diff --git a/pkg/controller/bootstrap/bootstrap.go b/pkg/controller/bootstrap/bootstrap.go index 5da3beadb5..c7d2a1651a 100644 --- a/pkg/controller/bootstrap/bootstrap.go +++ b/pkg/controller/bootstrap/bootstrap.go @@ -288,7 +288,7 @@ func (b *Bootstrap) Run(destDir string) error { configs = append(configs, iconfigs...) - rconfigs, err := containerruntimeconfig.RunImageBootstrap(b.templatesDir, cconfig, pools, icspRules, idmsRules, itmsRules, imgCfg, clusterImagePolicies, imagePolicies, fgHandler) + rconfigs, err := containerruntimeconfig.RunImageBootstrap(b.templatesDir, cconfig, pools, icspRules, idmsRules, itmsRules, imgCfg, clusterImagePolicies, imagePolicies) if err != nil { return err } diff --git a/pkg/controller/bootstrap/bootstrap_test.go b/pkg/controller/bootstrap/bootstrap_test.go index 7257bc6821..a468fd9abf 100644 --- a/pkg/controller/bootstrap/bootstrap_test.go +++ b/pkg/controller/bootstrap/bootstrap_test.go @@ -257,7 +257,6 @@ func TestBootstrapRunHypershift(t *testing.T) { }, Disabled: []apicfgv1.FeatureGateAttributes{ {Name: "OSStreams"}, - {Name: "SigstoreImageVerification"}, }, }}, }, diff --git a/pkg/controller/bootstrap/testdata/bootstrap/featuregate.yaml b/pkg/controller/bootstrap/testdata/bootstrap/featuregate.yaml index 2a6f03d7d8..2a65d62a85 100644 --- a/pkg/controller/bootstrap/testdata/bootstrap/featuregate.yaml +++ b/pkg/controller/bootstrap/testdata/bootstrap/featuregate.yaml @@ -8,5 +8,3 @@ status: enabled: - name: OpenShiftPodSecurityAdmission - name: OSStreams - disabled: - - name: SigstoreImageVerification diff --git a/pkg/controller/container-runtime-config/container_runtime_config_controller.go b/pkg/controller/container-runtime-config/container_runtime_config_controller.go index f00a93cd97..83e25a32af 100644 --- a/pkg/controller/container-runtime-config/container_runtime_config_controller.go +++ b/pkg/controller/container-runtime-config/container_runtime_config_controller.go @@ -242,10 +242,8 @@ func (ctrl *Controller) Run(ctx context.Context, workers int) { listerCaches := []cache.InformerSynced{ctrl.mcpListerSynced, ctrl.mccrListerSynced, ctrl.ccListerSynced, ctrl.imgListerSynced, ctrl.icspListerSynced, ctrl.idmsListerSynced, ctrl.itmsListerSynced, ctrl.clusterVersionListerSynced} - if ctrl.sigstoreAPIEnabled() { - ctrl.addImagePolicyObservers() - klog.Info("addded image policy observers with sigstore featuregate enabled") - } + ctrl.addImagePolicyObservers() + klog.Info("added image policy observers") if ctrl.criocpEnabled() { ctrl.addCRIOCPObservers() @@ -408,10 +406,6 @@ func (ctrl *Controller) imagePolicyDeleted(_ interface{}) { ctrl.imgQueue.Add("openshift-config") } -func (ctrl *Controller) sigstoreAPIEnabled() bool { - return ctrl.fgHandler.Enabled(features.FeatureGateSigstoreImageVerification) -} - func (ctrl *Controller) additionalStorageConfigEnabled() bool { return ctrl.fgHandler.Enabled(features.FeatureGateAdditionalStorageConfig) } @@ -988,7 +982,7 @@ func (ctrl *Controller) syncImageConfig(key string) error { scopeNamespacePolicies map[string]map[string]signature.PolicyRequirements ) - if ctrl.sigstoreAPIEnabled() && ctrl.addedPolicyObservers { + if ctrl.addedPolicyObservers { // Find all ClusterImagePolicy objects clusterImagePolicies, err = ctrl.clusterImagePolicyLister.List(labels.Everything()) if err != nil && errors.IsNotFound(err) { @@ -1367,20 +1361,16 @@ func (ctrl *Controller) syncImagePolicyStatusOnly(namespace, imagepolicy, condit // RunImageBootstrap generates MachineConfig objects for mcpPools that would have been generated by syncImageConfig, // except that mcfgv1.Image is not available. func RunImageBootstrap(templateDir string, controllerConfig *mcfgv1.ControllerConfig, mcpPools []*mcfgv1.MachineConfigPool, icspRules []*apioperatorsv1alpha1.ImageContentSourcePolicy, - idmsRules []*apicfgv1.ImageDigestMirrorSet, itmsRules []*apicfgv1.ImageTagMirrorSet, imgCfg *apicfgv1.Image, clusterImagePolicies []*apicfgv1.ClusterImagePolicy, imagePolicies []*apicfgv1.ImagePolicy, - fgHandler ctrlcommon.FeatureGatesHandler) ([]*mcfgv1.MachineConfig, error) { + idmsRules []*apicfgv1.ImageDigestMirrorSet, itmsRules []*apicfgv1.ImageTagMirrorSet, imgCfg *apicfgv1.Image, clusterImagePolicies []*apicfgv1.ClusterImagePolicy, imagePolicies []*apicfgv1.ImagePolicy) ([]*mcfgv1.MachineConfig, error) { var ( insecureRegs, registriesBlocked, policyBlocked, allowedRegs, searchRegs []string err error ) - clusterScopePolicies := map[string]signature.PolicyRequirements{} - scopeNamespacePolicies := map[string]map[string]signature.PolicyRequirements{} - if fgHandler.Enabled(features.FeatureGateSigstoreImageVerification) { - if clusterScopePolicies, scopeNamespacePolicies, err = getValidScopePolicies(clusterImagePolicies, imagePolicies, nil); err != nil { - return nil, err - } + clusterScopePolicies, scopeNamespacePolicies, err := getValidScopePolicies(clusterImagePolicies, imagePolicies, nil) + if err != nil { + return nil, err } // Read the search, insecure, blocked, and allowed registries from the cluster-wide Image CR if it is not nil diff --git a/pkg/controller/container-runtime-config/container_runtime_config_controller_test.go b/pkg/controller/container-runtime-config/container_runtime_config_controller_test.go index 9841e5659b..e1ddf0ef3f 100644 --- a/pkg/controller/container-runtime-config/container_runtime_config_controller_test.go +++ b/pkg/controller/container-runtime-config/container_runtime_config_controller_test.go @@ -93,7 +93,6 @@ func newFixture(t *testing.T) *fixture { f.objects = []runtime.Object{} f.fgHandler = ctrlcommon.NewFeatureGatesHardcodedHandler( []apicfgv1.FeatureGateName{ - features.FeatureGateSigstoreImageVerification, features.FeatureGateCRIOCredentialProviderConfig, }, []apicfgv1.FeatureGateName{}, @@ -1386,10 +1385,7 @@ func TestRunImageBootstrap(t *testing.T) { // Adding the release-image registry "release-reg.io" to the list of blocked registries to ensure that is it not added to // both registries.conf and policy.json as blocked imgCfg := newImageConfig("cluster", &apicfgv1.RegistrySources{InsecureRegistries: []string{"insecure-reg-1.io", "insecure-reg-2.io"}, BlockedRegistries: []string{"blocked-reg.io", "release-reg.io"}, ContainerRuntimeSearchRegistries: []string{"search-reg.io"}}) - // set FeatureGateSigstoreImageVerification enabled for testing - fgHandler := ctrlcommon.NewFeatureGatesHardcodedHandler([]apicfgv1.FeatureGateName{features.FeatureGateSigstoreImageVerification}, []apicfgv1.FeatureGateName{}) - - mcs, err := RunImageBootstrap("../../../templates", cc, pools, tc.icspRules, tc.idmsRules, tc.itmsRules, imgCfg, tc.clusterImagePolicies, tc.imagePolicies, fgHandler) + mcs, err := RunImageBootstrap("../../../templates", cc, pools, tc.icspRules, tc.idmsRules, tc.itmsRules, imgCfg, tc.clusterImagePolicies, tc.imagePolicies) require.NoError(t, err) require.Len(t, mcs, len(pools)) @@ -2132,7 +2128,6 @@ func TestContainerRuntimeConfigAdditionalStorageConfig(t *testing.T) { // Enable the AdditionalStorageConfig feature gate f.fgHandler = ctrlcommon.NewFeatureGatesHardcodedHandler( []apicfgv1.FeatureGateName{ - features.FeatureGateSigstoreImageVerification, features.FeatureGateAdditionalStorageConfig, }, []apicfgv1.FeatureGateName{}, @@ -2185,7 +2180,7 @@ func TestContainerRuntimeConfigAdditionalStorageConfigFeatureGateDisabled(t *tes f := newFixture(t) // Disable the AdditionalStorageConfig feature gate f.fgHandler = ctrlcommon.NewFeatureGatesHardcodedHandler( - []apicfgv1.FeatureGateName{features.FeatureGateSigstoreImageVerification}, + []apicfgv1.FeatureGateName{}, []apicfgv1.FeatureGateName{features.FeatureGateAdditionalStorageConfig}, ) f.newController()