encryption

type PlatformConfig struct {
	// Platform is the KMS platform type: "AWS_KMS", "GCP_CLOUD_KMS", or "UNKNOWN_KEY_TYPE"
	Platform string

	// RequiresCredentialsSecret indicates if cmekCredentialsSecretName is required
	// True for AWS_KMS and GCP_KMS, false for UNKNOWN_KEY_TYPE (file-based)
	RequiresCredentialsSecret bool

	// DefaultCredentialsSecretName is the default name for the credentials secret
	// Used when RequiresCredentialsSecret is true
	DefaultCredentialsSecretName string
}

type Provider interface {
	// SetupEncryptionInfrastructure creates cloud KMS resources (keys, roles, policies)
	// Returns a cleanup function that should be deferred to ensure proper resource cleanup
	// Called once during test setup, before any encryption secrets are created
	SetupEncryptionInfrastructure(t *testing.T) (cleanup func(), err error)

	// GetEncryptionPlatformConfig returns provider-specific encryption platform configuration
	GetEncryptionPlatformConfig() *PlatformConfig

	// EncryptKey encrypts a plaintext key using the provider's KMS
	// Takes raw key bytes, returns base64-encoded encrypted data
	EncryptKey(plaintextKey []byte, clusterRegion string) (encryptedKeyBase64 string, err error)

	// CreateKeySecret creates the Kubernetes secret with encrypted key data and provider metadata
	// (AuthPrincipal, URI, Region, Type, ExternalID, etc.)
	CreateKeySecret(kubectlOptions *k8s.KubectlOptions, secretName string, encryptedKeyData string, clusterRegion string) error

	// CreateCredentialsSecret creates the Kubernetes secret with cloud credentials
	// Returns the secret name and any error
	CreateCredentialsSecret(kubectlOptions *k8s.KubectlOptions) (string, error)
}