workqueue.DefaultTypedControllerRateLimiter[string](),
			workqueue.TypedRateLimitingQueueConfig[string]{Name: name},
		),
		apiServerID: apiServerID,
		getEncryptionConfigHash: func(_ context.Context, filepath string) (string, error) {
			return encryptionconfig.GetEncryptionConfigHash(filepath)
		},
		loadEncryptionConfig: encryptionconfig.LoadEncryptionConfig,
	}
}

// Run starts the controller and blocks until ctx is canceled.

				loadCalls++
				queue.ctx = ctx
				return test.mockLoadEncryptionConfig(ctx, filepath, reload, apiServerID)
			}
			d.getEncryptionConfigHash = func(ctx context.Context, filepath string) (string, error) {
				hashCalls++
				queue.ctx = ctx
				return test.mockGetEncryptionConfigHash(ctx, filepath)
			}

		tt := tt
		t.Run(tt.name, func(t *testing.T) {
			t.Parallel()

			got, err := GetEncryptionConfigHash(tt.filepath)
			if errString(err) != tt.wantErr {
				t.Errorf("GetEncryptionConfigHash() error = %v, wantErr %v", err, tt.wantErr)
				return
			}
			if got != tt.wantHash {
				t.Errorf("GetEncryptionConfigHash() got = %v, want %v", got, tt.wantHash)
			}
		})
	}

	}

	return data, computeEncryptionConfigHash(data), nil
}

// GetEncryptionConfigHash reads the encryption configuration file at filepath and returns the hash of the file.
// It does not attempt to decode or load the config, and serves as a cheap check to determine if the file has changed.
func GetEncryptionConfigHash(filepath string) (string, error) {
	_, contentHash, err := loadDataAndHash(filepath)