OCPBUGS-105399: Remove SigstoreImageVerification feature gate references

pkg/controller/bootstrap/bootstrap.go

@@ -288,7 +288,7 @@ func (b *Bootstrap) Run(destDir string) error {
 
 	configs = append(configs, iconfigs...)
 
-	rconfigs, err := containerruntimeconfig.RunImageBootstrap(b.templatesDir, cconfig, pools, icspRules, idmsRules, itmsRules, imgCfg, clusterImagePolicies, imagePolicies, fgHandler)
+	rconfigs, err := containerruntimeconfig.RunImageBootstrap(b.templatesDir, cconfig, pools, icspRules, idmsRules, itmsRules, imgCfg, clusterImagePolicies, imagePolicies)
 	if err != nil {
 		return err
 	}

pkg/controller/bootstrap/bootstrap_test.go

@@ -257,7 +257,6 @@ func TestBootstrapRunHypershift(t *testing.T) {
 				},
 				Disabled: []apicfgv1.FeatureGateAttributes{
 					{Name: "OSStreams"},
-					{Name: "SigstoreImageVerification"},
 				},
 			}},
 		},

pkg/controller/bootstrap/testdata/bootstrap/featuregate.yaml

@@ -8,5 +8,3 @@ status:
     enabled:
     - name: OpenShiftPodSecurityAdmission
     - name: OSStreams
-    disabled:
-    - name: SigstoreImageVerification

pkg/controller/container-runtime-config/container_runtime_config_controller.go

@@ -242,10 +242,8 @@ func (ctrl *Controller) Run(ctx context.Context, workers int) {
 	listerCaches := []cache.InformerSynced{ctrl.mcpListerSynced, ctrl.mccrListerSynced, ctrl.ccListerSynced,
 		ctrl.imgListerSynced, ctrl.icspListerSynced, ctrl.idmsListerSynced, ctrl.itmsListerSynced, ctrl.clusterVersionListerSynced}
 
-	if ctrl.sigstoreAPIEnabled() {
-		ctrl.addImagePolicyObservers()
-		klog.Info("addded image policy observers with sigstore featuregate enabled")
-	}
+	ctrl.addImagePolicyObservers()
+	klog.Info("added image policy observers")
 
 	if ctrl.criocpEnabled() {
 		ctrl.addCRIOCPObservers()
@@ -408,10 +406,6 @@ func (ctrl *Controller) imagePolicyDeleted(_ interface{}) {
 	ctrl.imgQueue.Add("openshift-config")
 }
 
-func (ctrl *Controller) sigstoreAPIEnabled() bool {
-	return ctrl.fgHandler.Enabled(features.FeatureGateSigstoreImageVerification)
-}
-
 func (ctrl *Controller) additionalStorageConfigEnabled() bool {
 	return ctrl.fgHandler.Enabled(features.FeatureGateAdditionalStorageConfig)
 }
@@ -988,7 +982,7 @@ func (ctrl *Controller) syncImageConfig(key string) error {
 		scopeNamespacePolicies                        map[string]map[string]signature.PolicyRequirements
 	)
 
-	if ctrl.sigstoreAPIEnabled() && ctrl.addedPolicyObservers {
+	if ctrl.addedPolicyObservers {
 		// Find all ClusterImagePolicy objects
 		clusterImagePolicies, err = ctrl.clusterImagePolicyLister.List(labels.Everything())
 		if err != nil && errors.IsNotFound(err) {
@@ -1367,20 +1361,16 @@ func (ctrl *Controller) syncImagePolicyStatusOnly(namespace, imagepolicy, condit
 // RunImageBootstrap generates MachineConfig objects for mcpPools that would have been generated by syncImageConfig,
 // except that mcfgv1.Image is not available.
 func RunImageBootstrap(templateDir string, controllerConfig *mcfgv1.ControllerConfig, mcpPools []*mcfgv1.MachineConfigPool, icspRules []*apioperatorsv1alpha1.ImageContentSourcePolicy,
-	idmsRules []*apicfgv1.ImageDigestMirrorSet, itmsRules []*apicfgv1.ImageTagMirrorSet, imgCfg *apicfgv1.Image, clusterImagePolicies []*apicfgv1.ClusterImagePolicy, imagePolicies []*apicfgv1.ImagePolicy,
-	fgHandler ctrlcommon.FeatureGatesHandler) ([]*mcfgv1.MachineConfig, error) {
+	idmsRules []*apicfgv1.ImageDigestMirrorSet, itmsRules []*apicfgv1.ImageTagMirrorSet, imgCfg *apicfgv1.Image, clusterImagePolicies []*apicfgv1.ClusterImagePolicy, imagePolicies []*apicfgv1.ImagePolicy) ([]*mcfgv1.MachineConfig, error) {
 
 	var (
 		insecureRegs, registriesBlocked, policyBlocked, allowedRegs, searchRegs []string
 		err                                                                     error
 	)
 
-	clusterScopePolicies := map[string]signature.PolicyRequirements{}
-	scopeNamespacePolicies := map[string]map[string]signature.PolicyRequirements{}
-	if fgHandler.Enabled(features.FeatureGateSigstoreImageVerification) {
-		if clusterScopePolicies, scopeNamespacePolicies, err = getValidScopePolicies(clusterImagePolicies, imagePolicies, nil); err != nil {
-			return nil, err
-		}
+	clusterScopePolicies, scopeNamespacePolicies, err := getValidScopePolicies(clusterImagePolicies, imagePolicies, nil)
+	if err != nil {
+		return nil, err
 	}
 
 	// Read the search, insecure, blocked, and allowed registries from the cluster-wide Image CR if it is not nil

pkg/controller/container-runtime-config/container_runtime_config_controller_test.go

@@ -93,7 +93,6 @@ func newFixture(t *testing.T) *fixture {
 	f.objects = []runtime.Object{}
 	f.fgHandler = ctrlcommon.NewFeatureGatesHardcodedHandler(
 		[]apicfgv1.FeatureGateName{
-			features.FeatureGateSigstoreImageVerification,
 			features.FeatureGateCRIOCredentialProviderConfig,
 		},
 		[]apicfgv1.FeatureGateName{},
@@ -1386,10 +1385,7 @@ func TestRunImageBootstrap(t *testing.T) {
 				// Adding the release-image registry "release-reg.io" to the list of blocked registries to ensure that is it not added to
 				// both registries.conf and policy.json as blocked
 				imgCfg := newImageConfig("cluster", &apicfgv1.RegistrySources{InsecureRegistries: []string{"insecure-reg-1.io", "insecure-reg-2.io"}, BlockedRegistries: []string{"blocked-reg.io", "release-reg.io"}, ContainerRuntimeSearchRegistries: []string{"search-reg.io"}})
-				// set FeatureGateSigstoreImageVerification enabled for testing
-				fgHandler := ctrlcommon.NewFeatureGatesHardcodedHandler([]apicfgv1.FeatureGateName{features.FeatureGateSigstoreImageVerification}, []apicfgv1.FeatureGateName{})
-
-				mcs, err := RunImageBootstrap("../../../templates", cc, pools, tc.icspRules, tc.idmsRules, tc.itmsRules, imgCfg, tc.clusterImagePolicies, tc.imagePolicies, fgHandler)
+				mcs, err := RunImageBootstrap("../../../templates", cc, pools, tc.icspRules, tc.idmsRules, tc.itmsRules, imgCfg, tc.clusterImagePolicies, tc.imagePolicies)
 				require.NoError(t, err)
 
 				require.Len(t, mcs, len(pools))
@@ -2132,7 +2128,6 @@ func TestContainerRuntimeConfigAdditionalStorageConfig(t *testing.T) {
 			// Enable the AdditionalStorageConfig feature gate
 			f.fgHandler = ctrlcommon.NewFeatureGatesHardcodedHandler(
 				[]apicfgv1.FeatureGateName{
-					features.FeatureGateSigstoreImageVerification,
 					features.FeatureGateAdditionalStorageConfig,
 				},
 				[]apicfgv1.FeatureGateName{},
@@ -2185,7 +2180,7 @@ func TestContainerRuntimeConfigAdditionalStorageConfigFeatureGateDisabled(t *tes
 			f := newFixture(t)
 			// Disable the AdditionalStorageConfig feature gate
 			f.fgHandler = ctrlcommon.NewFeatureGatesHardcodedHandler(
-				[]apicfgv1.FeatureGateName{features.FeatureGateSigstoreImageVerification},
+				[]apicfgv1.FeatureGateName{},
 				[]apicfgv1.FeatureGateName{features.FeatureGateAdditionalStorageConfig},
 			)
 			f.newController()