NO-JIRA: Standartize and document the returned latest key id from needsNewKey func

[ardaguclu]

When new key is not needed, returned latest Key ID is not used. However, with in-place field updates, this latest Key ID will be used to update the kms provider config, unless it is 0.

This is the full implementation #2241 to demonstrate the purpose.

Summary by CodeRabbit

• Bug Fixes
  • Preserved the most recent encryption key ID when rotation isn’t required (including non-migrated and KMS “no time-based rotation” scenarios), improving correctness for consumers that read the current key.
• Documentation
  • Clarified the meaning of latestKeyID, reason, needed, and err to make key-rotation outcomes and returned values easier to interpret.

[openshift-ci-robot]

@ardaguclu: This pull request explicitly references no jira issue.

Details

In response to this:

We should return calculated latest key ID only when it is valid to return. This will pave the way for in-place field updates to update the kms provider config of the latest key using the returned key ID.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ardaguclu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• pkg/operator/encryption/OWNERS [ardaguclu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

The encryption controller clarifies needsNewKey return semantics and preserves the latest KMS key ID when a new key is not required.

Changes

Encryption key rotation

Layer / File(s)	Summary
Preserve latest key ID pkg/operator/encryption/controllers/key_controller.go	needsNewKey documents its return values and returns latestKeyID instead of 0 when key rotation is not required.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: p0lyn0mial, dgrisonnet

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only key_controller.go changed; no test/spec files or Ginkgo titles were modified, so no unstable test names were introduced.
Test Structure And Quality	✅ Passed	PR only changes controller logic/docs; no Ginkgo test files were modified, so the test-structure check is not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the PR only changes a controller source file, so MicroShift compatibility is not implicated.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No Ginkgo e2e tests were added; the PR only changes pkg/operator/encryption/controllers/key_controller.go docs/behavior.
Topology-Aware Scheduling Compatibility	✅ Passed	The change only updates key-ID return behavior and comments in the encryption key controller; no replicas, affinity, nodeSelector, PDB, or topology logic was added.
Ote Binary Stdout Contract	✅ Passed	PR only changes comments and return values in a controller helper; no main/init/TestMain/suite setup stdout writes were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the PR only changes controller logic/comments in key_controller.go, so IPv4/disconnected-network checks don't apply.
No-Weak-Crypto	✅ Passed	Only documentation and return-value handling changed in key_controller.go; no weak algorithms or secret comparisons were introduced.
Container-Privileges	✅ Passed	The commit only updates pkg/operator/encryption/controllers/key_controller.go comments/return values; no privileged, hostPID/Network/IPC, or securityContext changes appear.
No-Sensitive-Data-In-Logs	✅ Passed	No new logging was added; the changed code only adjusts return values/comments, and existing log calls do not expose passwords/tokens/PII.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: standardizing and documenting the latest key ID returned by needsNewKey.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

pkg/operator/encryption/controllers/key_controller.go (1)

441-441: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Add regression coverage for the new KMS return contract.

This changes the no-rotation result from 0 to latestKeyID. Add a unit test asserting that an unchanged KMS provider returns (latestKeyID, "", false, nil) so future changes do not revert the documented behavior.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/operator/encryption/controllers/key_controller.go` at line 441, Add
regression coverage for the KMS no-rotation contract in the existing
key-controller tests: configure an unchanged KMS provider and assert the result
is (latestKeyID, "", false, nil), specifically preserving latestKeyID instead of
zero.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/operator/encryption/controllers/key_controller.go`:
- Around line 371-379: The needsNewKey documentation incorrectly restricts
latestKeyID to backed keys. Update its return-value description to state that it
contains the parsed ID of the latest key, including unbacked keys, while
preserving the existing zero-value cases and return behavior used for
calculating the next key ID.

---

Nitpick comments:
In `@pkg/operator/encryption/controllers/key_controller.go`:
- Line 441: Add regression coverage for the KMS no-rotation contract in the
existing key-controller tests: configure an unchanged KMS provider and assert
the result is (latestKeyID, "", false, nil), specifically preserving latestKeyID
instead of zero.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 59915a78-7f67-45d3-ad60-bf43bf4ff176

📥 Commits

Reviewing files that changed from the base of the PR and between 85316f8 and 061617f.

📒 Files selected for processing (1)

• pkg/operator/encryption/controllers/key_controller.go

[openshift-ci]

@ardaguclu: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[ardaguclu]

This was a premature attempt. It is better to open these PRs, after the preflight is done.
/close

[openshift-ci]

@ardaguclu: Closed this PR.

Details

In response to this:

This was a premature attempt. It is better to open these PRs, after the preflight is done.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.