ci: add etcd re-encryption e2e CI for AWS KMS, AESCBC, and Azure KMS (CNTRLPLANE-4377)

ci-operator/config/openshift/hypershift/openshift-hypershift-main.yaml

@@ -286,6 +286,8 @@ tests:
     env:
       NODEPOOL_N1_VERSION: "5.0"
       TECH_PREVIEW_NO_UPGRADE: "true"
+      HYPERSHIFT_ETCD_KMS_KEY_ALIAS: alias/hypershift-ci
+      E2E_AWS_KMS_KEY_ARN_ALTERNATE: alias/hypershift-ci-alternate
     workflow: hypershift-aws-e2e-v2
 - always_run: false
   as: e2e-v2-aws-techpreview-osimagestream
@@ -364,6 +366,7 @@ tests:
       ENABLE_HYPERSHIFT_CERT_ROTATION_SCALE: "true"
       HYPERSHIFT_AZURE_LOCATION: centralus
       NODEPOOL_N1_VERSION: "5.0"
+      E2E_AZURE_KMS_KEY_VERSION_ALTERNATE: "6079dbc6ff6549328bc90e85e06bfe05"
     workflow: hypershift-azure-e2e-v2-self-managed
 - always_run: false
   as: e2e-aws-minimal

ci-operator/step-registry/hypershift/aws/create-guests/hypershift-aws-create-guests-commands.sh

@@ -31,4 +31,12 @@ if [[ -n "${HYPERSHIFT_STORAGE_KMS_KEY_ALIAS:-}" ]]; then
     fi
 fi
 
+# Etcd KMS encryption: forward the key alias as HYPERSHIFT_ETCD_KMS_KEY_ARN so
+# that the kms-reencryption ClusterSpec variant can pass it as --kms-key-arn.
+# The AWS KMS SDK accepts both full ARNs and alias identifiers (alias/<name>).
+if [[ -n "${HYPERSHIFT_ETCD_KMS_KEY_ALIAS:-}" ]]; then
+    echo "Forwarding HYPERSHIFT_ETCD_KMS_KEY_ALIAS=${HYPERSHIFT_ETCD_KMS_KEY_ALIAS} as HYPERSHIFT_ETCD_KMS_KEY_ARN"
+    export HYPERSHIFT_ETCD_KMS_KEY_ARN="${HYPERSHIFT_ETCD_KMS_KEY_ALIAS}"
+fi
+
 /hypershift/bin/create-guests

ci-operator/step-registry/hypershift/aws/create-guests/hypershift-aws-create-guests-ref.yaml

@@ -39,6 +39,9 @@ ref:
   - name: HYPERSHIFT_STORAGE_KMS_KEY_ALIAS
     default: ""
     documentation: "AWS KMS key alias (e.g. alias/hypershift-ci) used to encrypt the default StorageClass volumes on the public cluster. When set and supported by the hypershift binary, the alias is resolved to an ARN and passed as --initial-storage-volumes-kms-key at cluster creation. Leave empty to skip."
+  - name: HYPERSHIFT_ETCD_KMS_KEY_ALIAS
+    default: ""
+    documentation: "AWS KMS key alias or identifier (e.g. alias/hypershift-ci) used for etcd data-at-rest encryption. When set, it is forwarded as HYPERSHIFT_ETCD_KMS_KEY_ARN so that the kms-reencryption ClusterSpec variant can pass it as --kms-key-arn at cluster creation. Leave empty to skip etcd KMS encryption."
   from: hypershift-tests
   grace_period: 5m0s
   resources:

ci-operator/step-registry/hypershift/aws/run-e2e-v2/hypershift-aws-run-e2e-v2-chain.yaml

@@ -7,6 +7,9 @@ chain:
     - name: HYPERSHIFT_PLATFORM
       default: ""
       documentation: "The cloud platform for the clusters (e.g. aws). Set in the workflow env block."
+    - name: E2E_AWS_KMS_KEY_ARN_ALTERNATE
+      default: ""
+      documentation: "Alternate AWS KMS key alias or ARN for etcd key-rotation re-encryption tests (AWSKMSKeyRotationTest, AzureKMSConsecutiveKeyRotationTest). Must be a different key than the one used at cluster creation. Leave empty to skip AWS KMS re-encryption tests."
     commands: |-
       set -xuo pipefail
       export KUBECONFIG="${SHARED_DIR}/management_cluster_kubeconfig"

ci-operator/step-registry/hypershift/azure/run-e2e-v2-selfmanaged/hypershift-azure-run-e2e-v2-selfmanaged-chain.yaml

@@ -14,6 +14,9 @@ chain:
     - name: HYPERSHIFT_PLATFORM
       default: ""
       documentation: "The cloud platform for the self-managed clusters (e.g. azure). Set in the workflow env block."
+    - name: E2E_AZURE_KMS_KEY_VERSION_ALTERNATE
+      default: ""
+      documentation: "Alternate Azure Key Vault key version for etcd KMS key-rotation re-encryption tests (AzureKMSKeyRotationTest, AzureKMSConsecutiveKeyRotationTest). Must be a different version than the one used at cluster creation. Leave empty to skip Azure KMS re-encryption tests."
     commands: |-
       set -xuo pipefail
       export KUBECONFIG="${SHARED_DIR}/management_cluster_kubeconfig"