CNTRLPLANE-3237: Retry APIServer CR update on conflict in SetAndWaitForEncryptionType

[p0lyn0mial]

should help with #2349 when we use #2352

Summary by CodeRabbit

• Bug Fixes
  • Improved encryption configuration updates to handle concurrent modification conflicts more reliably, reducing intermittent failures.
  • Re-read the latest server encryption configuration before applying changes, and only update when the desired mode differs.
  • Added stronger retry behavior to ensure updates complete successfully under contention.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b9198ea6-d6cf-489a-a2e3-5ff6e96aa1d0

📥 Commits

Reviewing files that changed from the base of the PR and between aa59c3f and e64074a.

📒 Files selected for processing (1)

• test/library/encryption/helpers.go

---

Walkthrough

SetAndWaitForEncryptionType now retries APIServer encryption configuration reads and updates on conflicts, re-evaluating the live object before each attempt and requiring the retry operation to succeed.

Changes

Encryption configuration retry handling

Layer / File(s)	Summary
Retry encryption configuration updates test/library/encryption/helpers.go	Uses retry.RetryOnConflict to re-fetch the APIServer object, compare encryption modes, optionally run provider.Setup, apply updates, and enforce success after retries.

Estimated code review effort: 2 (Simple) | ~10 minutes

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	SetAndWaitForEncryptionType logs %#v for old/new APIServerEncryption; KMS configs include VaultAddress, VaultNamespace, and secret/configmap names, exposing internal details.	Log only the encryption type or redact KMS fields before logging instead of dumping the full APIServerEncryption struct.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (13 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: retrying APIServer CR updates on conflict in SetAndWaitForEncryptionType.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The commit only changes helper logic in test/library/encryption/helpers.go; no Ginkgo test titles (It/Describe/Context/When) were added or modified.
Test Structure And Quality	✅ Passed	Only a test helper changed; no Ginkgo It/BeforeEach/AfterEach blocks or cluster test code were modified, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	Only helper retry logic changed in test/library/encryption/helpers.go; no new Ginkgo tests or MicroShift-unsupported APIs were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only helper retry logic changed; no new Ginkgo tests or multi-node/SNO-specific assumptions were added.
Topology-Aware Scheduling Compatibility	✅ Passed	Only a test helper changed to retry APIServer encryption config updates; no manifests, controllers, replicas, node selectors, or scheduling constraints were added.
Ote Binary Stdout Contract	✅ Passed	The touched helper only uses t.Logf and retry logic; no main/init/TestMain/suite setup or stdout writers were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo test definitions were added; only the encryption helper changed, so the IPv6/disconnected-network test check is not applicable.
No-Weak-Crypto	✅ Passed	Patch only adds APIServer update retry logic; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret/token comparisons were introduced.
Container-Privileges	✅ Passed	PR only changes a Go test helper’s retry logic; no container/K8s manifests or privilege-related fields were added.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@p0lyn0mial: This pull request references CNTRLPLANE-3237 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

should help with #2349 when we use #2352

Summary by CodeRabbit

• Bug Fixes
• Improved encryption configuration updates to handle conflicts more reliably, reducing intermittent failures during changes.
• Ensured the latest server configuration is re-read before applying updates, so encryption settings are only changed when needed.
• Added safer retry behavior so update operations complete successfully even when concurrent changes occur.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[gangwgr]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gangwgr, p0lyn0mial

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• test/library/encryption/OWNERS [p0lyn0mial]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@p0lyn0mial: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.