Add e2e tests for etcd data re-encryption after key rotation

test/e2e/v2/internal/env_vars.go

@@ -225,6 +225,17 @@ func init() {
 		false,
 		"",
 	)
+	// Encryption key rotation test environment variables
+	RegisterEnvVar(
+		"E2E_AWS_KMS_KEY_ARN_ALTERNATE",
+		"Alternate AWS KMS CMK ARN for key rotation re-encryption tests.",
+		false,
+	)
+	RegisterEnvVar(
+		"E2E_AZURE_KMS_KEY_VERSION_ALTERNATE",
+		"Alternate Azure Key Vault key version for key rotation re-encryption tests.",
+		false,
+	)
 	// External OIDC test environment variables
 	RegisterEnvVar(
 		"E2E_EXTERNAL_OIDC_CA_BUNDLE_FILE",

test/e2e/v2/lifecycle/aws.go

@@ -148,7 +148,7 @@ func (a *AWSPlatformConfig) ClusterSpecs(ctx context.Context, releaseImage, n1Im
 		publicArgs = append(publicArgs, "--initial-storage-volumes-kms-key="+arn)
 	}
 
-	return []ClusterSpec{
+	specs := []ClusterSpec{
 		{
 			Variant:     "public",
 			DestroyArgs: destroyArgs,
@@ -230,6 +230,19 @@ func (a *AWSPlatformConfig) ClusterSpecs(ctx context.Context, releaseImage, n1Im
 			),
 		},
 	}
+
+	// Only include kms-reencryption when a KMS key ARN is configured.
+	// e2e rotation coverage is KMS-only; without an ARN there are no rotation
+	// tests to run so the dedicated cluster would be created for nothing.
+	if kmsKeyARN := os.Getenv("HYPERSHIFT_ETCD_KMS_KEY_ARN"); kmsKeyARN != "" {
+		specs = append(specs, ClusterSpec{
+			Variant:     "kms-reencryption",
+			DestroyArgs: destroyArgs,
+			CreateArgs:  clusterArgs("--kms-key-arn=" + kmsKeyARN),
+		})
+	}
+
+	return specs
 }
 
 // PreCreate deploys the external OIDC provider and the mirror registry fixture
@@ -292,34 +305,46 @@ func (a *AWSPlatformConfig) DefaultTestPlan() TestPlan {
 }
 
 func (a *AWSPlatformConfig) TestMatrix() TestMatrix {
-	return TestMatrix{
-		Parallel: []TestGroup{
-			{
-				Name:        "managed-dns",
-				Variant:     "managed-dns",
-				LabelFilter: "hosted-cluster-managed-dns",
-			},
-			{
-				Name:        "karpenter",
-				Variant:     "karpenter",
-				LabelFilter: "karpenter",
-			},
-			// TODO: It might be possible to decompose the karpenter upgrade test
-			// into pre and post upgrade specs which communicate with a well defined
-			// IPC protocol, like the pre step serializing observations which the
-			// post step can use. Then we can compose the regular upgrade test here
-			// instead of duplicating upgrade logic inside the karpenter test.
-			{
-				Name:        "karpenter-upgrade",
-				Variant:     "karpenter-upgrade",
-				LabelFilter: "karpenter-upgrade",
-			},
-			{
-				Name:        "image-mirroring",
-				Variant:     "image-mirroring",
-				LabelFilter: "image-mirroring",
-			},
+	parallel := []TestGroup{
+		{
+			Name:        "managed-dns",
+			Variant:     "managed-dns",
+			LabelFilter: "hosted-cluster-managed-dns",
+		},
+		{
+			Name:        "karpenter",
+			Variant:     "karpenter",
+			LabelFilter: "karpenter",
 		},
+		// TODO: It might be possible to decompose the karpenter upgrade test
+		// into pre and post upgrade specs which communicate with a well defined
+		// IPC protocol, like the pre step serializing observations which the
+		// post step can use. Then we can compose the regular upgrade test here
+		// instead of duplicating upgrade logic inside the karpenter test.
+		{
+			Name:        "karpenter-upgrade",
+			Variant:     "karpenter-upgrade",
+			LabelFilter: "karpenter-upgrade",
+		},
+		{
+			Name:        "image-mirroring",
+			Variant:     "image-mirroring",
+			LabelFilter: "image-mirroring",
+		},
+	}
+
+	// kms-reencryption is only scheduled when a KMS key ARN is available —
+	// it must match the ClusterSpecs() conditional above.
+	if os.Getenv("HYPERSHIFT_ETCD_KMS_KEY_ARN") != "" {
+		parallel = append(parallel, TestGroup{
+			Name:        "kms-reencryption",
+			Variant:     "kms-reencryption",
+			LabelFilter: "etcd-encryption-reencryption",
+		})
+	}
+
+	return TestMatrix{
+		Parallel: parallel,
 		Sequential: []SequentialGroup{
 			{
 				Name: "public",

test/e2e/v2/lifecycle/aws_test.go

@@ -35,6 +35,7 @@ func TestAWSPlatformConfigClusterSpecs(t *testing.T) {
 			g.Expect(spec.DumpArgs).To(BeEmpty(), "variant %s", spec.Variant)
 		}
 	})
+
 }
 
 // testCLIImage is a digest-pinned openshift/cli image reference used in lookup and setup tests.

test/e2e/v2/lifecycle/azure.go

@@ -302,7 +302,7 @@ func (a *AzurePlatformConfig) TestMatrix() TestMatrix {
 					{
 						Name:        "public",
 						Variant:     "public",
-						LabelFilter: "azure-machine-diagnostics || self-managed-azure-public || hosted-cluster-node-communication || hosted-cluster-cpo || nodepool-arm64 || secret-encryption || control-plane-workloads || hosted-cluster-security || nodepool-osimagestream || hosted-cluster-ingress",
+						LabelFilter: "azure-machine-diagnostics || self-managed-azure-public || hosted-cluster-node-communication || hosted-cluster-cpo || nodepool-arm64 || secret-encryption || control-plane-workloads || hosted-cluster-security || nodepool-osimagestream || hosted-cluster-ingress || etcd-encryption-reencryption",
 						Skip:        "KAS allowed CIDRs",
 					},
 					{