update kms plugin beta image to ci

ci-operator/config/openshift/cluster-authentication-operator/openshift-cluster-authentication-operator-master.yaml

@@ -9,8 +9,8 @@ base_images:
     tag: 2.0.0-ent
   vault_kube_kms:
     name: vault-kube-kms
-    namespace: control-plane_vault
-    tag: 0.0.1
+    namespace: ci
+    tag: 0.1.0-beta-ubi
 binary_build_commands: make build --warn-undefined-variables
 build_root:
   from_repository: true
@@ -300,7 +300,7 @@ tests:
       FEATURE_SET: TechPreviewNoUpgrade
       TEST_SUITE: openshift/cluster-authentication-operator/encryption-kms
       VAULT_ENTERPRISE_IMAGE: quay.io/openshifttest/vault-enterprise:2.0.0-ent
-      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/control-plane-custom-builds/vault-kube-kms@sha256:33599dd6eee61dcf9a60138759fafda3d88593a3c2072585156882c6b5bd3fa5
+      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/ci/vault-kube-kms:0.1.0-beta-ubi
     test:
     - chain: etcd-encryption-vault-setup
     - ref: openshift-e2e-test

ci-operator/config/openshift/cluster-kube-apiserver-operator/openshift-cluster-kube-apiserver-operator-main.yaml

@@ -33,8 +33,8 @@ base_images:
     tag: 2.0.0-ent
   vault_kube_kms:
     name: vault-kube-kms
-    namespace: control-plane_vault
-    tag: 0.0.1
+    namespace: ci
+    tag: 0.1.0-beta-ubi
 binary_build_commands: make build --warn-undefined-variables
 build_root:
   from_repository: true
@@ -463,7 +463,7 @@ tests:
       FEATURE_SET: TechPreviewNoUpgrade
       TEST_SUITE: openshift/cluster-kube-apiserver-operator/encryption-kms
       VAULT_ENTERPRISE_IMAGE: quay.io/openshifttest/vault-enterprise:2.0.0-ent
-      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/control-plane-custom-builds/vault-kube-kms@sha256:33599dd6eee61dcf9a60138759fafda3d88593a3c2072585156882c6b5bd3fa5
+      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/ci/vault-kube-kms:0.1.0-beta-ubi
     test:
     - chain: etcd-encryption-vault-setup
     - ref: openshift-e2e-test
@@ -478,7 +478,7 @@ tests:
       FEATURE_SET: TechPreviewNoUpgrade
       TEST_SUITE: openshift/cluster-kube-apiserver-operator/encryption-kms-rotation
       VAULT_ENTERPRISE_IMAGE: quay.io/openshifttest/vault-enterprise:2.0.0-ent
-      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/control-plane-custom-builds/vault-kube-kms@sha256:33599dd6eee61dcf9a60138759fafda3d88593a3c2072585156882c6b5bd3fa5
+      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/ci/vault-kube-kms:0.1.0-beta-ubi
     test:
     - chain: etcd-encryption-vault-setup
     - ref: openshift-e2e-test

ci-operator/config/openshift/cluster-kube-apiserver-operator/openshift-cluster-kube-apiserver-operator-main__periodics.yaml

@@ -17,8 +17,8 @@ base_images:
     tag: 2.0.0-ent
   vault_kube_kms:
     name: vault-kube-kms
-    namespace: control-plane_vault
-    tag: 0.0.1
+    namespace: ci
+    tag: 0.1.0-beta-ubi
 binary_build_commands: make build --warn-undefined-variables
 build_root:
   from_repository: true
@@ -93,7 +93,7 @@ tests:
       FEATURE_SET: TechPreviewNoUpgrade
       TEST_SUITE: openshift/cluster-kube-apiserver-operator/encryption-kms
       VAULT_ENTERPRISE_IMAGE: quay.io/openshifttest/vault-enterprise:2.0.0-ent
-      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/control-plane-custom-builds/vault-kube-kms@sha256:33599dd6eee61dcf9a60138759fafda3d88593a3c2072585156882c6b5bd3fa5
+      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/ci/vault-kube-kms:0.1.0-beta-ubi
     test:
     - chain: etcd-encryption-vault-setup
     - ref: openshift-e2e-test
@@ -106,7 +106,7 @@ tests:
       FEATURE_SET: TechPreviewNoUpgrade
       TEST_SUITE: openshift/cluster-kube-apiserver-operator/encryption-kms
       VAULT_ENTERPRISE_IMAGE: quay.io/openshifttest/vault-enterprise:2.0.0-ent
-      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/control-plane-custom-builds/vault-kube-kms@sha256:33599dd6eee61dcf9a60138759fafda3d88593a3c2072585156882c6b5bd3fa5
+      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/ci/vault-kube-kms:0.1.0-beta-ubi
     test:
     - chain: etcd-encryption-vault-setup
     - ref: openshift-e2e-test
@@ -119,7 +119,7 @@ tests:
       FEATURE_SET: TechPreviewNoUpgrade
       TEST_SUITE: openshift/cluster-kube-apiserver-operator/encryption-kms
       VAULT_ENTERPRISE_IMAGE: quay.io/openshifttest/vault-enterprise:2.0.0-ent
-      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/control-plane-custom-builds/vault-kube-kms@sha256:33599dd6eee61dcf9a60138759fafda3d88593a3c2072585156882c6b5bd3fa5
+      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/ci/vault-kube-kms:0.1.0-beta-ubi
     test:
     - chain: etcd-encryption-vault-setup
     - ref: openshift-e2e-test
@@ -132,7 +132,7 @@ tests:
       FEATURE_SET: TechPreviewNoUpgrade
       TEST_SUITE: openshift/cluster-kube-apiserver-operator/encryption-kms
       VAULT_ENTERPRISE_IMAGE: quay.io/openshifttest/vault-enterprise:2.0.0-ent
-      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/control-plane-custom-builds/vault-kube-kms@sha256:33599dd6eee61dcf9a60138759fafda3d88593a3c2072585156882c6b5bd3fa5
+      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/ci/vault-kube-kms:0.1.0-beta-ubi
     test:
     - chain: etcd-encryption-vault-setup
     - ref: openshift-e2e-test
@@ -147,7 +147,7 @@ tests:
         FEATURE_SET=TechPreviewNoUpgrade
       TEST_SUITE: openshift/cluster-kube-apiserver-operator/encryption-kms
       VAULT_ENTERPRISE_IMAGE: quay.io/openshifttest/vault-enterprise:2.0.0-ent
-      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/control-plane-custom-builds/vault-kube-kms@sha256:33599dd6eee61dcf9a60138759fafda3d88593a3c2072585156882c6b5bd3fa5
+      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/ci/vault-kube-kms:0.1.0-beta-ubi
     test:
     - chain: etcd-encryption-vault-setup
     - ref: baremetalds-e2e-test
@@ -162,7 +162,7 @@ tests:
         FEATURE_SET=TechPreviewNoUpgrade
       TEST_SUITE: openshift/cluster-kube-apiserver-operator/encryption-kms
       VAULT_ENTERPRISE_IMAGE: quay.io/openshifttest/vault-enterprise:2.0.0-ent
-      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/control-plane-custom-builds/vault-kube-kms@sha256:33599dd6eee61dcf9a60138759fafda3d88593a3c2072585156882c6b5bd3fa5
+      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/ci/vault-kube-kms:0.1.0-beta-ubi
     test:
     - chain: etcd-encryption-vault-setup
     - ref: baremetalds-e2e-test
@@ -177,7 +177,7 @@ tests:
         FEATURE_SET=TechPreviewNoUpgrade
       TEST_SUITE: openshift/cluster-kube-apiserver-operator/encryption-kms
       VAULT_ENTERPRISE_IMAGE: quay.io/openshifttest/vault-enterprise:2.0.0-ent
-      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/control-plane-custom-builds/vault-kube-kms@sha256:33599dd6eee61dcf9a60138759fafda3d88593a3c2072585156882c6b5bd3fa5
+      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/ci/vault-kube-kms:0.1.0-beta-ubi
     test:
     - chain: etcd-encryption-vault-setup
     - ref: baremetalds-e2e-test
@@ -191,7 +191,7 @@ tests:
       TEST_ARGS: --disable-monitor=legacy-node-invariants --cluster-stability=Disruptive
       TEST_SUITE: openshift/cluster-kube-apiserver-operator/encryption-kms
       VAULT_ENTERPRISE_IMAGE: quay.io/openshifttest/vault-enterprise:2.0.0-ent
-      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/control-plane-custom-builds/vault-kube-kms@sha256:33599dd6eee61dcf9a60138759fafda3d88593a3c2072585156882c6b5bd3fa5
+      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/ci/vault-kube-kms:0.1.0-beta-ubi
     test:
     - chain: etcd-encryption-vault-setup
     - ref: openshift-e2e-test

ci-operator/config/openshift/cluster-openshift-apiserver-operator/openshift-cluster-openshift-apiserver-operator-main.yaml

@@ -5,8 +5,8 @@ base_images:
     tag: 2.0.0-ent
   vault_kube_kms:
     name: vault-kube-kms
-    namespace: control-plane_vault
-    tag: 0.0.1
+    namespace: ci
+    tag: 0.1.0-beta-ubi
 binary_build_commands: make build --warn-undefined-variables
 build_root:
   from_repository: true
@@ -143,7 +143,7 @@ tests:
       FEATURE_SET: TechPreviewNoUpgrade
       TEST_SUITE: openshift/cluster-openshift-apiserver-operator/encryption-kms
       VAULT_ENTERPRISE_IMAGE: quay.io/openshifttest/vault-enterprise:2.0.0-ent
-      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/control-plane-custom-builds/vault-kube-kms@sha256:33599dd6eee61dcf9a60138759fafda3d88593a3c2072585156882c6b5bd3fa5
+      VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/ci/vault-kube-kms:0.1.0-beta-ubi
     test:
     - chain: etcd-encryption-vault-setup
     - ref: openshift-e2e-test

ci-operator/step-registry/etcd-encryption/hashicorp-vault/azure/etcd-encryption-hashicorp-vault-azure-workflow.yaml

@@ -36,7 +36,7 @@ workflow:
     - VAULT_CHART_VERSION: 0.28.1 (Vault Helm chart version)
     - VAULT_NAMESPACE: vault-kms (namespace for Vault installation)
     - VAULT_SECONDARY_NAMESPACE: vault-kms-secondary (secondary Vault namespace)
-    - VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/control-plane-custom-builds/vault-kube-kms@sha256:33599dd6eee61dcf9a60138759fafda3d88593a3c2072585156882c6b5bd3fa5 (KMS plugin image)
+    - VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/ci/vault-kube-kms:0.1.0-beta-ubi (KMS plugin image)
     - VAULT_KMS_KEY_NAME: kms-key (transit encryption key name)
 
     Note: These Vault configuration values are not configurable via cluster-bot.

ci-operator/step-registry/etcd-encryption/hashicorp-vault/gcp/etcd-encryption-hashicorp-vault-gcp-workflow.yaml

@@ -36,7 +36,7 @@ workflow:
     - VAULT_CHART_VERSION: 0.28.1 (Vault Helm chart version)
     - VAULT_NAMESPACE: vault-kms (namespace for Vault installation)
     - VAULT_SECONDARY_NAMESPACE: vault-kms-secondary (secondary Vault namespace)
-    - VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/control-plane-custom-builds/vault-kube-kms@sha256:33599dd6eee61dcf9a60138759fafda3d88593a3c2072585156882c6b5bd3fa5 (KMS plugin image)
+    - VAULT_KMS_PLUGIN_IMAGE: registry.ci.openshift.org/ci/vault-kube-kms:0.1.0-beta-ubi (KMS plugin image)
     - VAULT_KMS_KEY_NAME: kms-key (transit encryption key name)
 
     Note: These Vault configuration values are not configurable via cluster-bot.

ci-operator/step-registry/etcd-encryption/vault-install/etcd-encryption-vault-install-ref.yaml

@@ -32,11 +32,11 @@ ref:
     documentation: |-
       Namespace where the second Vault Enterprise instance will be installed.
   - name: VAULT_KMS_PLUGIN_IMAGE
-    default: "registry.ci.openshift.org/control-plane-custom-builds/vault-kube-kms@sha256:33599dd6eee61dcf9a60138759fafda3d88593a3c2072585156882c6b5bd3fa5"
+    default: "registry.ci.openshift.org/ci/vault-kube-kms:0.1.0-beta-ubi"
     documentation: |-
       Full reference for the vault-kube-kms plugin image used by encryption-kms tests.
-      Must match the image configured in library-go test helpers until those read this
-      environment variable directly. Override at job level to trial a new plugin image.
+      Mirrored from quay.io/openshifttest/vault-kube-kms via supplementalCIImages.
+      Override at job level to trial a new plugin image.
       On baremetalds jobs the repository, mirror source, and local mirror tag are all
       derived from this value.
   documentation: |-

core-services/image-mirroring/_config.yaml

@@ -1073,10 +1073,8 @@ supplementalCIImages:
     image: quay.io/rh_ee_ves/aro-hcp-e2e-base:v1.0
   ocp-edge-qe/eco-gotests:latest:
     image: quay.io/ocp-edge-qe/eco-gotests:latest
-  control-plane/vault-kube-kms:0.0.1:
-    namespace: control-plane-custom-builds
-    name: vault-kube-kms
-    tag: 0.0.1
+  ci/vault-kube-kms:0.1.0-beta-ubi:
+    image: quay.io/openshifttest/vault-kube-kms:0.1.0-beta-ubi
   ci/vault-enterprise:2.0.0-ent:
     image: quay.io/openshifttest/vault-enterprise:2.0.0-ent
   ci/minio:RELEASE.2025-09-07T16-13-09Z: