PROOF: certrotation refactor + configurable PKI support

[sanchezl]

Summary

• Proof PR demonstrating the new certrotation API from certrotation: add configurable PKI support library-go#2152 (on top of certrotation: restructure controller to own plumbing and cert creation library-go#2151)
• Replaces old hybrid structs with pure config types (SigningCAConfig, CABundleConfig, TargetCertKeyPairConfig)
• Removes per-struct Informer/Lister/Client/EventRecorder plumbing
• PKI provider created by caller, gated on ConfigurablePKI feature gate
• PKI informer cache sync managed by caller via cachesToSync
• Vendors library-go from sanchezl/library-go certrotation-refactor branch

Test plan

• go build ./... passes
• e2e with TechPreview ConfigurablePKI

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)

• do-not-merge/work-in-progress

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 332e573c-4985-4fc9-8d51-4a289f6846b7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sanchezl

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [sanchezl]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sanchezl]

/hold

[sanchezl]

/retest

[sanchezl]

/payload-job periodic-ci-openshift-release-main-ci-4.22-e2e-aws-ovn-techpreview

[openshift-ci]

@sanchezl: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-ci-4.22-e2e-aws-ovn-techpreview

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/4ff07b40-32ac-11f1-8f40-e93b04c11ec9-0

[openshift-ci]

@sanchezl: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-serial-1of2	0cb0c5e	link	true	/test e2e-aws-ovn-serial-1of2
ci/prow/e2e-gcp-operator-serial-ote	0cb0c5e	link	true	/test e2e-gcp-operator-serial-ote

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[gangwgr]

/retest-required

[sanchezl]

Closing — proof for library-go#2152 (refactor + PKI). Went with library-go#2145 + CKAO#2051 instead due to how CEO uses the certrotation package.