensitive data.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[p0lyn0mial]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bertinatto, p0lyn0mial

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• pkg/operator/encryption/OWNERS [bertinatto,p0lyn0mial]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tjungblu]

I guess I would appreciate the context, but this is a private channel with only us in it, so I'm not sure this will age so well....

[p0lyn0mial]

the slack history is preserved so a redhater willing to learn more could visit that link and get more context, no ?

[tjungblu]

how would you be able to join the channel?

[openshift-ci]

@bertinatto: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.