[ntnn]

Summary

This is adjacent to #3498.

TL;DR:

1. Moving pkg/crypto to apimachinery/.../pkg/util/crypto
   Why? To have one kcpcrypto
   Why there? Because the helpers added are used in staging repos as well and this mirrors upstreams apimachinery pkg/util/<pkg>
2. Adding baseX{,sha224} helpers to kcpcrypto
   Why?
   1. Because we have many different iterations of this across the codebase, some use a library, some math/big.Int
   2. Because for migration operators need a library function to do the same hashing/encoding of shard names we do
3. Update all hashing/encoding places to use kcpcrypto
   Why? For consistency.

Prose:

Shards names are stored hashed on the Workspace in an annotation internal.tenancy.kcp.io/shard, presumably to not intentionally leak shard names to users.
For migrations we need to provide a library function for operators utilizing the migration primitive to check which shard an LC currently is in and which shard to migrate to.
We currently have many different places where base36, base36sha224 is implemented in different ways, sometimes using the base36 library, sometimes via math/big.Int.
Since these are all roughly the same shape I consolidated them into a tested package.
Most of the callsites are just ephemeral.

These are not:

• pkg/reconciler/tenancy/workspace/workspace_reconcile_scheduling.go:163
  written to the internal.tenancy.kcp.io/shard annotation on Workspace objects
• pkg/reconciler/tenancy/workspace/workspace_reconcile_scheduling.go:445
  used as the LogicalCluster name (ws.Spec.Cluster); a durable workspace identifier
• pkg/index/rewriters/user.go:39
  HomeClusterName becomes the actual logical cluster name for the user's home workspace
• staging/src/github.com/kcp-dev/sdk/apis/apis/v1alpha1/permissionclaims/labels.go and v1alpha2
  produces Kubernetes label keys/values written onto API resources

But all of these produce equivalent output so existing installations are unaffected, this is verified by the commit adding stable hashing/encoding unit tests. To show that the behaviour did not change this commit was PR'd separately here: #4158

What Type of PR Is This?

/kind chore

Related Issue(s)

Fixes #

Release Notes

New utility crypto package in apimachinery for base36/63 related encoding
Updated existing code paths to use new apimachinery crypto package for base36/63 encoding

[mjudeikis]

/lgtm
/approve

[kcp-ci-bot]

LGTM label has been added.

Details

Git tree hash: 888405df1a4eee0ce707999449e4d5a10f75836a

[kcp-ci-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mjudeikis

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [mjudeikis]
• staging/src/github.com/kcp-dev/sdk/apis/OWNERS [mjudeikis]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ntnn]

/retest

unrelated:

 === FAIL: test/e2e/reconciler/workspacedeletion TestWorkspaceDeletion/nested_workspace_cleanup_when_an_org_workspace_is_deleted (31.39s) 

[ntnn]

/retest