NO-JIRA: update preflight pod manifest

[tjungblu]

to facilitate static pods, this is a spin-off from #2345.

Summary by CodeRabbit

• New Features

  • Added support for running KMS preflight checks in both standard and static pod modes.
  • Static pod mode now uses host networking and mounts the Kubernetes manifests directory automatically.

• Bug Fixes

  • Improved pod configuration so the correct service account and kubeconfig are applied based on the selected mode.
  • Updated pod setup to better match the required runtime permissions for static pod environments.

[openshift-ci-robot]

@tjungblu: This pull request explicitly references no jira issue.

Details

In response to this:

to facilitate static pods, this is a spin-off from #2345.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

Walkthrough

The KMS preflight pod generation now supports a static pod mode via a new StaticPod template field. The YAML asset conditionally sets serviceAccountName, hostNetwork, hostPath volumes, security context, and kubeconfig args. Rendering logic was refactored into shared helpers, the deployer call site simplified, and tests updated/added.

Changes

KMS Preflight Static Pod Support

Layer / File(s)	Summary
Conditional pod asset fields pkg/operator/encryption/kms/preflight/assets/kms-preflight-pod.yaml	serviceAccountName, hostNetwork, resource-dir hostPath volume, container args, securityContext, and volumeMounts are now conditionally set based on .StaticPod.
Template struct and rendering refactor pkg/operator/encryption/kms/preflight/pod_template.go	Adds StaticPod field, newKmsPreflightTemplate helper, and refactors rendering into generatePodTemplate, generateStaticPodTemplate, renderPreflightPodTemplate, and renderPodTemplate.
Deployer call site update pkg/operator/encryption/kms/preflight/deployer.go	Removes the obsolete empty-string kubeconfig argument from the generatePodTemplate call.
Test coverage for static pod mode pkg/operator/encryption/kms/preflight/pod_template_test.go	Updates the existing test call signature and adds TestGenerateStaticPodTemplate with expected static-pod YAML verification.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Deployer
  participant generatePodTemplate
  participant generateStaticPodTemplate
  participant renderPreflightPodTemplate
  participant renderPodTemplate

  Deployer->>generatePodTemplate: operatorImage, operatorCommand, kmsCallTimeout
  generatePodTemplate->>renderPreflightPodTemplate: staticPod=false
  renderPreflightPodTemplate->>renderPodTemplate: parse/execute template, build Pod

  Deployer->>generateStaticPodTemplate: operatorImage, operatorCommand, kmsCallTimeout
  generateStaticPodTemplate->>renderPreflightPodTemplate: staticPod=true
  renderPreflightPodTemplate->>renderPodTemplate: parse/execute template, build Pod

Loading

Related Issues: None provided.

Related PRs: None provided.

Suggested labels: None provided.

Suggested reviewers: None provided.

Poem:
A rabbit hops through YAML lines so neat,
Static or not, each pod finds its seat.
HostPath mounted, kubeconfig injected right,
Templates refactored, tests shining bright.
Hop, hop, deploy — the preflight takes flight! 🐇

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Tools execution failed with the following error:

Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)

---

_{Comment @coderabbitai help to get the list of available commands.}

[tjungblu]

not possible to use a service account anymore due to:
https://github.com/kubernetes/kubernetes/blob/cbe5e3096ec29950198ed0b77ed9c611f3183c14/pkg/kubelet/config/common.go#L151-L159

[tjungblu]

just fyi, this is going to be reused for the installer pod, before you ask why there are three different functions now doing the same

[openshift-ci]

@tjungblu: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[p0lyn0mial]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: p0lyn0mial, tjungblu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• pkg/operator/encryption/OWNERS [p0lyn0mial]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment