[release-4.22]AGENT-1548: Backport NoRegistryClusterInstall feature to release-4.22

cmd/machine-config-controller/start.go

@@ -7,6 +7,7 @@ import (
 	"os"
 
 	features "github.com/openshift/api/features"
+	mcfginformersv1 "github.com/openshift/client-go/machineconfiguration/informers/externalversions/machineconfiguration/v1"
 	"github.com/openshift/machine-config-operator/cmd/common"
 	"github.com/openshift/machine-config-operator/internal/clients"
 	bootimagecontroller "github.com/openshift/machine-config-operator/pkg/controller/bootimage"
@@ -23,6 +24,7 @@ import (
 	"github.com/openshift/machine-config-operator/pkg/version"
 	"github.com/spf13/cobra"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	coreinformersv1 "k8s.io/client-go/informers/core/v1"
 	"k8s.io/client-go/tools/leaderelection"
 	"k8s.io/klog/v2"
 )
@@ -107,6 +109,8 @@ func runStartCmd(_ *cobra.Command, _ []string) {
 			ctrlctx.KubeNamespacedInformerFactory.Core().V1().Secrets(),
 			ctrlctx.KubeNamespacedInformerFactory.Core().V1().ConfigMaps(),
 			ctrlctx.ConfigInformerFactory.Config().V1().Infrastructures(),
+			ctrlctx.FeatureGatesHandler,
+			ctrlctx.ClientBuilder.MachineConfigClientOrDie("cert-rotation-controller"),
 		)
 		if err != nil {
 			klog.Fatalf("unable to start cert rotation controller: %v", err)
@@ -134,11 +138,14 @@ func runStartCmd(_ *cobra.Command, _ []string) {
 
 		if ctrlctx.FeatureGatesHandler.Enabled(features.FeatureGateNoRegistryClusterInstall) {
 			iriController := internalreleaseimage.New(
-				ctrlctx.InformerFactory.Machineconfiguration().V1alpha1().InternalReleaseImages(),
+				ctrlctx.InformerFactory.Machineconfiguration().V1().InternalReleaseImages(),
 				ctrlctx.InformerFactory.Machineconfiguration().V1().ControllerConfigs(),
 				ctrlctx.InformerFactory.Machineconfiguration().V1().MachineConfigs(),
 				ctrlctx.ConfigInformerFactory.Config().V1().ClusterVersions(),
 				ctrlctx.KubeInformerFactory.Core().V1().Secrets(),
+				ctrlctx.InformerFactory.Machineconfiguration().V1().MachineConfigNodes(),
+				ctrlctx.KubeInformerFactory.Core().V1().Nodes(),
+				ctrlctx.ConfigInformerFactory.Config().V1().Infrastructures(),
 				ctrlctx.ClientBuilder.KubeClientOrDie("internalreleaseimage-controller"),
 				ctrlctx.ClientBuilder.MachineConfigClientOrDie("internalreleaseimage-controller"))
 
@@ -201,6 +208,16 @@ func runStartCmd(_ *cobra.Command, _ []string) {
 }
 
 func createControllers(ctx *ctrlcommon.ControllerContext) []ctrlcommon.Controller {
+	// Only watch IRI informers when the feature gate is enabled. The
+	// InternalReleaseImages CRD is not installed on clusters where the gate is
+	// off, so the informer list call would fail and WaitForCacheSync in the
+	// template controller would block forever.
+	var iriSecretsInformer coreinformersv1.SecretInformer
+	var iriInformer mcfginformersv1.InternalReleaseImageInformer
+	if ctx.FeatureGatesHandler.Enabled(features.FeatureGateNoRegistryClusterInstall) {
+		iriSecretsInformer = ctx.KubeInformerFactory.Core().V1().Secrets()
+		iriInformer = ctx.InformerFactory.Machineconfiguration().V1().InternalReleaseImages()
+	}
 
 	var controllers []ctrlcommon.Controller
 	controllers = append(controllers,
@@ -209,9 +226,12 @@ func createControllers(ctx *ctrlcommon.ControllerContext) []ctrlcommon.Controlle
 			rootOpts.templates,
 			ctx.InformerFactory.Machineconfiguration().V1().ControllerConfigs(),
 			ctx.OpenShiftConfigKubeNamespacedInformerFactory.Core().V1().Secrets(),
+			iriSecretsInformer,
+			iriInformer,
 			ctx.ConfigInformerFactory.Config().V1().APIServers(),
 			ctx.ClientBuilder.KubeClientOrDie("template-controller"),
 			ctx.ClientBuilder.MachineConfigClientOrDie("template-controller"),
+			ctx.FeatureGatesHandler,
 		),
 		// Add all "sub-renderers here"
 		kubeletconfig.New(

cmd/machine-config-daemon/start.go

@@ -239,7 +239,7 @@ func runStartCmd(_ *cobra.Command, _ []string) {
 		internalReleaseImageManager := internalreleaseimage.New(
 			startOpts.nodeName,
 			ctrlctx.ClientBuilder.MachineConfigClientOrDie(componentName),
-			ctrlctx.InformerFactory.Machineconfiguration().V1alpha1().InternalReleaseImages(),
+			ctrlctx.InformerFactory.Machineconfiguration().V1().InternalReleaseImages(),
 			ctrlctx.InformerFactory.Machineconfiguration().V1().MachineConfigNodes(),
 		)
 		go internalReleaseImageManager.Run(1, stopCh)

cmd/machine-config-operator/start.go

@@ -69,7 +69,7 @@ func runStartCmd(_ *cobra.Command, _ []string) {
 
 		// Only pass IRI informer when the feature gate is enabled to avoid
 		// watching for a CRD that may not exist
-		var iriInformer = ctrlctx.InformerFactory.Machineconfiguration().V1alpha1().InternalReleaseImages()
+		var iriInformer = ctrlctx.InformerFactory.Machineconfiguration().V1().InternalReleaseImages()
 		if !ctrlctx.FeatureGatesHandler.Enabled(features.FeatureGateNoRegistryClusterInstall) {
 			iriInformer = nil
 		}

go.mod

@@ -37,8 +37,8 @@ require (
 	github.com/onsi/gomega v1.38.2
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/openshift-eng/openshift-tests-extension v0.0.0-20260127124016-0fed2b824818
-	github.com/openshift/api v0.0.0-20260326111139-30c2ef7a272e
-	github.com/openshift/client-go v0.0.0-20260330134249-7e1499aaacd7
+	github.com/openshift/api v0.0.0-20260717133910-57eb58a15422
+	github.com/openshift/client-go v0.0.0-20260720094807-fbc45213df28
 	github.com/openshift/library-go v0.0.0-20260303171201-5d9eb6295ff6
 	github.com/openshift/runtime-utils v0.0.0-20230921210328-7bdb5b9c177b
 	github.com/prometheus/client_golang v1.23.2

go.sum

@@ -623,10 +623,10 @@ github.com/opencontainers/selinux v1.13.0 h1:Zza88GWezyT7RLql12URvoxsbLfjFx988+L
 github.com/opencontainers/selinux v1.13.0/go.mod h1:XxWTed+A/s5NNq4GmYScVy+9jzXhGBVEOAyucdRUY8s=
 github.com/openshift-eng/openshift-tests-extension v0.0.0-20260127124016-0fed2b824818 h1:jJLE/aCAqDf8U4wc3bE1IEKgIxbb0ICjCNVFA49x/8s=
 github.com/openshift-eng/openshift-tests-extension v0.0.0-20260127124016-0fed2b824818/go.mod h1:6gkP5f2HL0meusT0Aim8icAspcD1cG055xxBZ9yC68M=
-github.com/openshift/api v0.0.0-20260326111139-30c2ef7a272e h1:SbgwHvkc6vgiqHOfGrbumjPvtOvJmCwJoFEwr7rAKzY=
-github.com/openshift/api v0.0.0-20260326111139-30c2ef7a272e/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
-github.com/openshift/client-go v0.0.0-20260330134249-7e1499aaacd7 h1:5GSoQlywIwYsRCw3qN+ZDmN6HrXTMZfI33bdRNm2jRQ=
-github.com/openshift/client-go v0.0.0-20260330134249-7e1499aaacd7/go.mod h1:HhXTUIMhgzxR3Ln/zEkr4QjTL0NN7A+t9Py/we9j2ug=
+github.com/openshift/api v0.0.0-20260717133910-57eb58a15422 h1:XIUxnjPKf+qjoOGrdjow458H9hgA4sx3QKACCt+Fy58=
+github.com/openshift/api v0.0.0-20260717133910-57eb58a15422/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
+github.com/openshift/client-go v0.0.0-20260720094807-fbc45213df28 h1:7umi+uA/Bm1PAEXduwzfQRsMZ8WR0/LHh9YXezJnxaA=
+github.com/openshift/client-go v0.0.0-20260720094807-fbc45213df28/go.mod h1:dOrynOHvh9q01db+7+Eu8O0do1FTrAUQSnI9tzJhO8Y=
 github.com/openshift/kubernetes v1.30.1-0.20260305123649-d18f3f005eaa h1:/gPMWR7fdCC3S4wHALD6Em+vztl1q9/cOpdMkFZwDus=
 github.com/openshift/kubernetes v1.30.1-0.20260305123649-d18f3f005eaa/go.mod h1:1r2FIoYrPU0110cjYlWAwNcbiqRPLWAgmZK4d0YeEZw=
 github.com/openshift/kubernetes/staging/src/k8s.io/api v0.0.0-20260305123649-d18f3f005eaa h1:ifOqAFthJWnT1HS6Sq2AcLQWNSJ1+XEiyA9eo+PIcR0=

install/0000_80_machine-config_00_service.yaml

@@ -85,3 +85,23 @@ spec:
     port: 9637
     targetPort: 9637
     protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: internal-release-image-registry
+  namespace: openshift-machine-config-operator
+  labels:
+    k8s-app: internal-release-image-registry
+    # This Service has no backing pods. It exists solely to document port 22625
+    # in the OCP communication flows matrix (see enhancements/network/communication-flows-matrix-ingress.md).
+    not-active-service: "true"
+  annotations:
+    include.release.openshift.io/self-managed-high-availability: "true"
+spec:
+  type: ClusterIP
+  ports:
+  - name: https
+    port: 22625
+    targetPort: 22625
+    protocol: TCP

manifests/machineconfigcontroller/internalreleaseimage-deletion-guard-validatingadmissionpolicy.yaml

@@ -13,10 +13,11 @@ spec:
     objectSelector: {}
     resourceRules:
     - apiGroups:   ["machineconfiguration.openshift.io"]
-      apiVersions: ["v1alpha1"]
+      apiVersions: ["v1"]
       operations:  ["DELETE"]
       resources:   ["internalreleaseimages"]
       scope: "*"
   validations:
-    - expression: "!oldObject.status.releases.exists(r, has(r.image) && r.image == params.status.desired.image)"
+    - expression: "!oldObject.status.releases.exists(r, has(r.image) && r.image.split('@')[1] == params.status.desired.image.split('@')[1])"
       message: "Cannot delete InternalReleaseImage while the cluster is using a release bundle from this resource. The current cluster release image matches a release stored in this InternalReleaseImage. Please upgrade or downgrade to a different release before deletion."
+      reason: Invalid

pkg/controller/bootstrap/bootstrap.go

@@ -93,10 +93,9 @@ func (b *Bootstrap) Run(destDir string) error {
 	imagev1.AddToScheme(scheme)
 	codecFactory := serializer.NewCodecFactory(scheme)
 	decoder := codecFactory.UniversalDecoder(
-		mcfgv1.GroupVersion, apioperatorsv1alpha1.GroupVersion,
+		mcfgv1.GroupVersion, mcfgv1alpha1.GroupVersion, apioperatorsv1alpha1.GroupVersion,
 		apicfgv1.GroupVersion, apicfgv1alpha1.GroupVersion,
-		corev1.SchemeGroupVersion, mcfgv1alpha1.GroupVersion,
-		imagev1.SchemeGroupVersion)
+		corev1.SchemeGroupVersion, imagev1.SchemeGroupVersion)
 
 	var (
 		cconfig              *mcfgv1.ControllerConfig
@@ -115,9 +114,10 @@ func (b *Bootstrap) Run(destDir string) error {
 		imgCfg               *apicfgv1.Image
 		apiServer            *apicfgv1.APIServer
 		imageStream          *imagev1.ImageStream
-		iri                  *mcfgv1alpha1.InternalReleaseImage
+		iri                  bool
 		iriTLSCert           *corev1.Secret
 		osImageStream        *mcfgv1alpha1.OSImageStream
+		iriCredentialsSecret        *corev1.Secret
 	)
 	for _, info := range infos {
 		if info.IsDir() {
@@ -183,9 +183,13 @@ func (b *Bootstrap) Run(destDir string) error {
 				if obj.GetName() == ctrlcommon.APIServerInstanceName {
 					apiServer = obj
 				}
+			case *mcfgv1.InternalReleaseImage:
+				if obj.GetName() == ctrlcommon.InternalReleaseImageInstanceName {
+					iri = true
+				}
 			case *mcfgv1alpha1.InternalReleaseImage:
 				if obj.GetName() == ctrlcommon.InternalReleaseImageInstanceName {
-					iri = obj
+					iri = true
 				}
 			case *imagev1.ImageStream:
 				for _, tag := range obj.Spec.Tags {
@@ -202,6 +206,9 @@ func (b *Bootstrap) Run(destDir string) error {
 				if obj.GetName() == ctrlcommon.InternalReleaseImageTLSSecretName {
 					iriTLSCert = obj
 				}
+				if obj.GetName() == ctrlcommon.InternalReleaseImageAuthSecretName {
+					iriCredentialsSecret = obj
+				}
 			case *mcfgv1alpha1.OSImageStream:
 				// If given, it's treated as user input with config such as the default stream
 				osImageStream = obj
@@ -259,6 +266,17 @@ func (b *Bootstrap) Run(destDir string) error {
 	}
 
 	pullSecretBytes := pullSecret.Data[corev1.DockerConfigJsonKey]
+
+	// Merge IRI registry credentials into the pull secret for first-boot authentication.
+	// The template controller has not yet run at this point, so machine-config-daemon-pull.service
+	// would otherwise fail to authenticate against the IRI registry.
+	// Merge is a no-op if the feature gate is off or the IRI resource is absent.
+	merger := ctrlcommon.NewIRISecretMergerFromObjects(iriCredentialsSecret, cconfig, fgHandler, iri)
+	pullSecretBytes, err = merger.Merge(pullSecretBytes)
+	if err != nil {
+		return fmt.Errorf("could not merge IRI credentials into pull secret for bootstrap: %w", err)
+	}
+
 	iconfigs, err := template.RunBootstrap(b.templatesDir, cconfig, pullSecretBytes, apiServer)
 	if err != nil {
 		return err
@@ -320,8 +338,8 @@ func (b *Bootstrap) Run(destDir string) error {
 	klog.Infof("Successfully generated MachineConfigs from kubelet configs.")
 
 	if fgHandler != nil && fgHandler.Enabled(features.FeatureGateNoRegistryClusterInstall) {
-		if iri != nil {
-			iriConfigs, err := internalreleaseimage.RunInternalReleaseImageBootstrap(iri, iriTLSCert, cconfig)
+		if iri {
+			iriConfigs, err := internalreleaseimage.RunInternalReleaseImageBootstrap(iriTLSCert, iriCredentialsSecret, cconfig)
 			if err != nil {
 				return err
 			}