NO-JIRA: add KMS remote-key state, annotations, and convergence helpers

[tjungblu]

Summary

• Add RemoteKeyState on KMS encryption key state and the secret annotation contract for target/migrated/converged remote key IDs.
• Add read/apply/patch helpers so later rotation work can persist those annotations without rewriting unrelated secret metadata.
• Add health-report convergence helpers to detect a unanimous remote key ID and to filter reports to the current write key.

Enhancement: openshift/enhancements#2041

Test plan

• go test ./pkg/operator/encryption/state/ ./pkg/operator/encryption/secrets/ ./pkg/operator/encryption/kms/health/
• CI unit/verify jobs

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@tjungblu: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

• Add RemoteKeyState on KMS encryption key state and the secret annotation contract for target/migrated/converged remote key IDs.
• Add read/apply/patch helpers so later rotation work can persist those annotations without rewriting unrelated secret metadata.

Enhancement: openshift/enhancements#2041

Test plan

• go test ./pkg/operator/encryption/state/ ./pkg/operator/encryption/secrets/
• CI unit/verify jobs

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tjungblu
Once this PR has been reviewed and has the lgtm label, please assign ardaguclu for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• pkg/operator/encryption/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[tjungblu]

/close

[openshift-ci]

@tjungblu: Closed this PR.

Details

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.